Some CIS checks (e.g., cis1.9/1.10 - 5.1.1 / 5.1.2 / 5.1.4) produce “connection refused” errors when kube-bench runs inside a pod due to a known kubectl limitation (Kubernetes issue #93474). These errors do not indicate actual compliance or security failures.
Proposed Workaround:
Until this is addressed in kubectl, consider marking these checks as manual to skip execution and suppress the false error messages.
References:
Kubernetes issue: #93474.
Some CIS checks (e.g., cis1.9/1.10 - 5.1.1 / 5.1.2 / 5.1.4) produce “connection refused” errors when kube-bench runs inside a pod due to a known kubectl limitation (Kubernetes issue #93474). These errors do not indicate actual compliance or security failures.
Proposed Workaround:
Until this is addressed in kubectl, consider marking these checks as manual to skip execution and suppress the false error messages.
References:
Kubernetes issue: #93474.