# aquasecurity/kube-bench

Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark

Repository: https://github.com/aquasecurity/kube-bench
Canonical: https://ross.abutalabs.com/products/kube-bench
Language: Go
License: Apache-2.0
License Family: permissive
Topics: kube-bench, cis-security, kubernetes-security, cis-benchmark, cis-kubernetes-benchmark, openshift, kubernetes, hacktoberfest
Last push: 2026-08-24T19:32:49+00:00

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 96, longevity 100
- inputs: {"age_days": 3362, "days_push": 9, "days_rel": 28, "gap_med": 22, "n_releases_24m": 26}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 8155, forks 1335 (observed 2026-08-28T04:10:13.903059+00:00)

## What it is
kube-bench is a Go-based tool that checks whether Kubernetes clusters are deployed securely by running the checks documented in the CIS Kubernetes Benchmark. Tests are configured with YAML files, and it can run as a Kubernetes Job, a container, or a binary on the host.

## Use cases
- audit a kubernetes cluster against cis security benchmarks
- check kubelet and control plane security configuration
- run cis compliance scans as a kubernetes job
- verify kubernetes hardening before production
- generate compliance reports for cluster security
- scan openshift deployments for cis benchmark compliance

## When to choose
- you need CIS Kubernetes Benchmark compliance checks for a cluster
- you want a lightweight, YAML-configurable security audit tool
- you need to run security checks as a scheduled Kubernetes Job

## When to avoid
- you need broad vulnerability scanning beyond CIS benchmarks - use Trivy instead
- you want continuous in-cluster scanning with an operator - use Trivy Operator
- you are not running Kubernetes or OpenShift

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, testing, cli
- domain: security, cloud-computing
- platform: go, cli
- tags: cis-benchmark, kubernetes-security, security-audit, compliance, openshift, containers, devops, kubernetes, docker, linux

## Member repositories
- aquasecurity/kube-bench (main) score 98

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:13.903059+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:29:45.819800+00:00, confidence not recorded.
  - readme: https://github.com/aquasecurity/kube-bench (fetched 2026-08-28T04:10:13.903059+00:00, sha 2ad42da663f8)
- Data as of 2026-08-30T08:39:29.467469+00:00.