kube-bench (Aqua Security)

What it is

A Go program that runs the checks from the CIS Kubernetes Benchmark on cluster nodes and reports each as pass, fail, warn, or info with a remediation hint. It includes profiles for managed services such as EKS, GKE, AKS, and OpenShift.

What it helps with

- Auditing control plane and worker node settings
- Showing exactly which config flags fail a benchmark item
- Running as a Kubernetes job to check every node
- Producing evidence for compliance reviews

Who it's for

Platform engineers, cluster administrators, and security teams responsible for clusters they own or are authorized to audit.

Worth knowing

It inspects config files and process flags on the node itself, so it usually runs as a privileged pod or directly on the host. Benchmark versions are picked automatically from the detected Kubernetes version.

Does it scan workloads or images?
No, it checks node and cluster configuration, while Trivy covers images and Kubernetes resources.

How does it compare with Kubescape?
In our view kube-bench is the focused choice for CIS node checks, and Kubescape adds broader posture frameworks across the cluster.