kube-bench
Runs the CIS Kubernetes Benchmark against an existing cluster and reports which controls pass, which fail, and what to do about them.
The checks cover what usually is wrong in practice: file permissions on manifests and certificates, API server flags such as anonymous authentication and authorisation mode, whether audit logging is on, kubelet configuration and etcd settings. The tool runs either as a job in the cluster or as a binary directly on the node, and each result comes with the benchmark's reference number plus remediation text. Two caveats are worth knowing before treating the output as a grade. A large share of the controls are marked manual and require human judgement. And in managed services the control plane is hidden, so several checks cannot be performed at all — hence the provider-specific profiles.