CheckOps home

Tools directory

K

CheckOps

kube-bench

kube-bench is Aqua Security's Apache-2.0 tool that checks whether Kubernetes is deployed according to the CIS Kubernetes Benchmark.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

kube-bench checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark. Tests are configured with YAML, making it easy to update as the benchmark evolves.

The source code is at aquasecurity/kube-bench on GitHub under the Apache-2.0 licence, with about 8,300 stars; the most recent commit was on 26 October 2026.

Features

  1. CIS benchmark checks: Control plane, nodes and policies.
  2. YAML-configured tests: Easy updates.
  3. Run as a Job: Deploy in-cluster.
  4. Managed Kubernetes support: Configs for several managed platforms; see docs.
  5. JSON output: For reporting.

Pros

  1. Free to use: Open source under Apache-2.0.
  2. Maintained: Commits as recent as 26 October 2026.
  3. Community: About 8,300 GitHub stars.

Cons

  1. Benchmark scope: Covers CIS items, not workload vulnerabilities.
  2. Access needed: Requires host-level access on nodes.
kubectl apply -f job.yaml   # from the repository
kubectl logs job/kube-bench

Resources:

Pricing

kube-bench is free and open source under the Apache-2.0 licence.

  1. Cluster operators auditing CIS compliance.
  2. Security teams checking cluster hardening.
  3. Not a fit for scanning application images.

Conclusion

kube-bench is the standard way to check clusters against the CIS Kubernetes Benchmark.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with kube-bench side by side.