[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-9896":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":17,"stars7d":18,"stars30d":19,"stars90d":16,"forks30d":16,"starsTrendScore":20,"compositeScore":21,"rankGlobal":10,"rankLanguage":10,"license":22,"archived":23,"fork":23,"defaultBranch":24,"hasWiki":25,"hasPages":25,"topics":26,"createdAt":10,"pushedAt":10,"updatedAt":34,"readmeContent":35,"aiSummary":36,"trendingCount":16,"starSnapshotCount":16,"syncStatus":37,"lastSyncTime":38,"discoverSource":39},9896,"kube-bench","aquasecurity\u002Fkube-bench","aquasecurity","Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark","",null,"Go",8077,1325,107,62,0,3,14,35,11,81.87,"Apache License 2.0",false,"main",true,[27,28,29,30,5,31,32,33],"cis-benchmark","cis-kubernetes-benchmark","cis-security","hacktoberfest","kubernetes","kubernetes-security","openshift","2026-06-12 04:00:47","[![GitHub Release][release-img]][release]\n[![Downloads][download]][release]\n[![Docker Pulls][docker-pull]][docker]\n[![Go Report Card][report-card-img]][report-card]\n[![Build Status](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench\u002Fworkflows\u002FBuild\u002Fbadge.svg?branch=main)](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench\u002Factions)\n[![License](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002FLicense-Apache%202.0-blue.svg)](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench\u002Fblob\u002Fmain\u002FLICENSE)\n[![Coverage Status][cov-img]][cov]\n\n[download]: https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Fdownloads\u002Faquasecurity\u002Fkube-bench\u002Ftotal?logo=github\n[release-img]: https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Frelease\u002Faquasecurity\u002Fkube-bench.svg?logo=github\n[release]: https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench\u002Freleases\n[docker-pull]: https:\u002F\u002Fimg.shields.io\u002Fdocker\u002Fpulls\u002Faquasec\u002Fkube-bench?logo=docker&label=docker%20pulls%20%2F%20kube-bench\n[docker]: https:\u002F\u002Fhub.docker.com\u002Fr\u002Faquasec\u002Fkube-bench\n[cov-img]: https:\u002F\u002Fcodecov.io\u002Fgithub\u002Faquasecurity\u002Fkube-bench\u002Fbranch\u002Fmain\u002Fgraph\u002Fbadge.svg\n[cov]: https:\u002F\u002Fcodecov.io\u002Fgithub\u002Faquasecurity\u002Fkube-bench\n[report-card-img]: https:\u002F\u002Fgoreportcard.com\u002Fbadge\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench\n[report-card]: https:\u002F\u002Fgoreportcard.com\u002Freport\u002Fgithub.com\u002Faquasecurity\u002Fkube-bench\n\n\u003Cimg src=\"docs\u002Fimages\u002Fkube-bench.png\" width=\"200\" alt=\"kube-bench logo\">\n\nkube-bench is a tool that checks whether Kubernetes is deployed securely by running the checks documented in the [CIS Kubernetes Benchmark](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fkubernetes\u002F).\n\nTests are configured with YAML files, making this tool easy to update as test specifications evolve.\n\n![Kubernetes Bench for Security](\u002Fdocs\u002Fimages\u002Foutput.png \"Kubernetes Bench for Security\")\n\n## CIS Scanning as part of Trivy and the Trivy Operator\n\n[Trivy](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy), the all in one cloud native security scanner, can be deployed as a [Kubernetes Operator](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy-operator) inside a cluster.\nBoth, the [Trivy CLI](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy), and the [Trivy Operator](https:\u002F\u002Fgithub.com\u002Faquasecurity\u002Ftrivy-operator) support CIS Kubernetes Benchmark scanning among several other features.\n\n## Quick start\n\nThere are multiple ways to run kube-bench.\nYou can run kube-bench inside a pod, but it will need access to the host's PID namespace in order to check the running processes, as well as access to some directories on the host where config files and other files are stored.\n\nThe supplied `job.yaml` [file](job.yaml) can be applied to run the tests as a job. For example:\n\n```bash\n$ kubectl apply -f job.yaml\njob.batch\u002Fkube-bench created\n\n$ kubectl get pods\nNAME                      READY   STATUS              RESTARTS   AGE\nkube-bench-j76s9   0\u002F1     ContainerCreating   0          3s\n\n# Wait for a few seconds for the job to complete\n$ kubectl get pods\nNAME                      READY   STATUS      RESTARTS   AGE\nkube-bench-j76s9   0\u002F1     Completed   0          11s\n\n# The results are held in the pod's logs\nkubectl logs kube-bench-j76s9\n[INFO] 1 Master Node Security Configuration\n[INFO] 1.1 API Server\n...\n```\nFor more information and different ways to run kube-bench see [documentation](docs\u002Frunning.md)\n### Please Note\n\n1. kube-bench implements the [CIS Kubernetes Benchmark](https:\u002F\u002Fwww.cisecurity.org\u002Fbenchmark\u002Fkubernetes\u002F) as closely as possible. Please raise issues here if kube-bench is not correctly implementing the test as described in the Benchmark. To report issues in the Benchmark itself (for example, tests that you believe are inappropriate), please join the [CIS community](https:\u002F\u002Fcisecurity.org).\n\n1. There is not a one-to-one mapping between releases of Kubernetes and releases of the CIS benchmark. See [CIS Kubernetes Benchmark support](docs\u002Fplatforms.md#cis-kubernetes-benchmark-support) to see which releases of Kubernetes are covered by different releases of the benchmark.\n\n\nBy default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine.\n- see the following documentation on [Running kube-bench](docs\u002Frunning.md#running-kube-bench) for more details.\n\n\n## Contributing\nKindly read [Contributing](CONTRIBUTING.md) before contributing. \nWe welcome PRs and issue reports.\n\n## Roadmap\n\nGoing forward we plan to release updates to kube-bench to add support for new releases of the CIS Benchmark. Note that these are not released as frequently as Kubernetes releases.\n","kube-bench 是一个用于检查 Kubernetes 集群是否按照 CIS Kubernetes 安全基准部署的工具。它通过运行 YAML 文件中定义的安全测试来确保集群符合最佳安全实践，这些文件易于更新以适应不断变化的安全标准。该项目采用 Go 语言编写，支持多种运行方式，包括在 Pod 内执行或作为 Kubernetes Job 运行，并且需要访问宿主机上的特定目录和进程信息以完成全面的安全评估。适用于任何希望提高其 Kubernetes 环境安全性的团队或个人，在持续集成\u002F持续部署流程中加入 kube-bench 可以帮助自动化地发现潜在的安全配置问题。",2,"2026-06-11 03:25:16","top_topic"]