CIS Kubernetes Benchmark

Overview

This integration compares Kubernetes configuration against CIS benchmark checks. It computes a score that ranges between 0 - 100. This integration requires access to node files, node processes, and the Kubernetes api-server therefore it assumes the agent will be installed as a DaemonSet with the proper Roles and RoleBindings attached.

Leader election

To collect cluster level data (compared to node level information) the integration makes use of the leader election mechanism. This mechanism assures that the cluster level data is collected by only one of the agents running as a part of the DaemonSet and not by all of them.

Cluster level data example: List of the running pods. Node level data example: kubelet configuration.

Compatibility

The Kubernetes package is tested with Kubernetes 1.21.x

Dashboard

CIS Kubernetes Benchmark integration is shipped including default dashboards and screens to manage the benchmark rules and inspect the compliance score and findings.

Deployment

Configure Kibana

In order for the integration to be installed, The Cloud Security Posture Kibana plugin must be enabled.

This could be done by adding the following configuration line to kibana.yml:

xpack.cloudSecurityPosture.enabled: true

For Cloud users, see Edit Kibana user settings.

Deploy the Elastic agent

Just like every other integration, the KSPM integration requires an Elastic agent to be deployed.

See agent installation instructions. Note, this integration can only be added to Elastic agents with versions 8.3 or higher.

Changelog