CIS Benchmark profile definitions Level flag implementation

[zeithbyte]

Is there any kind of "CIS Benchmark profile level" filter implemented in kube-bench ?

In the CIS Benchmark document, some profile definitions "Levels" are described as quoted below (extract from CIS Benchmakr v1.12):

Profile Definitions
The following configuration profiles are defined by this Benchmark:
• Level 1 - Master Node
Items in this profile intend to:
o be practical and prudent;
o provide a clear security benefit; and
o not inhibit the utility of the technology beyond acceptable means.
• Level 2 - Master Node
o Extends level 1
• Level 1 - Worker Node
Items in this profile intend to:
o be practical and prudent;
o provide a clear security benefit; and
o not inhibit the utility of the technology beyond acceptable means.
• Level 2 - Worker Node
o Extends Level 1

As an exemple, here are the extract of 4 tests from cthe v1.12 CIS benchmark to illustrate:

A level 1 - Master node check:

1.2.11 Ensure that the admission control plugin AlwaysPullImages
is set (Manual)
Profile Applicability:
• Level 1 - Master Node

A level 2 - Master node check:

1.2.12 Ensure that the admission control plugin ServiceAccount is
set (Automated)
Profile Applicability:
• Level 2 - Master Node

A level 1 - Worker node check:

4.2.7 Ensure that the --hostname-override argument is not set
(Manual)
Profile Applicability:
• Level 1 - Worker Node

A level 2 - Worker Node check:

4.2.8 Ensure that the eventRecordQPS argument is set to a level
which ensures appropriate event capture (Manual)
Profile Applicability:
• Level 2 - Worker Node

Is there any already existing option in kube-bench that already does this ?

I would like to run kube-bench and have some kind of flag to behave like kube-bench --targets master --level 1 and then display only appropriate checks, results and remediations.

Thankx in advance for any reply.

[afdesk]

@zeithbyte Thanks for your interest in kube-bench — that’s a very good question, or rather, a feature request.
At the moment, it’s only possible to filter by checks using the --skip or --check options.

However, it might make sense to introduce a similar option for filtering purposes by level.

Let’s wait and see how the community reacts and what kind of demand there is for this feature.

[zeithbyte]

Hi @afdesk and thanks for your reply.

For professional reasons i had to filter check by levels. I made this "filter" job manually and output to a CSV file based on CIS-1.12 document.

I can share it attached if it can help anyone having the same need as long as such a "--level" feature request doesn"t exist.
CIS-bencmark-Profile Applicability-mapping.csv