https://k8s-school.fr/labs/k8s/en/tags/cis-benchmark/index.htmlHugoenCopyright (c) 2025 Fabrice Jammes - Licensed under CC BY-SA 4.0Fri, 09 Jan 2026 10:00:00 +1000https://k8s-school.fr/labs/k8s/en/1_labs/kubebench-10-jobs/index.htmlFri, 09 Jan 2026 10:00:00 +1000https://k8s-school.fr/labs/k8s/en/1_labs/kubebench-10-jobs/index.htmlIntroduction to CIS Benchmarks The Center for Internet Security (CIS) provides best practices for securing Kubernetes. In this lab, we will use kube-bench, an open-source tool from Aqua Security, to check whether our cluster meets these security recommendations. Running kube-bench as a Job In a CKS exam or production environment, you often run kube-bench as a Kubernetes Job to scan nodes without SSH access.https://k8s-school.fr/labs/k8s/en/1_labs/kubebench-20-remediations/index.htmlFri, 09 Jan 2026 10:00:00 +1000https://k8s-school.fr/labs/k8s/en/1_labs/kubebench-20-remediations/index.htmlPractical CKS Exercise Workflow As a CKS candidate, you should practice the complete security hardening workflow manually. This section guides you through the key exercises step by step to remediate security issues found by kube-bench. Remove the --profiling argument for the scheduler Look for the check 1.4.1: Ensure that the –profiling argument is set to false.https://k8s-school.fr/labs/k8s/en/1_labs/kubebench-30-automation/index.htmlFri, 09 Jan 2026 10:00:00 +1000https://k8s-school.fr/labs/k8s/en/1_labs/kubebench-30-automation/index.htmlAutomation and Continuous Compliance Why is running kube-bench manually not enough for a production environment? Answers Configuration Drift: A manual change or update could revert security settings. New Benchmarks: CIS updates its recommendations regularly. Visibility: Security teams need centralized reporting, not just CLI logs. Suggested improvement Integrate kube-bench into a CronJob to run every week and send results to a security dashboard like Falco or a SIEM.