sig-security
badPods
Our great sponsors
sig-security | badPods | |
---|---|---|
21 | 2 | |
1,944 | 529 | |
2.1% | 0.0% | |
9.7 | 1.8 | |
2 days ago | almost 2 years ago | |
HTML | Shell | |
GNU General Public License v3.0 or later | MIT License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
sig-security
-
Introduction to the Kubernetes ecosystem
It is also interesting to meet the community : the TAGs (Tech Advisor Group) which provide strategic guidance and advice on technical issues, as well as the SIGs (Special Interest Group) which focuses on areas of interest or specific expertise within the Kubernetes community to drive development and innovation. The TAGs are specialized by areas, for example on security or environmental sustainability.
- Practicing Threat Modeling to Assess and Fortify Open Source Security [pdf]
-
Cloud Native Applications - Part 2: Security
Cloud Native Security Whitepaper
-
Does Kubernetes support SELinux?
As Daniel Walsh himself wrote in a blog post, CRI-O integrates very well with SELinux and prevents dangerous actions like a container loading an old, unmaintained and therefore potentially vulnerable kernel module and breaking out of the isolation. Additionally, the Kubernetes API itself contains resources to specifically configure SELinux labels for containers. Doesn't sound like something they would do for a tool that "doesn't work with Kubernetes", according to some. Also, the CNCF security whitepaper mentions SELinux as a tool that can be used to provide isolation and limit privileges, which is as much as we could expect from an high-level, architecturally-minded document.
- Cloud Native Security Whitepaper v2
- Cloud Native Security Whitepaper [pdf]
- Catalog of Supply Chain Compromises
- tag-security/supply-chain-security/compromises at main · cncf/tag-security
- supply-chain-security - Catalog of Supply Chain Compromises
badPods
- Bad Pods: Kubernetes Pod Privilege Escalation
-
[Security] Escaping a docker container through the web shell
Here is the section where I show a few different ways to exploit privileged mode using the Felix Wilhelm technique. https://github.com/BishopFox/badPods/tree/main/manifests/priv#remote-code-execution.
What are some alternatives?
cool-system - The Cloud Optimized Operational Lab (COOL) system
podschecker - podschecker is a simple script thats check your pods health on your terminal, it can send x11 notifications
mkosi - 💽 Build Bespoke OS Images
prowler - Prowler is an Open Source Security tool for AWS, Azure, GCP and Kubernetes to do security assessments, audits, incident response, compliance, continuous monitoring, hardening and forensics readiness. Includes CIS, NIST 800, NIST CSF, CISA, FedRAMP, PCI-DSS, GDPR, HIPAA, FFIEC, SOC2, GXP, Well-Architected Security, ENS and more
slsa - Supply-chain Levels for Software Artifacts
spack - A flexible package manager that supports multiple versions, configurations, platforms, and compilers.
cyclonedx-gomod - Creates CycloneDX Software Bill of Materials (SBOM) from Go modules
sample-tf-opa-policies
ostree - Operating system and container binary deployment and upgrades
vscode-datree - Simple VSCode Extension that allows you to run Datree tests on Kubernetes configurations.
Ansible - Ansible is a radically simple IT automation platform that makes your applications and systems easier to deploy and maintain. Automate everything from code deployment to network configuration to cloud management, in a language that approaches plain English, using SSH, with no agents to install on remote systems. https://docs.ansible.com.
ESPKey - Wiegand data logger, replay device and micro door-controller