Kubernetes CIS Benchmarks are now available in Trivy

[itaysk]

Dear Kube-bench comunity,
We've announced last week that Kubernetes CIS benchmarks are now available in Trivy, our all-in-one security scanner. Trivy could scan Kubernetes clusters for workloads and cluster misconfigurations since a while back, but now it can do full CIS scanning, similar to kube-bench, and even better.

You can read the new item here: https://www.aquasec.com/news/cis-kubernetes-benchmarks-scanning-into-trivy/
And a detailed blog post here: https://blog.aquasec.com/trivy-kubernetes-cis-benchmark-scanning

Do let us know your feedback! Trivy is where our focus and attention is, and we will keep developing and expanding Kubernetes security scenarios with your help and support.

[06kellyjac]

If this is well received will kube-bench be retired in favor of trivy CIS scanning?

[itaysk]

Yes. We are trying to consolidate all of our scanning efforts in one place and that is Trivy.
In addition to more attention from the core team and the community, integrating with Trivy can improve the basic CIS scanning in ways we technically couldn't have achieved with kube-bench. For example workload configuration scans that was skipped by kube-bench (shown as MANUAL), and now can be automated with Trivy.

[06kellyjac]

Cool.
Once there's a plan for deprecating kube-bench in favour of trivy I'll start the process of removing it from nixpkgs.
I might put a warning message on it soon.

[06kellyjac]

Has there been any news on the deprecation of kube-bench?
I noticed tfsec now has a note about migration in the description and readme plus a migration guide.

[itaysk]

we had capacity/personnel challenges specifically around kubernetes tooling which made us put this transition on hold. we still want to eventually unify all k8s scanning in trivy, but for now we are not touching kube-bench.