aquasecurity/kube-bench ? reverse-engineered prompt

Build me a Go tool that checks whether a Kubernetes cluster is set up securely against the CIS Kubernetes Benchmark.

I want it to run from the command line, and also work well as a container or Kubernetes Job. It should automatically figure out the Kubernetes version when possible, pick the right set of checks, and print clear pass, fail, warning, and info style results in the terminal or logs.

Make the checks driven by YAML config files so it’s easy to update as the benchmark changes. Include support for running against master and node level security settings, and make the output easy to read for someone auditing a cluster. If useful, add sample job manifests and basic docs for how to run it in a cluster.

Please make it practical and polished, with sensible defaults, and if you need to look up current Kubernetes or CIS benchmark details online, go ahead and do that.