Lion Cipher Lab
Harden a Kubernetes cluster against the CIS Benchmark with kube-bench
- Cloud Security
- Intermediate
- ~45 min
- Free · no account required
Why it matters
Kubernetes ships with a lot of knobs, and its defaults are tuned for getting started, not for being locked down. The CIS Kubernetes Benchmark is a community-agreed checklist of those knobs — how the API server, kubelet, etcd, and cluster policies should be configured to reduce risk — turned into concrete, testable controls. kube-bench is a free, open-source tool from Aqua Security that runs those checks against a real cluster and tells you, control by control, whether you PASS, need to look (WARN), or FAIL. Learning to read that report is a core cloud-security skill: it turns 'is my cluster…
What you'll learn
- what the CIS Kubernetes Benchmark is and why it exists
- spinning up a throwaway local cluster with kind (or minikube)
- running kube-bench as an in-cluster Job
- reading PASS / WARN / FAIL findings and their remediation text
- remediating one control on the node and re-running to confirm
- knowing which controls are the managed provider's job, not yours
Steps in this lab
- What the CIS Kubernetes Benchmark is
- What kube-bench is
- Spin up your own throwaway cluster with kind
- Confirm the cluster is up
- Run kube-bench against the cluster
- Read the PASS / WARN / FAIL findings
- Remediate one control and re-run
- The reality: not every control is yours to fix