Kubernetes Security Checklist 2021

• rbac-tool

  4 344 5.9 Go

  Rapid7 | insightCloudSec | Kubernetes RBAC Power Toys - Visualize, Analyze, Generate & Query

  

  Role-Based Access Control (RBAC) should be configured for the Kubernetes cluster. Rights need to be assigned within the project namespace based on least privilege and separation of duties (RBAC-tool)

• KubiScan

  8 850 3.0 Python

  A tool to scan Kubernetes cluster for risky permissions

  

  RBAC Rights should be audited regularly (KubiScan, Krane)

• SonarQube

  www.sonarqube.org

  sponsored

  Static code analysis for 29 languages.. Your projects are multi-language. So is SonarQube analysis. Find Bugs, Vulnerabilities, Security Hotspots, and Code Smells so you can release quality code every time. Get started analyzing your projects today for free.

  

• krane

  2 425 5.1 Ruby

  Kubernetes RBAC static Analysis & visualisation tool

  

  RBAC Rights should be audited regularly (KubiScan, Krane)

• Kyverno

  12 1,781 9.8 Go

  Kubernetes Native Policy Management

  

  Use Policy engine (OPA, Kyverno)

• sealed-secrets

  26 4,334 7.4 Go

  A Kubernetes controller and tool for one-way encrypted Secrets

  

  Secrets should be added to the container using the volumeMount mechanism or the secretKeyRef mechanism. For hiding secrets in source codes, for example, the sealed-secret tool can be used.

• falco

  17 4,453 9.4 C++

  Cloud Native Runtime Security

  

  Use third-party security monitoring tool on all cluster nodes (Falco, Sysdig, Aqua Enterpise, NeuVector, Prisma Cloud Compute)

• documentation

  4 454 6.1 Shell

  Kata Containers version 1.x documentation (for version 2.x see https://github.com/kata-containers/kata-containers). (by kata-containers)

  

  For services with increased security requirements, it is recommended to use a low-level run-time with a high degree of isolation (gVisior, Kata-runtime)

• Scout APM

  scoutapm.com

  sponsored

  Less time debugging, more time building. Scout APM allows you to find and fix performance issues with no hassle. Now with error monitoring and external services monitoring, Scout is a developer's best friend when it comes to application development.

  

• lynis

  35 9,266 8.2 Shell

  Lynis - Security auditing tool for Linux, macOS, and UNIX-based systems. Assists with compliance testing (HIPAA/ISO27001/PCI DSS) and system hardening. Agentless, and installation optional.

  

  It is recommended to regularly scan packages and configuration for vulnerabilities(OpenSCAP profiles, Lynis)

• kube-bench

  12 4,466 8.7 Go

  Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark

  

  Cluster Configuration should be audited regularly (Kube-bench, Kube-hunter, Kubestriker)

• kube-hunter

  6 3,452 5.0 Python

  Hunt for security weaknesses in Kubernetes clusters

  

  Cluster Configuration should be audited regularly (Kube-bench, Kube-hunter, Kubestriker)

• scope

  2 5,286 7.3 Go

  Monitoring, visualisation & management for Docker & Kubernetes

  

  Build observability and visibility processes in order to understand what is happening in infrastructure and services (Luntry, WaveScope)

• cvehound

  1 70 9.6 SmPL

  Check linux sources dump for known CVEs.

  It is recommended to regularly update the OS kernel version (CVEhound)

• inspektor-gadget

  1 804 9.4 C

  Collection of gadgets for debugging and introspecting Kubernetes applications using BPF

  

  All namespaces should have NetworkPolicy. Interactions between namespaces should be limited to NetworkPolicy following least privileges principles (Inspektor Gadget)

• udica

  2 303 5.1 Python

  This repository contains a tool for generating SELinux security profiles for containers

  

  The application should have a seccomp, apparmor or selinux profile according to the principles of least privileges (Udica, Oci-seccomp-bpf-hook, Go2seccomp, Security Profiles Operator)

• oci-seccomp-bpf-hook

  1 125 4.7 Go

  OCI hook to trace syscalls and generate a seccomp profile

  

  The application should have a seccomp, apparmor or selinux profile according to the principles of least privileges (Udica, Oci-seccomp-bpf-hook, Go2seccomp, Security Profiles Operator)

• go2seccomp

  1 127 10.0 Go

  Generate seccomp profiles from go binaries

  The application should have a seccomp, apparmor or selinux profile according to the principles of least privileges (Udica, Oci-seccomp-bpf-hook, Go2seccomp, Security Profiles Operator)

• security-profiles-operator

  1 272 9.6 C

  The Kubernetes Security Profiles Operator

  

  The application should have a seccomp, apparmor or selinux profile according to the principles of least privileges (Udica, Oci-seccomp-bpf-hook, Go2seccomp, Security Profiles Operator)

• kubeaudit

  4 1,134 6.9 Go

  kubeaudit helps you audit your Kubernetes clusters against common security controls

  

  Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)

• kubescape

  46 4,977 9.8 Go

  Kubescape is a K8s open-source tool providing a multi-cloud K8s single pane of glass, including risk analysis, security compliance, RBAC visualizer and image vulnerabilities scanning.

  

  Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)

• conftest

  6 2,085 8.4 Go

  Write tests against structured configuration data using the Open Policy Agent Rego query language

  

  Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)

• kubesec

  2 670 8.2 Shell

  Security risk analysis for Kubernetes resources

  

  Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)

• checkov

  19 3,685 10.0 Python

  Prevent cloud misconfigurations during build-time for Terraform, CloudFormation, Kubernetes, Serverless framework and other infrastructure-as-code-languages with Checkov by Bridgecrew.

  

  Workload configuration should be audited regularly (Kics, Kubeaudit, Kubescape, Conftest, Kubesec, Checkov)

• syft

  10 1,777 9.3 Go

  CLI tool and library for generating a Software Bill of Materials from container images and filesystems

  

  It is necessary to explicitly indicate the versions of the installed packages. The SBOM building tools (Syft) can be used to determine the list of packages.

• hadolint

  8 6,425 8.5 Haskell

  Dockerfile linter, validate inline bash, written in Haskell

  

  Dockerfile should be checked during development by automated scanners (Kics, Hadolint, Conftest)

• trivy

  33 10,126 9.3 Go

  Scanner for vulnerabilities in container images, file systems, and Git repositories, as well as for configuration issues

  

  All images should be checked in the application lifecycle by automated scanners (Trivy, Clair, Grype)

• clair

  9 8,422 9.1 Go

  Vulnerability Static Analysis for Containers

  

  All images should be checked in the application lifecycle by automated scanners (Trivy, Clair, Grype)

• grype

  22 2,813 9.2 Go

  A vulnerability scanner for container images and filesystems

  

  All images should be checked in the application lifecycle by automated scanners (Trivy, Clair, Grype)

• slsa

  4 576 9.4

  Supply-chain Levels for Software Artifacts

  

  Build secure CI and CD as same as suply chain process (SLSA)

Suggest a related project