CIS Kubernetes Benchmark Audits with kube-bench

id: kube-bench-cis-benchmark-audit
namespace: company.team
description: |
  Audit a Kubernetes cluster against the CIS Kubernetes Benchmark with
  kube-bench, from a weekly schedule or an on-demand webhook. The scan runs
  in its official container with a bundled fixture report, so the flow stays
  deterministic when no cluster is reachable, the JSON is parsed into a
  failed-check count and the failing control ids, and anything above the
  allowed threshold opens a GitHub issue, alerts Slack, and appends
  remediation notes per failed control group before the verdict, counts, and
  report location are published as outputs.

triggers:
  - id: weekly_cis_audit
    type: io.kestra.plugin.core.trigger.Schedule
    description: Primary trigger, a weekly CIS benchmark audit every Monday at 06:00
      UTC; shipped disabled until an operator switches it on.
    cron: "0 6 * * 1"
    disabled: true
  - id: on_demand_audit
    type: io.kestra.plugin.core.trigger.Webhook
    description: POST here to audit a cluster on demand, for example after a control
      plane upgrade or before an external review.
    key: "{{ secret('KUBEBENCH_WEBHOOK_KEY') }}"

inputs:
  - id: cluster_name
    type: STRING
    defaults: staging-eks-cluster
    description: Logical name of the cluster under audit, used in the remediation
      report, the GitHub issue title, and the Slack message.
  - id: failed_threshold
    type: INT
    defaults: 0
    description: Maximum number of failed CIS checks tolerated before the run
      escalates to a GitHub issue and to Slack.
  - id: github_repository
    type: STRING
    defaults: your-org/cluster-baselines
    description: Repository in owner/repo form that receives the remediation issue
      when the threshold is exceeded.

tasks:
  # --- 1. benchmark scan and parse ---
  - id: audit_workspace
    type: io.kestra.plugin.core.flow.WorkingDirectory
    description: One shared directory so the scan, the parser, and the remediation
      report all see the same files.
    tasks:
      - id: run_kube_bench
        type: io.kestra.plugin.scripts.shell.Commands
        description: Write a deterministic kube-bench fixture, run kube-bench in its
          official container, and fall back to the fixture when no cluster is
          reachable so the audit is reproducible offline.
        taskRunner:
          type: io.kestra.plugin.scripts.runner.docker.Docker
          entryPoint: []
        containerImage: aquasec/kube-bench:latest
        env:
          CLUSTER_NAME: "{{ inputs.cluster_name }}"
        outputFiles:
          - kube-bench-report.json
        commands:
          - |
            set -u
            cat > mock-report.json <<'JSON'
            {
              "Controls": [{
                "id": "4",
                "text": "Kubernetes Policies",
                "node_type": "policies",
                "tests": [{
                  "text": "RBAC and Service Accounts",
                  "section": "4.1",
                  "pass": 7, "fail": 2, "warn": 1,
                  "results": [
                    {
                      "test_number": "4.1.1", "test_section": "4.1", "status": "FAIL",
                      "test_desc": "4.1.1 Ensure cluster-admin privileges are used only where required",
                      "remediation": "Audit ClusterRoleBindings and drop cluster-admin from service accounts that do not need it."
                    },
                    {
                      "test_number": "4.1.4", "test_section": "4.1", "status": "PASS",
                      "test_desc": "4.1.4 Minimize access to secrets",
                      "remediation": ""
                    },
                    {
                      "test_number": "4.1.5", "test_section": "4.1", "status": "FAIL",
                      "test_desc": "4.1.5 Ensure default service accounts are not actively used",
                      "remediation": "Set automountServiceAccountToken to false for the default service account in every namespace."
                    },
                    {
                      "test_number": "4.2.3", "test_section": "4.2", "status": "WARN",
                      "test_desc": "4.2.3 Minimize the admission of containers with allowPrivilegeEscalation",
                      "remediation": "Set securityContext.allowPrivilegeEscalation to false in every pod security context."
                    }
                  ]
                }]
              }]
            }
            JSON

            echo "Scanning cluster ${CLUSTER_NAME} with kube-bench"
            kube-bench --json-output > kube-bench-report.json || true

            if [ ! -s kube-bench-report.json ]; then
              cp mock-report.json kube-bench-report.json
              echo "no cluster reachable from this worker, emitting the bundled fixture report"
            fi

            echo "report bytes $(wc -c < kube-bench-report.json)"

      - id: parse_report
        type: io.kestra.plugin.scripts.python.Script
        description: Read the kube-bench JSON, count total and failed checks, collect
          the failing control ids and the per-group remediation, and emit the
          verdict through the outputs protocol.
        taskRunner:
          type: io.kestra.plugin.scripts.runner.docker.Docker
        containerImage: python:3.12-slim
        env:
          CLUSTER_NAME: "{{ inputs.cluster_name }}"
          FAILED_THRESHOLD: "{{ inputs.failed_threshold }}"
        script: |
          import json
          import os

          report_path = "kube-bench-report.json"
          cluster = os.environ.get("CLUSTER_NAME", "unknown-cluster")
          try:
              threshold = int(os.environ.get("FAILED_THRESHOLD", "0"))
          except ValueError:
              threshold = 0

          data = {}
          if os.path.exists(report_path) and os.path.getsize(report_path) > 0:
              try:
                  with open(report_path, "r") as handle:
                      data = json.load(handle)
              except ValueError:
                  data = {}

          results = []
          for control in data.get("Controls") or []:
              if not isinstance(control, dict):
                  continue
              for group in control.get("tests") or []:
                  if not isinstance(group, dict):
                      continue
                  section = str(group.get("section") or "unknown")
                  title = str(group.get("text") or section)
                  for entry in group.get("results") or []:
                      if not isinstance(entry, dict):
                          continue
                      row = dict(entry)
                      row.setdefault("test_section", section)
                      row.setdefault("test_number", section)
                      row["section_title"] = title
                      results.append(row)

          failed = [r for r in results if str(r.get("status", "")).strip().upper() == "FAIL"]
          critical_controls = sorted({str(r.get("test_number") or "unknown") for r in failed})
          controls_summary = ", ".join(critical_controls) if critical_controls else "none"

          buckets = {}
          for row in failed:
              key = str(row.get("test_section") or "unknown")
              bucket = buckets.setdefault(key, {"id": key, "title": row.get("section_title", key), "failed": 0, "notes": []})
              bucket["failed"] += 1
              note = str(row.get("remediation") or "Review the control and align the cluster configuration with the CIS benchmark.")
              if note not in bucket["notes"]:
                  bucket["notes"].append(note)

          failed_groups = []
          for key in sorted(buckets):
              bucket = buckets[key]
              failed_groups.append({
                  "id": bucket["id"], "title": bucket["title"], "failed": bucket["failed"],
                  "remediation": " ".join(bucket["notes"]),
              })

          verdict = "PASS" if len(failed) <= threshold else "FAIL"

          with open("remediation-report.md", "w") as handle:
              handle.write("# CIS Kubernetes Benchmark remediation notes\n\n")
              handle.write("Cluster: " + cluster + "\n\n")
              if not failed_groups:
                  handle.write("No failed checks, nothing to remediate.\n")

          payload = {
              "total_checks": len(results),
              "failed_count": len(failed),
              "critical_controls": critical_controls,
              "controls_summary": controls_summary,
              "failed_groups": failed_groups,
              "verdict": verdict,
          }
          print("cluster=%s total=%d failed=%d verdict=%s" % (cluster, len(results), len(failed), verdict))
          print("::" + json.dumps({"outputs": payload}) + "::")

  # --- 2. remediation notes ---
  - id: append_remediation
    type: io.kestra.plugin.core.flow.Loop
    description: Walk the failed control groups one at a time and append a
      remediation section for each into the shared report file.
    values: "{{ outputs.parse_report.vars.failed_groups }}"
    concurrencyLimit: 1
    tasks:
      - id: append_control_note
        type: io.kestra.plugin.scripts.python.Script
        description: Append the control id, group title, and remediation text for the
          current failed control group.
        taskRunner:
          type: io.kestra.plugin.scripts.runner.docker.Docker
        containerImage: python:3.12-slim
        env:
          CONTROL_ID: "{{ item.id }}"
          CONTROL_TITLE: "{{ item.title }}"
          REMEDIATION: "{{ item.remediation }}"
        script: |
          import json
          import os

          control_id = os.environ.get("CONTROL_ID", "unknown")
          title = os.environ.get("CONTROL_TITLE", "")
          remediation = os.environ.get("REMEDIATION", "")

          with open("remediation-report.md", "a") as handle:
              handle.write("## " + control_id + " " + title + "\n\n")
              handle.write(remediation.strip() + "\n\n")

          print("appended remediation for " + control_id)
          print("::" + json.dumps({"outputs": {"appended": control_id}}) + "::")

  # --- 3. verdict gate ---
  - id: check_verdict
    type: io.kestra.plugin.core.flow.If
    description: Escalate only when the failed check count sits above the tolerated
      threshold, a compliant cluster is recorded and left alone.
    condition: "{{ (outputs.parse_report.vars.failed_count | number) >
      (inputs.failed_threshold | number) }}"
    then:
      - id: open_remediation_issue
        type: io.kestra.plugin.github.issues.Create
        description: Open a labeled GitHub issue listing the failing control ids so
          remediation is tracked where the team already works.
        jwtToken: "{{ secret('GITHUB_TOKEN') }}"
        repository: "{{ inputs.github_repository }}"
        title: "CIS benchmark failures on {{ inputs.cluster_name }}"
        body: |
          ## CIS Kubernetes Benchmark audit

          Cluster **{{ inputs.cluster_name }}** failed **{{ outputs.parse_report.vars.failed_count }}** of **{{ outputs.parse_report.vars.total_checks }}** checks (threshold {{ inputs.failed_threshold }}).

          Failing control ids:

          {{ outputs.parse_report.vars.controls_summary }}

          Execution {{ execution.id }}

          Work the remediation notes attached to the execution, then close this issue.
        labels:
          - kubernetes
          - cis-benchmark
      - id: alert_slack
        type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
        description: Tell the platform channel how many checks failed, which controls
          broke, and that a GitHub issue is waiting.
        url: "{{ secret('SLACK_WEBHOOK_URL') }}"
        payload: |
          {
            "text": "CIS benchmark audit FAILED for {{ inputs.cluster_name }} - {{ outputs.parse_report.vars.failed_count }} of {{ outputs.parse_report.vars.total_checks }} checks failed. Controls {{ outputs.parse_report.vars.controls_summary }}. Issue opened in {{ inputs.github_repository }}. Execution {{ execution.id }}."
          }
    else:
      - id: log_compliant
        type: io.kestra.plugin.core.log.Log
        description: Record the compliant result so the execution history doubles as
          audit evidence.
        message: "CIS benchmark audit passed for {{ inputs.cluster_name }} with {{
          outputs.parse_report.vars.failed_count }} failed check(s)."

errors:
  - id: notify_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: Escalate any failure to the ops channel with the execution url.
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {"text": "FAILED: {{ flow.id }} {{ execution.id }}"}

outputs:
  - id: verdict
    type: STRING
    description: PASS when the failed check count is within the threshold, otherwise FAIL.
    value: "{{ outputs.parse_report.vars.verdict }}"
  - id: failed_count
    type: INT
    description: Number of kube-bench checks whose status is FAIL, for example 2.
    value: "{{ outputs.parse_report.vars.failed_count }}"
  - id: critical_controls
    type: ARRAY
    description: 'Distinct failing CIS control ids, for example ["4.1.1", "4.1.5"].'
    value: "{{ outputs.parse_report.vars.critical_controls | toJson }}"
  - id: report_uri
    type: STRING
    description: Internal storage URI of the kube-bench JSON report produced by this run.
    value: "{{ outputs.run_kube_bench.outputFiles['kube-bench-report.json'] }}"

Diagram unavailable

We could not build the topology for this blueprint. The flow itself is valid, use the YAML on the left to run it.

How it works

weekly_cis_audit (io.kestra.plugin.core.trigger.Schedule, cron 0 6 * * 1) is the primary trigger and ships disabled: true, so nothing runs until an operator switches it on. on_demand_audit (io.kestra.plugin.core.trigger.Webhook, keyed) accepts an on-demand audit of a named cluster from a CI job or a laptop.
audit_workspace (io.kestra.plugin.core.flow.WorkingDirectory) opens one shared filesystem so the scan, the parser, and the remediation report all see the same files.
run_kube_bench (io.kestra.plugin.scripts.shell.Commands on the io.kestra.plugin.scripts.runner.docker.Docker runner, image aquasec/kube-bench:latest) first writes a mock-report.json fixture with a heredoc, then runs kube-bench --json-output > kube-bench-report.json || true. When no cluster is reachable the redirect comes up empty and the fixture is copied in, so the report always exists and the flow behaves the same offline and online. entryPoint: [] clears the image entrypoint so the script runs instead of kube-bench install.
parse_report (io.kestra.plugin.scripts.python.Script on python:3.12-slim) reads the JSON, counts total and failed checks, collects the distinct failing control ids, buckets failures by control section with their remediation text, writes the header of remediation-report.md, and emits everything through the outputs protocol.
append_remediation (io.kestra.plugin.core.flow.Loop, concurrencyLimit: 1) walks the failed control groups, and append_control_note appends one section per group so the report stays ordered and readable.
check_verdict (io.kestra.plugin.core.flow.If) compares failed_count with failed_threshold. Above it, open_remediation_issue (io.kestra.plugin.github.issues.Create) files a labeled issue carrying the control ids and alert_slack posts the counts to Slack. At or below it, log_compliant records the all-clear.
The errors block alerts Slack whenever the scan or the parse breaks, because a dead scanner looks exactly like a clean cluster.

What you get

Gateable results: verdict, failed_count, critical_controls, and report_uri are flow outputs any downstream flow can branch on.
Escalation where engineers already work: a labeled GitHub issue listing every failing control id, plus a Slack ping with the counts.
A remediation report that accumulates one note per failed control group, ready to attach to the issue or an audit evidence pack.
An audit trail, every execution clean or not is a dated record with the raw kube-bench JSON kept in internal storage.

Who it's for

Platform and SRE teams that must demonstrate CIS Kubernetes Benchmark posture on a schedule.
Security engineers who want failing controls turned into tracked work instead of a forgotten report.
Kubernetes operators validating a cluster after an upgrade or before an external review.

Why orchestrate this with Kestra

kube-bench is easy to run once and easy to forget. Kestra supplies the loop around it: a disabled-by-default weekly schedule as the safety net, a keyed webhook for on-demand runs, a hermetic container so the tool version lives in the flow file, a threshold branch that separates escalation from the all-clear, execution history with the raw report attached, and routing into GitHub and Slack from one declarative definition. A cron entry on a bastion host gives you none of that, it only audits the cluster someone remembered to run it against.

Prerequisites

A worker with Docker access, the scan runs in the kube-bench container and the parser in python:3.12-slim.
A reachable Kubernetes API for a real audit. Without one the flow still completes on the bundled fixture, which is exactly what makes it safe to run in CI or on a laptop.
A GitHub token that can open issues in github_repository (classic PAT scope repo, or fine-grained Issues: write).
A Slack incoming webhook for escalation and for failure alerts.

Secrets

KUBEBENCH_WEBHOOK_KEY: key segment guarding the on-demand webhook URL, anyone holding it can trigger an audit.
GITHUB_TOKEN: token used to open the remediation issue.
SLACK_WEBHOOK_URL: Slack incoming webhook URL.

Quick start

Add the three secrets to your Kestra namespace.
Run the flow once with the default inputs and confirm verdict, failed_count, critical_controls, and report_uri in the outputs.
Point github_repository at a repository where issues are welcome, then re-run with failed_threshold at 0 to watch the fixture failures open the issue and fire the Slack alert.
Trigger on_demand_audit at /api/v1/{tenant}/executions/webhook/{namespace}/kube-bench-cis-benchmark-audit/{KUBEBENCH_WEBHOOK_KEY}, or enable weekly_cis_audit once a cluster is reachable from the worker.

How to extend

Audit a fleet by fanning the cluster_name input out with a Loop over a cluster list, one execution per cluster.
Pin the benchmark with an extra kube-bench --benchmark flag on the scan task when a specific CIS version must be evidenced.
Ship remediation-report.md to S3 or attach it to the GitHub issue as an audit evidence artifact.
Turn a breach into a red run by adding io.kestra.plugin.core.execution.Fail under check_verdict.

Audit a Kubernetes Cluster Against the CIS Benchmark with kube-bench

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

New to Kestra?

Audit a Kubernetes Cluster Against the CIS Benchmark with kube-bench

How it works

What you get

Who it's for

Why orchestrate this with Kestra

Prerequisites

Secrets

Quick start

How to extend

Links

Tasks

Orchestrate with Kestra

Share this Blueprint

Create a Blueprint

More Infrastructure Blueprints

Gate a Kestra upgrade against every live flow

Retire Unused Kestra Flows with Quarantine, Approval and Restore

Knative Service Revision Failure and Scale Sentinel

KMS Key Rotation Compliance Gate

Audit Keycloak Realm Security and Fix It with On-Call Approval

Kong Ingress Upstream Target Unhealthy and Circuit Breaker Sentinel

New to Kestra?