Kubernetes Security Checklist 2021

• rbac-tool

  9 868 5.3 Go

  Rapid7 | insightCloudSec | Kubernetes RBAC Power Toys - Visualize, Analyze, Generate & Query

  

Role-Based Access Control (RBAC) should be configured for the Kubernetes cluster. Rights need to be assigned within the project namespace based on least privilege and separation of duties (RBAC-tool)

• KubiScan

  10 1,277 5.9 Python

  A tool to scan Kubernetes cluster for risky permissions

  

RBAC Rights should be audited regularly (KubiScan, Krane)

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• krane

  4 658 3.9 Ruby

  Kubernetes RBAC static analysis & visualisation tool (by appvia)

  

RBAC Rights should be audited regularly (KubiScan, Krane)

• Kyverno

  35 5,105 9.9 Go

  Kubernetes Native Policy Management

  

Use Policy engine (OPA, Kyverno)

• sealed-secrets

  69 7,120 9.2 Go

  A Kubernetes controller and tool for one-way encrypted Secrets

  

Secrets should be added to the container using the volumeMount mechanism or the secretKeyRef mechanism. For hiding secrets in source codes, for example, the sealed-secret tool can be used.

• falco

  42 6,895 9.8 C++

  Cloud Native Runtime Security

  

Use third-party security monitoring tool on all cluster nodes (Falco, Sysdig, Aqua Enterpise, NeuVector, Prisma Cloud Compute)

• documentation

  5 454 6.1 Shell

  Discontinued Kata Containers version 1.x documentation (for version 2.x see https://github.com/kata-containers/kata-containers). (by kata-containers)

  

For services with increased security requirements, it is recommended to use a low-level run-time with a high degree of isolation (gVisior, Kata-runtime)

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• lynis

  72 12,493 8.1 Shell

  Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

  

It is recommended to regularly scan packages and configuration for vulnerabilities(OpenSCAP profiles, Lynis)

• kube-bench

  23 6,635 8.4 Go

  Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark

  

Cluster Configuration should be audited regularly (Kube-bench, Kube-hunter, Kubestriker)

• kube-hunter

  10 4,613 4.5 Python

  Hunt for security weaknesses in Kubernetes clusters

  

Cluster Configuration should be audited regularly (Kube-bench, Kube-hunter, Kubestriker)

• scope

  4 5,820 0.0 Go

  Monitoring, visualisation & management for Docker & Kubernetes

  

Build observability and visibility processes in order to understand what is happening in infrastructure and services (Luntry, WaveScope)

• cvehound

  1 115 8.8 SmPL

  Check linux sources dump for known CVEs.

It is recommended to regularly update the OS kernel version (CVEhound)

• inspektor-gadget

  8 1,928 9.9 C

  The eBPF tool and systems inspection framework for Kubernetes, containers and Linux hosts.

  

All namespaces should have NetworkPolicy. Interactions between namespaces should be limited to NetworkPolicy following least privileges principles (Inspektor Gadget)

• udica

  4 434 5.7 Python

  This repository contains a tool for generating SELinux security profiles for containers

  

The application should have a seccomp, apparmor or selinux profile according to the principles of least privileges (Udica, Oci-seccomp-bpf-hook, Go2seccomp, Security Profiles Operator)

• oci-seccomp-bpf-hook

  2 286 7.0 Go

  OCI hook to trace syscalls and generate a seccomp profile

  

The application should have a seccomp, apparmor or selinux profile according to the principles of least privileges (Udica, Oci-seccomp-bpf-hook, Go2seccomp, Security Profiles Operator)

• go2seccomp

  1 135 10.0 Go

  Generate seccomp profiles from go binaries

The application should have a seccomp, apparmor or selinux profile according to the principles of least privileges (Udica, Oci-seccomp-bpf-hook, Go2seccomp, Security Profiles Operator)

• security-profiles-operator

  2 647 9.7 C

  The Kubernetes Security Profiles Operator

  

The application should have a seccomp, apparmor or selinux profile according to the principles of least privileges (Udica, Oci-seccomp-bpf-hook, Go2seccomp, Security Profiles Operator)

• kubeaudit

  7 1,837 3.8 Go

  kubeaudit helps you audit your Kubernetes clusters against common security controls

  

Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)

• kubescape

  76 9,686 9.5 Go

  Kubescape is an open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters. It includes risk analysis, security, compliance, and misconfiguration scanning, saving Kubernetes users and administrators precious time, effort, and resources.

  

Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)

• conftest

  9 2,785 8.5 Go

  Write tests against structured configuration data using the Open Policy Agent Rego query language

  

Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)

• kubesec

  3 1,149 8.1 Go

  Security risk analysis for Kubernetes resources

  

Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)

• checkov

  54 6,512 9.9 Python

  Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

  

Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)

• syft

  32 5,451 9.8 Go

  CLI tool and library for generating a Software Bill of Materials from container images and filesystems

  

It is necessary to explicitly indicate the versions of the installed packages. The SBOM building tools (Syft) can be used to determine the list of packages.

• hadolint

  24 9,677 2.3 Haskell

  Dockerfile linter, validate inline bash, written in Haskell

  

Dockerfile should be checked during development by automated scanners (Kics, Hadolint, Conftest)

• trivy

  82 21,316 9.7 Go

  Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

  

All images should be checked in the application lifecycle by automated scanners (Trivy, Clair, Grype)

• clair

  21 10,030 9.2 Go

  Vulnerability Static Analysis for Containers

  

All images should be checked in the application lifecycle by automated scanners (Trivy, Clair, Grype)

• grype

  55 7,623 9.5 Go

  A vulnerability scanner for container images and filesystems

  

All images should be checked in the application lifecycle by automated scanners (Trivy, Clair, Grype)

• slsa

  35 1,422 8.7 Shell

  Supply-chain Levels for Software Artifacts

  

Build secure CI and CD as same as suply chain process (SLSA)

• SaaSHub

  www.saashub.com sponsored

  SaaSHub - Software Alternatives and Reviews. SaaSHub helps you find the best software and product alternatives

  

Suggest a related project