Vulnerability assessment in kubernetes using Kube bench

Kube-Bench is an open-source tool developed by Aqua Security that helps you check the security configuration of Kubernetes clusters. It automates the process of auditing a Kubernetes cluster against the Center for Internet Security (CIS) Kubernetes Benchmark. The CIS Kubernetes Benchmark is a set of best practices and security recommendations to secure Kubernetes deployments.

Kube-Bench is widely used by system administrators, security professionals, and anyone responsible for the security and compliance of Kubernetes environments. It assesses the security posture of a cluster by running a series of tests based on the CIS Kubernetes Benchmark and provides a detailed report highlighting any potential security misconfigurations or vulnerabilities.

Basic functionality of the kube bench is explaining below 

• Scanning Kubernetes Cluster: Kube-Bench connects to the Kubernetes API server and performs a series of checks against the cluster's configuration and settings.

• CIS Benchmark Tests: The tool runs a set of checks based on the CIS Kubernetes Benchmark. The benchmark consists of various security recommendations categorized into different sections, such as control plane configuration, node security, network policies, etc.

• Generating Reports: After scanning the cluster, Kube-Bench generates a comprehensive report detailing the results of each check. The report indicates whether each security check has passed or failed, along with additional information and recommendations.

• Remediation: Based on the report generated by Kube-Bench, administrators can take necessary actions to address any security issues and misconfigurations identified during the scan.

Let's install and configure kube bench in a sample kubernetes cluster 

Install Kube-Bench:

We can install Kube-Bench using various methods, such as downloading the binary from the GitHub releases page or using a package manager. Here's an example of installing it using curl and bash

#curl -L https://github.com/aquasecurity/kube-bench/releases/latest/download/kube-bench | sudo tee /usr/local/bin/kube-bench > /dev/null sudo 

#chmod +x /usr/local/bin/kube-bench

Run Kube-Bench against your Kubernetes cluster. You'll need the kubeconfig file to authenticate with the cluster. Replace path/to/your/kubeconfig.yaml with the actual path to your kubeconfig file: The default location of the kubeconfig file will be $Home/.kube/config

# kube-bench -c path/to/your/kubeconfig.yaml

Once this command it executed we will get the result as below 

********************************************************************************

[INFO] 1 Master Node Security Configuration

   [INFO] 1.1 API Server

     [PASS] 1.1.1 Ensure that the --allow-privileged argument is set to false (Scored)

     [PASS] 1.1.2 Ensure that the --anonymous-auth argument is set to false (Scored)

     [FAIL] 1.1.3 Ensure that the --basic-auth-file argument is not set (Scored)

     [PASS] 1.1.4 Ensure that the --insecure-allow-any-token argument is set to false (Scored)

     ...

   [INFO] 1.2 Controller Manager

     [PASS] 1.2.1 Ensure that the --terminated-pod-gc-threshold argument is set as appropriate (Scored)

     [PASS] 1.2.2 Ensure that the --profiling argument is set to false (Scored)

     ...

[INFO] 2 Node Security Configuration

   [INFO] 2.1 Kubelet

     [PASS] 2.1.1 Ensure that the --anonymous-auth argument is set to false (Scored)

     [PASS] 2.1.2 Ensure that the --authorization-mode argument is not set to AlwaysAllow (Scored)

     [PASS] 2.1.3 Ensure that the --protect-kernel-defaults argument is set to true (Scored)

     ...

   [INFO] 2.2 Docker

     [PASS] 2.2.1 Ensure that the version of Docker is up to date (Scored)

     [PASS] 2.2.2 Ensure that the Docker daemon is configured to drop Linux capabilities (Scored)

     ...

[INFO] 3 ETCD Security Configuration

   [PASS] 3.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Scored)

   [PASS] 3.2 Ensure that the --client-cert-auth argument is set to true (Scored)

   ...

[INFO] 4 Policies

   [INFO] 4.1 Pod Security Policies

     [PASS] 4.1.1 Ensure that a PodSecurityPolicy (PSP) is created (Scored)

     [PASS] 4.1.2 Ensure that the PSP controller is deployed (Scored)

     ...

   [INFO] 4.2 Network Policies

     [PASS] 4.2.1 Ensure that Calico network policy plugin is deployed (Scored)

     [PASS] 4.2.2 Ensure that 'NetworkPolicy' is set as the default network policy provider (Scored)

     ...

[INFO] 5 Logging and Monitoring

   [PASS] 5.1 Ensure that audit policies are configured (Scored)

   [PASS] 5.2 Ensure that the audit policy covers key security concerns (Scored)

   ...

==============================================================

|                     Summary Report                         |

==============================================================

|    Passing  |      74    |         |    Not Passing  |    4    |

==============================================================

****************************************************************************

In this sample report:

Each section (e.g., Master Node Security Configuration, Node Security Configuration, etc.) corresponds to a specific area of security checks.
Within each section, there are individual checks with their results (PASS, FAIL, WARN, etc.).
The summary at the end provides a count of passing and failing checks.

Remember that Kube-Bench is a tool for auditing and checking your cluster's security configuration. It doesn't fix any identified issues automatically. You will need to manually adjust your cluster's configuration based on the recommendations provided.