Security · Flashcard
Why can kube-bench not report control-plane checks on an EKS or GKE cluster?
- AThe provider owns those nodes, so their flags and config files are not reachable
- BThe provider forbids benchmark tooling from running inside a managed cluster
- CThe CIS Kubernetes Benchmark omits control-plane recommendations from its profiles
- DThose recommendations are Manual, so no tool may report a result for them at all
Why this is the answer
kube-bench reads the API server, scheduler and controller-manager settings from files on the host, and the docs state plainly that inspecting the master nodes of managed clusters is impossible because you have no access to them — worker-node checks still work, which is why separate EKS and GKE job manifests exist. Nothing forbids running the tool. The benchmark does contain control-plane recommendations; they are simply unreachable. And Automated versus Manual status is unrelated to who owns the node.
Official docs