Performing Kubernetes Cis Benchmark With Kube Bench

## agentic-workflows-blueprint.workflow.performing-kubernetes-cis-benchmark-with-kube-bench

### Goal

Assess Kubernetes cluster security posture against CIS benchmark controls using kube-bench and produce remediation-prioritized evidence for hardening programs.

### Scope

- Applies to: Kubernetes control plane, worker, etcd, and policy benchmark assessments.
- Does not cover: replacing runtime threat detection or policy enforcement controls.

### Triggers

- "Run Kubernetes CIS benchmark"
- "Assess cluster hardening with kube-bench"
- "Generate compliance evidence for Kubernetes security controls"
- "Track benchmark drift over time"

### Inputs

- `clusterContext`: cluster/provider/version context
- `benchmarkProfile`: target profile (generic, EKS, GKE, AKS, etc.)
- `executionMode`: node/binary run or Kubernetes job mode
- `severityPolicy`: mapping for FAIL/WARN prioritization
- `reportTarget` (optional): destination for JSON/JUnit/text output
- `remediationCapacity` (optional): team constraints for scheduled fixes

### Invariants

- Benchmark profile must match cluster platform/version context.
- Results must be preserved in machine-readable format for trend analysis.
- FAIL findings are prioritized before WARN findings unless justified.
- Remediation recommendations must map to specific CIS control IDs.

### Procedure

1. **Prepare benchmark run**
   - Select benchmark profile and execution mode.
   - Validate required permissions and host/cluster access.

2. **Execute kube-bench**
   - Run full benchmark and optionally component-specific targets.
   - Capture raw output and structured report formats.

3. **Classify findings**
   - Separate PASS/FAIL/WARN outcomes and map by benchmark section.
   - Identify high-risk controls affecting auth, API server, kubelet, and RBAC posture.

4. **Prioritize remediation**
   - Rank findings by security impact and operational risk.
   - Propose sequenced remediation plan with ownership and expected blast radius.

5. **Validate remediations**
   - Re-run impacted controls after configuration changes.
   - Confirm delta improvements and absence of regressions.

6. **Operationalize continuous assessment**
   - Schedule periodic benchmark runs for drift detection.
   - Publish trend metrics and unresolved findings backlog.

### Outputs

- kube-bench result artifacts (text/JSON/JUnit as configured).
- CIS findings summary with FAIL/WARN prioritization.
- Remediation plan mapped to control IDs.
- Re-test evidence for resolved controls.

### Review gate

- [ ] Benchmark profile aligns with platform/version.
- [ ] Structured report artifacts are generated and retained.
- [ ] FAIL findings have remediation owner and plan.
- [ ] Re-validation confirms critical fixes are effective.
- [ ] Continuous benchmark cadence is defined.

### References

- `../../SKILL.md`
- `../securing-kubernetes-on-cloud/SKILL.md`
- `../review/SKILL.md`