Space separator is not supported when auditing command line options
Author: matlajCreated May 7, 2026Updated May 7, 2026
Overview
kube-bench does not support checking the value of --flag value style (space separator) command line options on binaries.
How did you run kube-bench?
We ran into this because we specify the OVNKubernetes binary as the proxy binary in our CIS benchmark 1.12 config, and ovnkube uses space separators:
$ ./ovnkube --help
(...)
METRICS OPTIONS
--metrics-bind-address value The IP address and port for the OVN K8s metrics server to serve on (set to 0.0.0.0 for all IPv4 interfaces)
(...)What happened?
kube-bench did not detect the value on the command line option --metrics-bind-address 127.0.0.1.
What did you expect to happen:
kube-bench detects the value on the command line option --metrics-bind-address 127.0.0.1.
Environment
$ ./kube-bench version
0.15.4Anything else you would like to add:
A simple way to reproduce this:
- Edit
cfg/cis-1.12/node.yamlto the following:
---
controls:
version: "cis-1.12"
id: 4
text: "Worker Node Security Configuration"
type: "node"
groups:
- id: 4.1
text: "Worker Node Configuration Files"
checks:
- id: 4.1.1
text: "Verify that a space separator works"
audit: "/bin/ps -fC tail"
tests:
bin_op: or
test_items:
- flag: "--lines"
compare:
op: eq
value: 5
scored: true
- id: 4.1.2
text: "Verify that an equals sign separator works"
audit: "/bin/ps -fC tail"
tests:
bin_op: or
test_items:
- flag: "--sleep-interval"
compare:
op: eq
value: 4
scored: true- In one terminal, run
tail -f --lines 5 --sleep-interval=4 /dev/null - In another terminal, run
./kube-bench run --benchmark=cis-1.12 --group=4.1 --config-dir=./cfg/ - Observe that check 4.1.1 fails
Source: aquasecurity/kube-bench