Lab 01 — CIS Kubernetes Benchmark Assessment

Mission Information

Item	Details
Lab ID	K8S-COMPLIANCE-LAB-01
Difficulty	Intermediate
Estimated Time	4–6 Hours
Environment	Kubernetes Training Cluster
Platform	Kubernetes, kube-bench, kubectl, Linux
Cost	Free
Primary Role	Kubernetes Security Engineer
Supporting Roles	Cloud Security Engineer, Compliance Analyst, Platform Engineer, DevSecOps Engineer
Module	Kubernetes Benchmarks & Compliance
Previous Lesson	Lesson 11 — Security Best Practices
Next Lab	Lab 02 — Gatekeeper Policies

Mission Scenario

CloudNova Technologies has successfully deployed multiple Kubernetes production clusters supporting financial applications, healthcare services and AI workloads.

Before the next production release, the Internal Audit team and Chief Information Security Officer (CISO) require an independent compliance assessment against the CIS Kubernetes Benchmark.

Recent observations include:

Inconsistent API Server configuration
Unknown kubelet security posture
Worker node hardening differences
Missing audit configurations
Excessive permissions
Weak authentication controls
Missing encryption validation
Pod Security inconsistencies

The organisation must determine whether its Kubernetes clusters satisfy industry-recognised hardening standards before approving production deployments.

Your mission is to perform an enterprise CIS Benchmark assessment, analyse the findings, prioritise risks and produce a management-ready compliance report.

Learning Objectives

By completing this lab you will learn how to:

Understand the CIS Kubernetes Benchmark
Perform Kubernetes benchmark assessments
Install kube-bench
Assess control plane security
Assess worker node security
Interpret benchmark findings
Differentiate PASS, FAIL and WARN results
Prioritise remediation activities
Validate Kubernetes hardening
Produce compliance evidence
Build executive compliance reports

Enterprise Assessment Architecture

               Kubernetes Cluster

                      │

      ┌───────────────┼───────────────┐

      ▼                               ▼

Control Plane                  Worker Nodes

      │                               │

      └───────────────┬───────────────┘

                      │

                kube-bench

                      │

      ┌───────────────┼───────────────┐

      ▼               ▼               ▼

PASS            WARN            FAIL

                      │

                      ▼

          Enterprise Assessment

                      │

                      ▼

      Compliance Report & Remediation

Enterprise Compliance Workflow

Cluster Discovery

      │

      ▼

Benchmark Execution

      │

      ▼

Control Analysis

      │

      ▼

Evidence Collection

      │

      ▼

Risk Assessment

      │

      ▼

Compliance Report

      │

      ▼

Remediation Plan

Lab Outcomes

By the end of this lab you will have:

Installed kube-bench
Executed a CIS Benchmark assessment
Reviewed benchmark sections
Identified failed controls
Analysed security risks
Prioritised remediation
Produced compliance evidence
Created an enterprise compliance report

Prerequisites

Before beginning ensure you have:

Kubernetes Cluster
kubectl
Cluster Administrator access
Linux shell
Internet access
Git
Docker (optional)

Tools Used

Tool	Purpose
kube-bench	CIS Benchmark Assessment
kubectl	Kubernetes Administration
jq	JSON Parsing
Linux	Host Administration
Git	Repository Download
Docker	Optional kube-bench Execution

Recommended Lab Structure

lab-01-cis-benchmark/

├── reports/
│   ├── kube-bench.txt
│   ├── kube-bench.json
│   ├── findings.md
│   ├── remediation.md
│   └── executive-summary.md
│
├── evidence/
│   ├── cluster-version.txt
│   ├── node-list.txt
│   ├── benchmark-version.txt
│   └── screenshots/
│
└── assessment/
    ├── compliance-matrix.md
    └── risk-register.md

Task 01 — Discover the Cluster

Identify the cluster.

kubectl cluster-info

Record:

Cluster Name
Kubernetes Version
API Server
Platform
Environment

Save evidence.

Task 02 — Identify Kubernetes Version

kubectl version

Determine:

Server Version
Client Version

Ensure the benchmark version matches the Kubernetes version.

Task 03 — Review Cluster Nodes

kubectl get nodes -o wide

Record:

Control Plane Nodes
Worker Nodes
Operating Systems
Kernel Version
Runtime

Task 04 — Install kube-bench

Download.

git clone https://github.com/aquasecurity/kube-bench.git

Run.

cd kube-bench

Verify installation.

Task 05 — Execute kube-bench

Run.

kube-bench

Save output.

kube-bench > reports/kube-bench.txt

Task 06 — Export JSON Results

kube-bench --json \
> reports/kube-bench.json

Validate JSON.

Task 07 — Review Benchmark Sections

Review findings for:

Master Node
Control Plane
etcd
Scheduler
Controller Manager
Worker Nodes
Policies

Understand:

PASS

WARN

FAIL

INFO

Task 08 — Analyse Failed Controls

Review every failed recommendation.

Record.

Control ID
Description
Risk
Impact

Determine.

Business impact.

Task 09 — Review Authentication Controls

Validate:

Anonymous Authentication
Client Certificates
RBAC
Authentication Modes

Confirm.

Least privilege.

Task 10 — Review Authorization

Validate.

RBAC Enabled
ABAC Disabled
Webhook Authorization

Review findings.

Task 11 — Review Audit Logging

Validate.

Audit Policy
Audit Log
Log Retention

Confirm.

Logging enabled.

Task 12 — Review API Server Security

Validate.

TLS
Encryption
Secure Ports
Admission Controllers

Compare against benchmark.

Task 13 — Review etcd Security

Validate.

TLS
Encryption
Authentication
Certificates

Review.

Permissions.

Task 14 — Review Scheduler

Validate.

Permissions
Certificates
Secure Configuration

Task 15 — Review Controller Manager

Review.

Secure Bind Address
TLS
Authentication

Task 16 — Review Worker Nodes

Validate.

kubelet
TLS
Authentication
Authorization

Review.

Read-only Port.

Task 17 — Review File Permissions

Validate.

Critical Kubernetes files.

Review.

Ownership.

Permissions.

Task 18 — Review Pod Security

Validate.

Pod Security Admission
Restricted Policies
Namespace Labels

Task 19 — Review Secrets Protection

Validate.

Encryption at Rest
Secret Access
RBAC

Task 20 — Review Network Security

Validate.

Network Policies
API Exposure
Control Plane Access

Task 21 — Review Image Security

Review.

Private Registry
Signed Images
Digest Usage

Task 22 — Review Runtime Security

Validate.

Runtime
seccomp
AppArmor
SELinux

Task 23 — Review Compliance Findings

Categorise.

Critical

High

Medium

Low

Prioritise remediation.

Task 24 — Build Compliance Matrix

Create.

assessment/compliance-matrix.md

Example.

CIS Control	Status	Risk	Owner
1.1	PASS	Low	Platform
1.2	FAIL	Critical	Security

Task 25 — Create Risk Register

Document.

Risk
Impact
Likelihood
Priority
Owner
Due Date

Task 26 — Build Executive Summary

Summarise.

Compliance %
Critical Findings
High Findings
Recommendations

Suitable for:

CISO
Audit Committee
Management

Task 27 — Produce Remediation Plan

Group actions.

Immediate

30 Days

90 Days

Future Improvements

Task 28 — Evidence Collection

Collect.

kube-bench Results
JSON Output
Cluster Version
Node Inventory
Screenshots
Compliance Matrix
Risk Register

Task 29 — Cleanup

Remove temporary files.

Archive evidence.

Verify report completeness.

Enterprise Compliance Checklist

Control	Status
Benchmark Executed	☐
Control Plane Reviewed	☐
Worker Nodes Reviewed	☐
API Server Reviewed	☐
etcd Reviewed	☐
Scheduler Reviewed	☐
Controller Manager Reviewed	☐
RBAC Reviewed	☐
Audit Logging Reviewed	☐
Secrets Reviewed	☐
Runtime Reviewed	☐
Compliance Matrix Created	☐
Risk Register Completed	☐
Executive Report Completed	☐

Risk Classification

Critical

Anonymous Authentication Enabled
RBAC Disabled
etcd Unencrypted
Read-only kubelet Port Enabled

High

Missing Audit Logs
Weak TLS Configuration
Excessive Permissions
Missing Pod Security Controls

Medium

Missing Network Policies
Weak File Permissions
Missing Runtime Controls

Low

Documentation
Labels
Metadata

Skills Developed

By completing this lab you will be able to:

Perform CIS Kubernetes Benchmark assessments
Use kube-bench effectively
Interpret benchmark findings
Assess Kubernetes hardening
Prioritise remediation
Produce enterprise compliance reports
Support audit and regulatory reviews

Knowledge Check

Question 1

What is the purpose of the CIS Kubernetes Benchmark?

Answer: It provides industry-recognised security configuration recommendations for hardening Kubernetes clusters.

Question 2

What does a FAIL result indicate?

Answer: The assessed control does not meet the benchmark recommendation and requires investigation or remediation.

Question 3

Should every benchmark finding always be remediated immediately?

Answer: Not necessarily. Findings should be assessed based on business context, risk, compensating controls, and operational impact before remediation is prioritised.

Question 4

Why should benchmark results be preserved?

Answer: They provide evidence for audits, compliance reporting, security reviews, and future comparison.

Question 5

Does passing the CIS Benchmark guarantee a secure Kubernetes cluster?

Answer: No. The CIS Benchmark is an important hardening baseline, but it should be complemented by continuous monitoring, runtime protection, vulnerability management, and secure operational practices.

Lab Summary

In this lab, you performed an enterprise CIS Kubernetes Benchmark assessment using kube-bench to evaluate the security posture of a Kubernetes cluster.

You reviewed the control plane, worker nodes, authentication, authorisation, audit logging, API server configuration, etcd security, runtime protections, and other benchmark controls. You analysed benchmark findings, prioritised remediation activities, created a compliance matrix, documented risks, and produced an executive-ready assessment report.

This assessment establishes a security baseline that supports continuous compliance, strengthens Kubernetes hardening, and provides evidence for internal audits and external regulatory requirements.

What’s Next?

Next Lab: Lab 02 — Gatekeeper Policies

In the next lab, you will deploy Open Policy Agent (OPA) Gatekeeper, implement governance policies, enforce Kubernetes security guardrails, validate policy compliance, and automate admission control to prevent non-compliant workloads from entering the cluster.