Securing Kubernetes Deployments

This page summarizes the projects mentioned and recommended in the original post on dev.to

Our great sponsors
  • Scout APM - Truly a developer’s best friend
  • talent.io - Download talent.io’s Tech Salary Report
  • SonarQube - Static code analysis for 29 languages.
  • kubernetes

    Production-Grade Container Scheduling and Management

    The first thing to check is that the manifests are formally correct — in other words, they follow the Kubernetes OpenAPI specification. We’ll introduce two tools for this: kubeval and kubeconform.

  • kube-score

    Kubernetes object analysis with recommendations for improved reliability and security

    apps/v1/Deployment semaphore-demo-ruby-kubernetes 💥 [CRITICAL] Container Resources · semaphore-demo-ruby-kubernetes -> CPU limit is not set Resource limits are recommended to avoid resource DDOS. Set resources.limits.cpu · semaphore-demo-ruby-kubernetes -> Memory limit is not set Resource limits are recommended to avoid resource DDOS. Set resources.limits.memory · semaphore-demo-ruby-kubernetes -> CPU request is not set Resource requests are recommended to make sure that the application can start and run without crashing. Set resources.requests.cpu · semaphore-demo-ruby-kubernetes -> Memory request is not set Resource requests are recommended to make sure that the application can start and run without crashing. Set resources.requests.memory [CRITICAL] Container Image Pull Policy · semaphore-demo-ruby-kubernetes -> ImagePullPolicy is not set to Always It's recommended to always set the ImagePullPolicy to Always, to make sure that the imagePullSecrets are always correct, and to always get the image you want. [CRITICAL] Pod NetworkPolicy · The pod does not have a matching NetworkPolicy Create a NetworkPolicy that targets this pod to control who/what can communicate with this pod. Note, this feature needs to be supported by the CNI implementation used in the Kubernetes cluster to have an effect. [CRITICAL] Pod Probes · Container is missing a readinessProbe A readinessProbe should be used to indicate when the service is ready to receive traffic. Without it, the Pod is risking to receive traffic before it has booted. It's also used during rollouts, and can prevent downtime if a new version of the application is failing. More information: https://github.com/zegl/kube-score/blob/master/README_PROBES.md [CRITICAL] Container Security Context · semaphore-demo-ruby-kubernetes -> Container has no configured security context Set securityContext to run the container in a more secure context. v1/Service semaphore-demo-ruby-kubernetes-lb ✅

  • Scout APM

    Truly a developer’s best friend. Scout APM is great for developers who want to find and fix performance issues in their applications. With Scout, we'll take care of the bugs so you can focus on building great things 🚀.

  • semaphore-demo-ruby-kubernetes

    A Semaphore demo CI/CD pipeline for Kubernetes.

  • kubeconform

    A FAST Kubernetes manifests validator, with support for Custom Resources!

    wget https://github.com/yannh/kubeconform/releases/download/v0.4.12/kubeconform-linux-amd64.tar.gz tar xf kubeconform-linux-amd64.tar.gz sudo cp kubeconform /usr/local/bin checkout kubeconform --summary deployment.yml

NOTE: The number of mentions on this list indicates mentions on common posts plus user suggested alternatives. Hence, a higher number means a more popular project.

Suggest a related project

Related posts