An Overview of Kubernetes Security Projects at KubeCon Europe 2023

• vmclarity

  4 84 9.9 Go

  VMClarity is a tool for agentless detection and management of Virtual Machine Software Bill Of Materials (SBOM) and vulnerabilities

  

  VMClarity works similarly, but within the context of VMs used by cloud services to host containers and clusters. Compared to containers, VMs may be as (or even more) vulnerable to threats and they typically need complex tools for analysis. Following a similar pattern to KubeClarity, VMClarity supports aggregating multiple tools into one UI and CLI.

• kubeclarity

  5 1,254 8.2 Go

  KubeClarity is a tool for detection and management of Software Bill Of Materials (SBOM) and vulnerabilities of container images and filesystems

  

  KubeClarity runs on any Kubernetes cluster and provides a UI and CLI for analyzing images and generating SBOMs. By default, KubeClarity doesn’t have its own SBOM generator or vulnerability scanner, but instead supports third-party tools that you can enable in any combination, making it great for adding additional interfaces for existing toolchains.

• WorkOS

  workos.com

  sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• Lean and Mean Docker containers

  38 18,136 9.1 Go

  Slim(toolkit): Don't change anything in your container image and minify it by up to 30x (and for compiled languages even more) making it secure too! (free and open source)

  

  Slim.ai presents the data in a more user friendly way than many of the other tools in this post. On top of its open source SlimToolkit for identifying the contents of an image, Slim.ai uses Trivy for vulnerability scanning.

• syft

  32 5,417 9.8 Go

  CLI tool and library for generating a Software Bill of Materials from container images and filesystems

  

  Syft is a popular open source CLI tool created by Anchore for generating an SBOM from container images and filesystems. It’s designed to provide a catalog of dependencies for other tools to use as a data source. It supports many popular programming languages, package managers, and container image formats.

• Kyverno

  35 5,077 9.9 Go

  Kubernetes Native Policy Management

  

  Cosign is used for signing containers through a variety of different methods. It has strong integration with other open source tools, such as Kyverno.

• cyclonedx-gomod

  4 122 8.6 Go

  Creates CycloneDX Software Bill of Materials (SBOM) from Go modules

  

  CycloneDx-gomod

• in-toto

  4 824 8.9 Python

  in-toto is a framework to protect supply chain integrity.

  

  in-toto is an open source project that focuses on the attestation part of software supply chain security. You use it to define a “layout” for a project, i.e., how the different components should fit together. A project ships this definition with its code, and then another user of that software can compare what they have with the attached definition to see if it matches the structure and contents they expect. If it doesn’t, then this could point to external tampering or other issues.

• InfluxDB

  www.influxdata.com

  sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• grype

  55 7,583 9.5 Go

  A vulnerability scanner for container images and filesystems

  

  Grype is another popular open source tool from Anchore. Working with SBOM files, Grype scans container images and filesystems for vulnerabilities. Grype supports different output formats for vulnerabilities and custom templates for output.

• falco

  42 6,883 9.8 C++

  Cloud Native Runtime Security

  

  Falco is a well-known open source security solution originally created by Sysdig. It’s a CNCF incubating project and one of the few (as far as I can tell) options on this list that uses eBPF to scan for vulnerabilities.

• dependency-track

  17 2,303 9.8 Java

  Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain.

  

  Dependency-Track

• trivy

  82 21,222 9.7 Go

  Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

  

  Trivy is a mature and comprehensive open source tool from Aqua Security that supports scanning multiple sources, from file systems to containers and VMs. Trivy also looks beyond vulnerabilities, to scan licenses, secrets, infrastructure as code misconfiguration, and more.

• python-tuf

  3 1,578 9.3 Python

  Python reference implementation of The Update Framework (TUF)

  

  Confusingly named, it’s not a framework, but a specification that developers can follow when implementing their update systems to help users know they can trust the updates they receive. There’s also a Python reference implementation.

• cosign

  30 4,049 9.6 Go

  Code signing and transparency for containers and binaries

  

  sigstore is another suite of tools that focuses on attestation and provenance. Within the suite are two tools I heard mentioned a few times at KubeCon: Cosign and Rekor.

• rekor

  29 832 9.7 Go

  Software Supply Chain Transparency Log

  

  sigstore is another suite of tools that focuses on attestation and provenance. Within the suite are two tools I heard mentioned a few times at KubeCon: Cosign and Rekor.

• kubescape

  76 9,671 9.5 Go

  Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

  

  Kubescape is a comprehensive Kubernetes security platform and CNCF sandbox project. It can scan clusters, Helm charts, and YAML manifests to detect misconfigurations. It supports various frameworks, including NSA-CISA, MITRE ATT&CK®, and the CIS Benchmark.

• apko

  14 1,048 9.4 Go

  Build OCI images from APK packages directly without Dockerfile

  

  Chainguard also appears to have several open source projects.The most popular one is apko, used for building OCI images from APK packages.

• SaaSHub

  www.saashub.com

  sponsored

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

Suggest a related project