---
name: "kube-bench-cis-benchmark"
description: "Verify Kubernetes cluster nodes against the official CIS Kubernetes Benchmark."
metadata:
  author: "Aqua Security"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "run kube-bench on master node"
  - "check cis kubernetes benchmark"
  - "audit kubelet configuration"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# kube-bench CIS Kubernetes Benchmark Automated Checks

Executes Aqua Security kube-bench: auditing master and worker node file permissions, API server flags, kubelet configurations, etcd encryption, and generating pass/fail check summaries.

## When to Invoke
Invoke this skill whenever you need to:
- run kube-bench on master node
- check cis kubernetes benchmark
- audit kubelet configuration

## Execution SOP & Rules
1. Deploy kube-bench using the official job-node.yaml manifest to scan cluster worker nodes.
2. Review output sections: Master Node Security, Etcd, Control Plane, and Worker Node Configs.
3. Harden kubelet configurations according to CIS recommendations in /var/lib/kubelet/config.yaml.
4. Re-run kube-bench to verify all failing checks transition to PASS.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.