#2036·kube-bench

CIS benchmark 4.3.1 returns exit `1` when no process found, resulting in false positive

Author: btray900Created Jan 28, 2026Updated Feb 20, 2026

Overview

The node/master 4.3.1 check looks for the bound IP address for kube-proxy metrics port 10249.

When no proxy process is found the exit status 1 results in a test FAIL, rather than a PASS as 10249 does not exist at all, thus not bound to a non-loopback IP.

How did you run kube-bench?

Kubernetes daemonset

What happened?

json

 {
                    "section": "4.3",
                    "type": "",
                    "pass": 0,
                    "fail": 1,
                    "warn": 0,
                    "info": 0,
                    "desc": "kube-proxy",
                    "results": [
                        {
                            "test_number": "4.3.1",
                            "test_desc": "Ensure that the kube-proxy metrics service is bound to localhost (Automated)",
                            "audit": "/bin/ps -fC proxy",
                            "AuditEnv": "",
                            "AuditConfig": "/bin/sh -c 'if test -e /etc/kubernetes/proxy.conf; then cat /etc/kubernetes/proxy.conf; fi'",
                            "type": "",
                            "remediation": "Modify or remove any values which bind the metrics service to a non-localhost address.\nThe default value is 127.0.0.1:10249.\n",
                            "test_info": [
                                "Modify or remove any values which bind the metrics service to a non-localhost address.\nThe default value is 127.0.0.1:10249.\n"
                            ],
                            "status": "FAIL",
                            "actual_value": "",
                            "scored": true,
                            "IsMultiple": false,
                            "expected_result": "",
                            "reason": "failed to run: \"/bin/ps -fC proxy\", output: \"UID          PID    PPID  C STIME TTY          TIME CMD\\n\", error: exit status 1"
                        }
                    ]
                }

Test reason returned from here

What did you expect to happen:

That the test would PASS because 10249 is not listening at all and is not bound to a non-loopback IP.

Environment

Kube-bench version: v0.14.1 Kubernetes version: Kubeadm v1.33.7

Running processes

bash

root@rack1compute01 [ ~ ]# ps -eaf | grep kube
root        5917    5043  0 Jan27 ?        00:00:00 bash /kube-ovn/start-cniserver.sh --enable-mirror=false --mirror-iface=mirror0 --node-switch=join --encap-checksum=true --iface=ovngeneve --service-cluster-ip-range=10.96.0.0/12 --dpdk-tunnel-iface=br-phy --network-type=geneve --default-interface-name= --logtostderr=false --alsologtostderr=true --log_file=/var/log/kube-ovn/kube-ovn-cni.log --log_file_max_size=200 --enable-metrics=true --kubelet-dir=/var/lib/kubelet --enable-tproxy=false --ovs-vsctl-concurrency=100 --secure-serving=false --enable-ovn-ipsec=false
nobody      6161    5629  0 Jan27 ?        00:00:00 /bin/bash /kube-ovn/start-ovs.sh
root        6436    5917 17 Jan27 ?        06:28:13 ./kube-ovn-daemon --ovs-socket=/run/openvswitch/db.sock --bind-socket=/run/openvswitch/kube-ovn-daemon.sock --enable-mirror=false --mirror-iface=mirror0 --node-switch=join --encap-checksum=true --iface=ovngeneve --service-cluster-ip-range=10.96.0.0/12 --dpdk-tunnel-iface=br-phy --network-type=geneve --default-interface-name= --logtostderr=false --alsologtostderr=true --log_file=/var/log/kube-ovn/kube-ovn-cni.log --log_file_max_size=200 --enable-metrics=true --kubelet-dir=/var/libkubelet --enable-tproxy=false --ovs-vsctl-concurrency=100 --secure-serving=false --enable-ovn-ipsec=false
nobody      8654    7670  6 Jan27 ?        02:14:13 /process-exporter -children=true -procnames=dockerd,kubelet,kube-proxy,cron,rsyslogd,containerd
root       12696    7675  0 Jan27 ?        00:00:49 /csi-node-driver-registrar --v=2 --csi-address=/csi/csi.sock --kubelet-registration-path=/var/lib/kubelet/plugins/undercloud-volume.csi.azure.com/csi.sock
nobody     13966   13021  3 Jan27 ?        01:22:27 /kube-ovn/kube-ovn-pinger --external-address=1.1.1.1- --external-dns=kube-ovn.io. --ds-namespace=ns-system --logtostderr=false --alsologtostderr=true --log_file=/var/log/kube-ovn/kube-ovn-pinger.log --log_file_max_size=200 --enable-metrics=true
root       16704    7787  0 Jan27 ?        00:00:55 /csi-node-driver-registrar --v=5 --csi-address=/csi/csi.sock --kubelet-registration-path=/var/lib/kubelet/plugins/nfs.csi.azure.com/csi.sock
root       18448   13106  5 Jan27 ?        01:53:20 /bin/resource-topology-exporter --v=3 --sleep-interval=10s --sysfs=/host-sys --kubelet-config-file=/host-var/lib/kubelet/config.yaml --podresources-socket=unix:///host-var/lib/kubelet/pod-resources/kubelet.sock --notify-file=/host-run/rte/notify --pods-fingerprint --expose-timing --refresh-node-resources --topology-manager-policy=single-numa-node --topology-manager-scope=container
root       21750       1 20 Jan27 ?        07:36:12 /usr/bin/kubelet --bootstrap-kubeconfig=/etc/kubernetes/bootstrap-kubelet.conf --kubeconfig=/etc/kubernetes/kubelet.conf --config=/var/lib/kubelet/config.yaml --cgroup-driver=systemd --cgroup-root=workload --container-runtime-endpoint=unix:///run/containerd/containerd.sock --cpu-manager-policy=static --cpu-manager-policy-options=full-pcpus-only=true --cpu-manager-reconcile-period=10s --eviction-hard=imagefs.available<15%,memory.available<1Gi,nodefs.available<10%,nodefs.inodesFree<5% --max-pods=250 --memory-manager-policy=Static --node-ip=10.1.6.23 --node-labels=metal3.io/uuid=de123456-288f-4f5c-ac8d-753131c21e76,platform.domain.com/compute-plane=true,platform.domain.com/role=compute,node-type=worker,platform.domain.com/version=1.1.0 --pod-infra-container-image=acr.domain.com/oss/v2/kubernetes/pause:3.10 --provider-id=metal3://de123456-288f-4f5c-ac8d-753131c21e76 --register-with-taints=node.cluster.x-k8s.io/uninitialized:NoSchedule --resolv-conf=/etc/kubernetes/kubelet-resolv.conf --serialize-image-pulls=true --tls-cipher-suites=TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 --topology-manager-policy=best-effort --topology-manager-scope=pod --container-log-max-size=50M --reserved-cpus=0-3,56-59
nobody     22128   18728  0 Jan27 ?        00:09:32 /kube-state-metrics --port=8080 --telemetry-port=8081 --port=8080 --resources=pods --node=rack1compute01
root     1453240 1447327  0 16:12 pts/1    00:00:00 grep --color=auto kube
root     1453242    6436  0 16:12 ?        00:00:00 ./kube-ovn-daemon --ovs-socket=/run/openvswitch/db.sock --bind-socket=/run/openvswitch/kube-ovn-daemon.sock --enable-mirror=false --mirror-iface=mirror0 --node-switch=join --encap-checksum=true --iface=ovngeneve --service-cluster-ip-range=10.96.0.0/12 --dpdk-tunnel-iface=br-phy --network-type=geneve --default-interface-name= --logtostderr=false --alsologtostderr=true --log_file=/var/log/kube-ovn/kube-ovn-cni.log --log_file_max_size=200 --enable-metrics=true --kubelet-dir=/var/libkubelet --enable-tproxy=false --ovs-vsctl-concurrency=100 --secure-serving=false --enable-ovn-ipsec=false

Configuration files

[If kube-bench is reporting an issue related to the settings defined in a config file, please attach the file, or include an extract showing the settings that are being detected incorrectly.]

Anything else you would like to add:

In case different distros return ps output differently.

bash

DISTRIB_ID="azurelinux"
DISTRIB_RELEASE="3.0.20260107"
DISTRIB_CODENAME=AzureLinux
DISTRIB_DESCRIPTION="Azure Linux 3.0"
NAME="Microsoft Azure Linux"
VERSION="3.0.20260107"
ID=azurelinux
VERSION_ID="3.0"
PRETTY_NAME="Microsoft Azure Linux 3.0"
ANSI_COLOR="1;34"
HOME_URL="https://aka.ms/azurelinux"
BUG_REPORT_URL="https://aka.ms/azurelinux"
SUPPORT_URL="https://aka.ms/azurelinux"

Source: aquasecurity/kube-bench

View original on GitHub View discussion on GitHub