{"id":38497,"date":"2019-10-31T22:24:06","date_gmt":"2019-10-31T19:24:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/33-instrumenta-dlya-bezopasnosti-kubernetes\/"},"modified":"2019-10-31T22:24:06","modified_gmt":"2019-10-31T19:24:06","slug":"33-instrumenta-dlya-bezopasnosti-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","title":{"rendered":"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i><b>Pozn. p\u0159ek.<\/b>: Pokud se zaj\u00edm\u00e1te o bezpe\u010dnost v infrastruktu\u0159e postaven\u00e9 na Kubernetes, tento skv\u011bl\u00fd p\u0159ehled od spole\u010dnosti Sysdig bude vynikaj\u00edc\u00edm v\u00fdchoz\u00edm bodem pro rychl\u00e9 sezn\u00e1men\u00ed se s aktu\u00e1ln\u00edmi \u0159e\u0161en\u00edmi. Obsahuje jak komplexn\u00ed syst\u00e9my od zn\u00e1m\u00fdch hr\u00e1\u010d\u016f na trhu, tak i mnohem skromn\u011bj\u0161\u00ed n\u00e1stroje, kter\u00e9 \u0159e\u0161\u00ed r\u016fzn\u00e9 probl\u00e9my. R\u00e1di se v koment\u00e1\u0159\u00edch dozv\u00edme o va\u0161ich zku\u0161enostech s t\u011bmito n\u00e1stroji a uv\u00edt\u00e1me odkazy na dal\u0161\u00ed projekty.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/4d9aa6583128844afadc1b06996c29b6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nSoftwarov\u00e9 produkty pro zabezpe\u010den\u00ed Kubernetes... je jich tolik a ka\u017ed\u00fd m\u00e1 sv\u00e9 c\u00edle, oblasti pou\u017eit\u00ed a licence.<\/p>\n<p>Proto jsme se rozhodli vytvo\u0159it tento seznam a zahrnuli jsme do n\u011bj jak open-source projekty, tak komer\u010dn\u00ed platformy od r\u016fzn\u00fdch dodavatel\u016f. Douf\u00e1me, \u017ee v\u00e1m pom\u016f\u017ee vybrat ty, kter\u00e9 v\u00e1s nejv\u00edce zaj\u00edmaj\u00ed, a nasm\u011bruje v\u00e1s spr\u00e1vn\u00fdm sm\u011brem v z\u00e1vislosti na va\u0161ich konkr\u00e9tn\u00edch pot\u0159eb\u00e1ch v oblasti zabezpe\u010den\u00ed Kubernetes.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Kategorie<\/h2>\n<p>\nAbychom usnadnili orientaci v seznamu, n\u00e1stroje jsou rozd\u011bleny podle hlavn\u00edch funkc\u00ed a oblast\u00ed pou\u017eit\u00ed. Vytvo\u0159ily se n\u00e1sleduj\u00edc\u00ed sekce:<\/p>\n<ul>\n<li> Skenov\u00e1n\u00ed obraz\u016f Kubernetes a statick\u00e1 anal\u00fdza;<\/li>\n<li> Runtime bezpe\u010dnost;<\/li>\n<li> S\u00ed\u0165ov\u00e1 bezpe\u010dnost Kubernetes;<\/li>\n<li> Distribuce obraz\u016f a spr\u00e1va tajemstv\u00ed;<\/li>\n<li> Audit bezpe\u010dnosti Kubernetes;<\/li>\n<li> Komplexn\u00ed komer\u010dn\u00ed produkty.<\/li>\n<\/ul>\n<p>\nP\u0159ejd\u011bme k v\u011bci:<\/p>\n<h2>Skenov\u00e1n\u00ed obraz\u016f Kubernetes<\/h2>\n<p><\/p>\n<h3>Anchore<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/anchore.com\">anchore.com<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (Apache) a komer\u010dn\u00ed nab\u00eddka<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/2c942e5a104feb4840a426157d5457f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nBal\u00ed\u010dek Anchore analyzuje kontejnery a umo\u017e\u0148uje prov\u00e1d\u011bt bezpe\u010dnostn\u00ed kontroly na z\u00e1klad\u011b politik definovan\u00fdch u\u017eivateli.<\/p>\n<p>Krom\u011b b\u011b\u017en\u00e9ho skenov\u00e1n\u00ed kontejnerov\u00fdch obraz\u016f na zn\u00e1m\u00e9 zranitelnosti z datab\u00e1ze CVE prov\u00e1d\u00ed Anchore \u0159adu dal\u0161\u00edch kontrol v r\u00e1mci politiky skenov\u00e1n\u00ed: ov\u011b\u0159uje Dockerfile, \u00faniky p\u0159ihla\u0161ovac\u00edch \u00fadaj\u016f, bal\u00ed\u010dky pou\u017e\u00edvan\u00fdch programovac\u00edch jazyk\u016f (npm, maven atd.), licence softwaru a mnohem v\u00edce.<\/p>\n<h3>Clair<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/coreos.com\/clair\">coreos.com\/claire<\/a><\/noindex> <i>(nyn\u00ed pod z\u00e1\u0161titou Red Hat)<\/i><\/li>\n<li> Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/81be8927c1fcbfa5d714836a1db3c7d8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nClair byl jedn\u00edm z prvn\u00edch open-source projekt\u016f pro skenov\u00e1n\u00ed obraz\u016f. Je \u0161iroce zn\u00e1m jako skener bezpe\u010dnosti, kter\u00fd je z\u00e1kladem pro registr obraz\u016f Quay <i>(tak\u00e9 od CoreOS \u2014 <b>pozn. p\u0159ek.<\/b>)<\/i>Clair dok\u00e1\u017ee shrom\u00e1\u017edit informace o CVE z mnoha zdroj\u016f, v\u010detn\u011b seznam\u016f zranitelnost\u00ed specifick\u00fdch pro linuxov\u00e9 distribuce, kter\u00e9 spravuj\u00ed bezpe\u010dnostn\u00ed t\u00fdmy Debianu, Red Hatu nebo Ubuntu.<\/p>\n<p>Na rozd\u00edl od Anchore se Clair p\u0159ev\u00e1\u017en\u011b zam\u011b\u0159uje na vyhled\u00e1v\u00e1n\u00ed zranitelnost\u00ed a porovn\u00e1v\u00e1n\u00ed dat s CVE. P\u0159esto produkt nab\u00edz\u00ed u\u017eivatel\u016fm n\u011bkter\u00e9 mo\u017enosti roz\u0161\u00ed\u0159en\u00ed funkcionality pomoc\u00ed plugin\u016f.<\/p>\n<h3>Dagda<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/eliasgranderubio\/dagda\">github.com\/eliasgranderubio\/dagda<\/a><\/noindex><\/li>\n<li> Licence: svobodn\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/242930fcb99017f80f7cfc2a676e16ef.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDagda prov\u00e1d\u00ed statickou anal\u00fdzu kontejnerov\u00fdch obraz\u016f za \u00fa\u010delem odhalen\u00ed zn\u00e1m\u00fdch zranitelnost\u00ed, trojan\u016f, vir\u016f, malware a dal\u0161\u00edch hrozeb.<\/p>\n<p>Od ostatn\u00edch podobn\u00fdch n\u00e1stroj\u016f se bal\u00ed\u010dek Dagda vyzna\u010duje dv\u011bma pozoruhodn\u00fdmi vlastnostmi:<\/p>\n<ul>\n<li> Skv\u011ble se integruje s <noindex><a rel=\"nofollow\" href=\"https:\/\/www.clamav.net\/\">ClamAV<\/a><\/noindex>, p\u016fsob\u00ed nejen jako n\u00e1stroj pro skenov\u00e1n\u00ed kontejnerov\u00fdch obraz\u016f, ale tak\u00e9 jako antivirus.<\/li>\n<li> Tak\u00e9 poskytuje runtime ochranu, v re\u00e1ln\u00e9m \u010dase p\u0159ij\u00edm\u00e1 ud\u00e1losti od d\u00e9mona Docker a integruje se s Falco <i>(viz n\u00ed\u017ee)<\/i> pro shroma\u017e\u010fov\u00e1n\u00ed bezpe\u010dnostn\u00edch ud\u00e1lost\u00ed b\u011bhem provozu kontejneru.<\/li>\n<\/ul>\n<p><\/p>\n<h3>KubeXray<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jfrog\/kubexray\">github.com\/jfrog\/kubexray<\/a><\/noindex><\/li>\n<li> Licence: svobodn\u00e1 (Apache), ale vy\u017eaduje z\u00edsk\u00e1n\u00ed dat od JFrog Xray (komer\u010dn\u00edho produktu)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/f3aafb0d694b810fd5a7046c270e3b4d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubeXray \u201enaslouch\u00e1\u201c ud\u00e1lostem API serveru Kubernetes a pomoc\u00ed metadat od JFrog Xray se star\u00e1 o to, aby se spou\u0161t\u011bly pouze pod&#8217;y, kter\u00e9 odpov\u00eddaj\u00ed aktu\u00e1ln\u00ed politice.<\/p>\n<p>KubeXray nejen prov\u00e1d\u00ed audit nov\u00fdch nebo aktualizovan\u00fdch kontejner\u016f v deployment&#8217;ech (podobn\u011b jako admission controller v Kubernetes), ale tak\u00e9 dynamicky kontroluje b\u011b\u017e\u00edc\u00ed kontejnery na shodu s nov\u00fdmi bezpe\u010dnostn\u00edmi politikami, p\u0159i\u010dem\u017e odstra\u0148uje zdroje odkazuj\u00edc\u00ed na zraniteln\u00e9 obrazy.<\/p>\n<h3>Snyk<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/snyk.io\/\">snyk.io<\/a><\/noindex><\/li>\n<li> Licence: svobodn\u00e1 (Apache) a komer\u010dn\u00ed verze<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/a36ded26e3a659474c1c154bc3e753bb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSnyk je neobvykl\u00fd skener zranitelnost\u00ed v tom smyslu, \u017ee je zvl\u00e1\u0161\u0165 zam\u011b\u0159en na v\u00fdvojov\u00fd proces a je propagov\u00e1n jako \"nepostradateln\u00e9 \u0159e\u0161en\u00ed\" pro v\u00fdvoj\u00e1\u0159e.<\/p>\n<p>Snyk se p\u0159\u00edmo p\u0159ipojuje k repozit\u00e1\u0159\u016fm k\u00f3du, parsuje manifest projektu a analyzuje importovan\u00fd k\u00f3d spolu s p\u0159\u00edm\u00fdmi a nep\u0159\u00edm\u00fdmi z\u00e1vislostmi. Snyk podporuje mnoho popul\u00e1rn\u00edch programovac\u00edch jazyk\u016f a dok\u00e1\u017ee odhalit skryt\u00e9 licen\u010dn\u00ed rizika.<\/p>\n<h3>Trivy<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/knqyf263\/trivy\">github.com\/knqyf263\/trivy<\/a><\/noindex><\/li>\n<li> Licence: svobodn\u00e1 (AGPL)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/b21dd72d590d719a7d13741117002999.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTrivy \u2014 jednoduch\u00fd, ale v\u00fdkonn\u00fd skener zranitelnost\u00ed pro kontejnery, snadno integrovateln\u00fd do CI\/CD pipeline. Jeho v\u00fdzna\u010dnou vlastnost\u00ed je jednoduchost instalace a pou\u017eit\u00ed: aplikace se skl\u00e1d\u00e1 z jedin\u00e9ho bin\u00e1rn\u00edho souboru a nevy\u017eaduje instalaci datab\u00e1ze ani dal\u0161\u00edch knihoven.<\/p>\n<p>Druhou stranou jednoduchosti Trivy je, \u017ee je t\u0159eba se nau\u010dit, jak analyzovat a pos\u00edlat v\u00fdsledky ve form\u00e1tu JSON, aby je mohly vyu\u017e\u00edt ostatn\u00ed bezpe\u010dnostn\u00ed n\u00e1stroje Kubernetes.<\/p>\n<h2>Bezpe\u010dnost runtime v Kubernetes<\/h2>\n<p><\/p>\n<h3>Falco<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/falco.org\/\">falco.org<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/0e2601a1ec4ec56ed9daea5f34f36e9a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFalco je sada n\u00e1stroj\u016f pro zaji\u0161t\u011bn\u00ed bezpe\u010dnosti cloudov\u00fdch runtime prost\u0159ed\u00ed. Pat\u0159\u00ed do rodiny projekt\u016f <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cncf.io\/sandbox-projects\/\">CNCF<\/a><\/noindex>.<\/p>\n<p>Pou\u017eit\u00edm Sysdig n\u00e1stroj\u016f na \u00farovni j\u00e1dra Linuxu a profilov\u00e1n\u00ed syst\u00e9mov\u00fdch vol\u00e1n\u00ed, Falco umo\u017e\u0148uje hlubok\u00e9 proniknut\u00ed do chov\u00e1n\u00ed syst\u00e9mu. Jeho mechanizmus runtime pravidel je schopen detekovat podez\u0159elou aktivitu v aplikac\u00edch, kontejnerech, z\u00e1kladn\u00edm hostiteli a orchestr\u00e1toru Kubernetes.<\/p>\n<p>Falco zaji\u0161\u0165uje \u00faplnou transparentnost ve funkci runtime a odhalov\u00e1n\u00ed hrozeb, p\u0159i\u010dem\u017e pro tyto \u00fa\u010dely umis\u0165uje speci\u00e1ln\u00ed agenty na uzly Kubernetes. T\u00edm p\u00e1dem odpad\u00e1 pot\u0159eba modifikovat kontejnery, zav\u00e1d\u011bn\u00edm do nich ciz\u00edho k\u00f3du nebo p\u0159id\u00e1v\u00e1n\u00edm sidecar kontejner\u016f.<\/p>\n<h3>Bezpe\u010dnostn\u00ed r\u00e1mce Linux pro runtime<\/h3>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/18f219ca98e481376265b753b638a7ec.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTyto nativn\u00ed r\u00e1mce pro j\u00e1dro Linux nejsou \u201ebezpe\u010dnostn\u00edmi n\u00e1stroji Kubernetes\u201c v obvykl\u00e9m smyslu, nicm\u00e9n\u011b si zaslou\u017e\u00ed zm\u00ednku, proto\u017ee jsou d\u016fle\u017eit\u00fdm prvkem v kontextu bezpe\u010dnosti runtime, kter\u00fd je sou\u010d\u00e1st\u00ed Kubernetes Pod Security Policy (PSP).<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/gitlab.com\/apparmor\/apparmor\/wikis\/home\/\">AppArmor<\/a><\/noindex> p\u0159ipojuje bezpe\u010dnostn\u00ed profil k proces\u016fm spu\u0161t\u011bn\u00fdm v kontejneru, ur\u010duje privilegium souborov\u00e9ho syst\u00e9mu, pravidla pro s\u00ed\u0165ov\u00fd p\u0159\u00edstup, p\u0159ipojov\u00e1n\u00ed knihoven atd. Jedn\u00e1 se o syst\u00e9m zalo\u017een\u00fd na mandatorn\u00edm \u0159\u00edzen\u00ed p\u0159\u00edstupu (Mandatory Access Control, MAC). Jin\u00fdmi slovy, zamezuje prov\u00e1d\u011bn\u00ed zak\u00e1zan\u00fdch akc\u00ed.<\/p>\n<p>Security-Enhanced Linux (<noindex><a rel=\"nofollow\" href=\"https:\/\/selinuxproject.org\/page\/Main_Page\">SELinux<\/a><\/noindex>) je roz\u0161\u00ed\u0159en\u00fd bezpe\u010dnostn\u00ed modul v j\u00e1d\u0159e Linuxu, v n\u011bkter\u00fdch aspektech podobn\u00fd AppArmor a \u010dasto s n\u00edm porovn\u00e1van\u00fd. SELinux p\u0159evy\u0161uje AppArmor svou moc\u00ed, flexibilitou a preciznost\u00ed nastaven\u00ed. Jeho nev\u00fdhody jsou del\u0161\u00ed doba zau\u010den\u00ed a zv\u00fd\u0161en\u00e1 slo\u017eitost.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/seccomp\/libseccomp\">Seccomp<\/a><\/noindex> a seccomp-bpf umo\u017e\u0148uj\u00ed filtrovat syst\u00e9mov\u00e9 vol\u00e1n\u00ed, blokovat prov\u00e1d\u011bn\u00ed t\u011bch, kter\u00e9 jsou potenci\u00e1ln\u011b nebezpe\u010dn\u00e9 pro z\u00e1kladn\u00ed OS a nejsou pot\u0159ebn\u00e9 pro norm\u00e1ln\u00ed chod u\u017eivatelsk\u00fdch aplikac\u00ed. Seccomp je v n\u011bkter\u00fdch aspektech podobn\u00fd Falco, i kdy\u017e nezn\u00e1 specifika kontejner\u016f.<\/p>\n<h3>Sysdig open source<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sysdig.com\/opensource\">www.sysdig.com\/opensource<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/4f8849a6cc819cef89f10ab80911c504.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSysdig je komplexn\u00ed n\u00e1stroj pro anal\u00fdzu, diagnostiku a debugov\u00e1n\u00ed Linuxov\u00fdch syst\u00e9m\u016f (tak\u00e9 funguje na Windows a macOS, ale s omezen\u00fdmi funkcemi). M\u016f\u017ee b\u00fdt pou\u017eit pro sb\u011br podrobn\u00fdch informac\u00ed, kontrolu a krimin\u00e1ln\u00ed expertizu <i>(forenzn\u00ed)<\/i> z\u00e1kladn\u00edho syst\u00e9mu a jak\u00fdchkoliv kontejner\u016f, kter\u00e9 na n\u011bm b\u011b\u017e\u00ed.<\/p>\n<p>Sysdig tak\u00e9 zpo\u010d\u00e1tku podporuje spou\u0161t\u011bc\u00ed prost\u0159ed\u00ed pro kontejnery a metadata Kubernetes, p\u0159id\u00e1v\u00e1 dal\u0161\u00ed m\u011b\u0159en\u00ed a \u0161t\u00edtky ke v\u0161em shroma\u017e\u010fovan\u00fdm informac\u00edm o chov\u00e1n\u00ed syst\u00e9mu. Existuje n\u011bkolik zp\u016fsob\u016f anal\u00fdzy klastru Kubernetes pomoc\u00ed Sysdig: lze prov\u00e9st zachycen\u00ed v ur\u010dit\u00e9m okam\u017eiku pomoc\u00ed <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sysdiglabs\/kubectl-capture\">kubectl capture<\/a><\/noindex> nebo spustit interaktivn\u00ed rozhran\u00ed na b\u00e1zi ncurses pomoc\u00ed pluginu <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sysdiglabs\/kubectl-dig\">kubectl dig<\/a><\/noindex>.<\/p>\n<h2>S\u00ed\u0165ov\u00e1 bezpe\u010dnost Kubernetes<\/h2>\n<p><\/p>\n<h3>Aporeto<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aporeto.com\/\">www.aporeto.com<\/a><\/noindex><\/li>\n<li> Licence: komer\u010dn\u00ed<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/9692c50339a6c304c7f32f90619aaed1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAporeto nab\u00edz\u00ed \u201ebezpe\u010dnost odd\u011blenou od s\u00edt\u011b a infrastruktury\u201c. To znamen\u00e1, \u017ee slu\u017eby Kubernetes nejen\u017ee z\u00edsk\u00e1vaj\u00ed lok\u00e1ln\u00ed ID (tj. ServiceAccount v Kubernetes), ale tak\u00e9 univerz\u00e1ln\u00ed identifik\u00e1tor\/otisk, kter\u00fd lze pou\u017e\u00edt pro bezpe\u010dnou a vz\u00e1jemn\u011b ov\u011b\u0159enou interakci s jakoukoliv jinou slu\u017ebou, nap\u0159\u00edklad v klastru OpenShift.<\/p>\n<p>Aporeto je schopen generovat jedine\u010dn\u00fd identifik\u00e1tor nejen pro Kubernetes\/kontejnery, ale tak\u00e9 pro hostitele, cloudov\u00e9 funkce a u\u017eivatele. Na z\u00e1klad\u011b t\u011bchto identifik\u00e1tor\u016f a sady pravidel s\u00ed\u0165ov\u00e9 bezpe\u010dnosti stanoven\u00fdch administr\u00e1torem budou komunikace povoleny nebo zablokov\u00e1ny.<\/p>\n<h3>Calico<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.projectcalico.org\/\">www.projectcalico.org<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/5902a133d4afc496f035de0f63129f99.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCalico se obvykle nasazuje b\u011bhem instalace orchestrace kontejner\u016f, co\u017e umo\u017e\u0148uje vytvo\u0159it virtu\u00e1ln\u00ed s\u00ed\u0165 spojuj\u00edc\u00ed kontejnery. Krom\u011b t\u00e9to z\u00e1kladn\u00ed s\u00ed\u0165ov\u00e9 funk\u010dnosti projekt Calico pracuje s Kubernetes Network Policies a sv\u00fdm vlastn\u00edm souborem profil\u016f s\u00ed\u0165ov\u00e9 bezpe\u010dnosti, podporuje ACL (seznamy \u0159\u00edzen\u00ed p\u0159\u00edstupu) pro endpoint&#8217;y a pravidla s\u00ed\u0165ov\u00e9 bezpe\u010dnosti na z\u00e1klad\u011b anotac\u00ed pro Ingress a Egress provoz.<\/p>\n<h3>Cilium<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cilium.io\/\">www.cilium.io<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/2a9f3d1de52936c2f1a06d96fab054fb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCilium funguje jako firewall pro kontejnery a poskytuje funkce pro zaji\u0161t\u011bn\u00ed s\u00ed\u0165ov\u00e9 bezpe\u010dnosti, kter\u00e9 jsou p\u016fvodn\u011b p\u0159izp\u016fsobeny Kubernetes a pracovn\u00edm z\u00e1t\u011b\u017e\u00edm mikroservis\u016f. Cilium vyu\u017e\u00edv\u00e1 novou technologii j\u00e1dra Linuxu nazvanou BPF (Berkeley Packet Filter) k filtrov\u00e1n\u00ed, monitorov\u00e1n\u00ed, p\u0159esm\u011brov\u00e1n\u00ed a \u00faprav\u011b dat.<\/p>\n<p>Cilium je schopno nasazovat politiky s\u00ed\u0165ov\u00e9ho p\u0159\u00edstupu na z\u00e1klad\u011b identifik\u00e1tor\u016f kontejner\u016f, vyu\u017e\u00edvaj\u00edc\u00ed Docker nebo Kubernetes \u0161t\u00edtky a metadata. Cilium tak\u00e9 rozum\u00ed a filtruje r\u016fzn\u00e9 protokoly 7. \u00farovn\u011b, jako je HTTP nebo gRPC, umo\u017e\u0148uj\u00edc\u00ed definovat sadu REST vol\u00e1n\u00ed, kter\u00e1 nap\u0159\u00edklad budou povolena mezi dv\u011bma deployment&#8217;y Kubernetes.<\/p>\n<h3>Istio<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/\">istio.io<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/da9e18500fffdf2c310182a4820c722d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIstio je \u0161iroce zn\u00e1m\u00fd jako realizace paradigmatu service mesh prost\u0159ednictv\u00edm nasazen\u00ed nez\u00e1visl\u00e9 na platform\u011b control plane a p\u0159esm\u011brov\u00e1n\u00ed ve\u0161ker\u00e9ho \u0159\u00edzen\u00e9ho servisn\u00edho provozu p\u0159es dynamicky konfigurovan\u00e9 proxy Envoy. Istio vyu\u017e\u00edv\u00e1 tuto modern\u00ed p\u0159edstavu v\u0161ech mikroservis\u016f a kontejner\u016f k implementaci r\u016fzn\u00fdch strategi\u00ed s\u00ed\u0165ov\u00e9 bezpe\u010dnosti.<\/p>\n<p>Mo\u017enosti Istio v oblasti zaji\u0161t\u011bn\u00ed s\u00ed\u0165ov\u00e9 bezpe\u010dnosti zahrnuj\u00ed transparentn\u00ed \u0161ifrov\u00e1n\u00ed TLS pro automatick\u00e9 zlep\u0161en\u00ed protokolu komunikace mezi mikroservisy na HTTPS a vlastn\u00ed syst\u00e9m RBAC pro identifikaci a autorizaci, kter\u00fd umo\u017e\u0148uje schvalov\u00e1n\u00ed\/z\u00e1kazy v\u00fdm\u011bny dat mezi r\u016fzn\u00fdmi pracovn\u00edmi z\u00e1t\u011b\u017eemi v klastru.<\/p>\n<p><i><b>Pozn. p\u0159ek.<\/b>: V\u00edce informac\u00ed o bezpe\u010dnostn\u00edch funkc\u00edch Istio naleznete v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443668\/\">tomto \u010dl\u00e1nku<\/a><\/noindex>.<\/i><\/p>\n<h3>Tigera<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tigera.io\/\">www.tigera.io<\/a><\/noindex><\/li>\n<li> Licence: komer\u010dn\u00ed<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/3568cf2fc634d4c40c45f0db4a08aa77.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV tomto \u0159e\u0161en\u00ed, nazvan\u00e9m \"firewall Kubernetes\", se klade d\u016fraz na p\u0159\u00edstup k s\u00ed\u0165ov\u00e9 bezpe\u010dnosti s nulovou d\u016fv\u011brou.<\/p>\n<p>Podobn\u011b jako u jin\u00fdch nativn\u00edch s\u00ed\u0165ov\u00fdch \u0159e\u0161en\u00ed pro Kubernetes se Tigera spol\u00e9h\u00e1 na metadata p\u0159i identifikaci r\u016fzn\u00fdch slu\u017eeb a objekt\u016f v klastru a poskytuje detekci probl\u00e9m\u016f v runtime, neust\u00e1l\u00e9 kontroly souladu a transparentnost s\u00edt\u011b pro multicloudov\u00e9 nebo hybridn\u00ed monolitick\u00e9 kontejnerizovan\u00e9 infrastruktury.<\/p>\n<h3>Trireme<\/h3>\n<p><\/p>\n<ul>\n<li>Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aporeto.com\/opensource\/\">www.aporeto.com\/opensource<\/a><\/noindex><\/li>\n<li>Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/5924b4c2a0f6324e9d946c0261cbc53f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTrireme-Kubernetes je jednoduch\u00e1 a srozumiteln\u00e1 implementace specifikace Network Policies Kubernetes. Nejzaj\u00edmav\u011bj\u0161\u00ed vlastnost\u00ed je, \u017ee na rozd\u00edl od podobn\u00fdch produkt\u016f pro s\u00ed\u0165ovou bezpe\u010dnost Kubernetes nevy\u017eaduje centr\u00e1ln\u00ed control plane pro koordinaci s\u00edt\u011b (mesh). To \u010din\u00ed \u0159e\u0161en\u00ed trivi\u00e1ln\u011b \u0161k\u00e1lovateln\u00fdm. V Trireme je to dosa\u017eeno instalac\u00ed agenta na ka\u017ed\u00fd uzel, kter\u00fd se p\u0159\u00edmo p\u0159ipojuje k TCP\/IP z\u00e1sobn\u00edku hostitele.<\/p>\n<h2>Distribuce obraz\u016f a spr\u00e1va tajemstv\u00ed<\/h2>\n<p><\/p>\n<h3>Grafeas<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/grafeas.io\/\">grafeas.io<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/92c9986b36991d280cce0b1093e1938f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGrafeas je API s otev\u0159en\u00fdm zdrojov\u00fdm k\u00f3dem pro audity a spr\u00e1vu dodavatelsk\u00e9ho \u0159et\u011bzce softwaru. Na z\u00e1kladn\u00ed \u00farovni Grafeas p\u0159edstavuje n\u00e1stroj pro sb\u011br metadat a v\u00fdro\u010dn\u00edch zpr\u00e1v. M\u016f\u017ee b\u00fdt pou\u017eit pro sledov\u00e1n\u00ed shody s nejlep\u0161\u00edmi praktikami bezpe\u010dnosti v organizaci.<\/p>\n<p>Tento centralizovan\u00fd zdroj pravdy pom\u00e1h\u00e1 odpov\u011bd\u011bt na ot\u00e1zky jako:<\/p>\n<ul>\n<li> Kdo sestavil a podepsal konkr\u00e9tn\u00ed kontejner?<\/li>\n<li> Pro\u0161el v\u0161emi skenery bezpe\u010dnosti a kontrolami stanoven\u00fdmi politikou bezpe\u010dnosti? Kdy? Jak\u00e9 byly v\u00fdsledky? <\/li>\n<li> Kdo ho nasadil do produkce? Jak\u00e9 konkr\u00e9tn\u00ed parametry byly pou\u017eity b\u011bhem nasazen\u00ed?<\/li>\n<\/ul>\n<p><\/p>\n<h3>In-toto<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/in-toto.github.io\/\">in-toto.github.io<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/91f0ba618f41dbadb07b37ec6999a736.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIn-toto je r\u00e1mec navr\u017een\u00fd pro zaji\u0161t\u011bn\u00ed integrity, autentizace a auditu cel\u00e9ho dodavatelsk\u00e9ho \u0159et\u011bzce softwaru. P\u0159i nasazen\u00ed In-toto v infrastruktu\u0159e se nejprve nastavuje pl\u00e1n, kter\u00fd popisuje r\u016fzn\u00e9 kroky v pipeline (repozit\u00e1\u0159e, n\u00e1stroje CI\/CD, n\u00e1stroje QA, sb\u011bra\u010de artefakt\u016f atd.) a u\u017eivatele (odpov\u011bdn\u00e9 osoby), kter\u00fdm je povoleno je iniciovat.<\/p>\n<p>In-toto sleduje prov\u00e1d\u011bn\u00ed pl\u00e1nu t\u00edm, \u017ee ov\u011b\u0159uje, \u017ee ka\u017ed\u00e1 \u00faloha v \u0159et\u011bzci je vykon\u00e1na spr\u00e1vn\u011b v\u00fdhradn\u011b autorizovan\u00fdm person\u00e1lem a b\u011bhem pohybu s produktem nedoch\u00e1z\u00ed k \u017e\u00e1dn\u00fdm neopr\u00e1vn\u011bn\u00fdm manipulac\u00edm.<\/p>\n<h3>Portieris<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/IBM\/portieris\">github.com\/IBM\/portieris<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/ff9c24c88cd9a06c8bd35dfe4f3558cf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPortieris je admission controller pro Kubernetes; pou\u017e\u00edv\u00e1 se pro nucen\u00e9 kontroly d\u016fv\u011bryhodnosti obsahu. Portieris pou\u017e\u00edv\u00e1 server <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/theupdateframework\/notary\">Notary<\/a><\/noindex> <i>(psali jsme o n\u011bm na konci <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/340366\/\">tohoto \u010dl\u00e1nku<\/a><\/noindex> \u2014 <b>pozn. p\u0159ek.<\/b>)<\/i> jako zdroj pravdy pro ov\u011b\u0159en\u00ed d\u016fv\u011bryhodn\u00fdch a podepsan\u00fdch artefakt\u016f (tj. schv\u00e1len\u00fdch kontejnerov\u00fdch obraz\u016f).<\/p>\n<p>P\u0159i vytv\u00e1\u0159en\u00ed nebo zm\u011bn\u011b pracovn\u00ed z\u00e1t\u011b\u017ee v Kubernetes Portieris na\u010d\u00edt\u00e1 informace o podpisu a politiku d\u016fv\u011bry k obsahu pro po\u017eadovan\u00e9 obrazy kontejner\u016f a v p\u0159\u00edpad\u011b pot\u0159eby na m\u00edst\u011b prov\u00e1d\u00ed zm\u011bny v JSON objektu API pro spu\u0161t\u011bn\u00ed podepsan\u00fdch verz\u00ed t\u011bchto obraz\u016f.<\/p>\n<h3>Vault<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.vaultproject.io\/\">www.vaultproject.io<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (MPL)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/19191a10051dc6349af017a06f0fd43e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVault je bezpe\u010dn\u00e9 \u0159e\u0161en\u00ed pro ukl\u00e1d\u00e1n\u00ed citliv\u00fdch informac\u00ed: hesel, OAuth token\u016f, PKI certifik\u00e1t\u016f, p\u0159\u00edstupov\u00fdch \u00fa\u010dt\u016f, tajemstv\u00ed Kubernetes atd. Vault podporuje mnoho pokro\u010dil\u00fdch funkc\u00ed, jako je pron\u00e1jem efem\u00e9rn\u00edch bezpe\u010dnostn\u00edch token\u016f nebo organizace rotace kl\u00ed\u010d\u016f.<\/p>\n<p>Pomoc\u00ed Helm chartu Vault lze nasadit jako nov\u00fd deployment v klastru Kubernetes s Consul&#8217;em jako backendov\u00fdm \u00falo\u017ei\u0161t\u011bm. Podporuje nativn\u00ed zdroje Kubernetes, jako jsou tokeny ServiceAccount a m\u016f\u017ee dokonce fungovat jako standardn\u00ed \u00falo\u017ei\u0161t\u011b tajemstv\u00ed Kubernetes.<\/p>\n<p><i><b>Pozn. p\u0159ek.<\/b>: Mimochodem, doslova v\u010dera spole\u010dnost HashiCorp, vyv\u00edjej\u00edc\u00ed Vault, ozn\u00e1mila n\u011bkter\u00e1 vylep\u0161en\u00ed pro pou\u017e\u00edv\u00e1n\u00ed Vault v Kubernetes, zejm\u00e9na co se t\u00fd\u010de Helm chartu. Podrobnosti si p\u0159e\u010dt\u011bte v <noindex><a rel=\"nofollow\" href=\"https:\/\/www.hashicorp.com\/blog\/whats-next-for-vault-and-kubernetes\">blogu v\u00fdvoj\u00e1\u0159e<\/a><\/noindex>.<\/i><\/p>\n<h2>Audit bezpe\u010dnosti Kubernetes<\/h2>\n<p><\/p>\n<h3>Kube-bench<\/h3>\n<p><\/p>\n<ul>\n<li>Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/kube-bench\">github.com\/aquasecurity\/kube-bench<\/a><\/noindex><\/li>\n<li>Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/8e0e101503f02ea3033f7b29c9ee9ddf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKube-bench je aplikace v Go, kter\u00e1 kontroluje, zda je Kubernetes nasazen bezpe\u010dn\u011b, prov\u00e1d\u011bn\u00edm test\u016f z seznamu <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/container-compliance\/\">CIS Kubernetes Benchmark<\/a><\/noindex>.<\/p>\n<p>Kube-bench hled\u00e1 nezabezpe\u010den\u00e9 konfigurace mezi komponenty klastru (etcd, API, controller manager atd.), podez\u0159el\u00e1 p\u0159\u00edstupov\u00e1 pr\u00e1va k soubor\u016fm, nezabezpe\u010den\u00e9 \u00fa\u010dty nebo otev\u0159en\u00e9 porty, kv\u00f3ty zdroj\u016f, nastaven\u00ed limit\u016f po\u010dtu API vol\u00e1n\u00ed pro ochranu p\u0159ed DoS \u00fatoky atd.<\/p>\n<h3>Kube-hunter<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/kube-hunter\">github.com\/aquasecurity\/kube-hunter<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/e5e38368af8bf086da149cbfd71a5e6d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKube-hunter \"lov\u00ed\" potenci\u00e1ln\u00ed zranitelnosti (jako je vzd\u00e1len\u00e9 spu\u0161t\u011bn\u00ed k\u00f3du nebo \u00fanik dat) v klastrech Kubernetes. Kube-hunter lze spustit jako vzd\u00e1len\u00fd skener - v tomto p\u0159\u00edpad\u011b zhodnot\u00ed klastr z pohledu extern\u00edho \u00fato\u010dn\u00edka - nebo jako pod uvnit\u0159 klastru.<\/p>\n<p>Vlastnost\u00ed Kube-hunter&#8217;a je re\u017eim \u201eaktivn\u00ed lov\u201c, b\u011bhem kter\u00e9ho nejen hl\u00e1s\u00ed probl\u00e9my, ale tak\u00e9 se pokou\u0161\u00ed vyu\u017e\u00edvat zranitelnosti nalezen\u00e9 v c\u00edlov\u00e9m klastru, kter\u00e9 potenci\u00e1ln\u011b mohou po\u0161kodit jeho fungov\u00e1n\u00ed. Tak\u017ee se pou\u017e\u00edvejte s opatrnost\u00ed!<\/p>\n<h3>Kubeaudit<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Shopify\/kubeaudit\">github.com\/Shopify\/kubeaudit<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (MIT)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/84651a05f714b9c841245cb38f78324a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubeaudit je konzolov\u00fd n\u00e1stroj, kter\u00fd byl p\u016fvodn\u011b vyvinut ve spole\u010dnosti Shopify pro audit konfigurace Kubernetes s ohledem na r\u016fzn\u00e9 bezpe\u010dnostn\u00ed probl\u00e9my. Nap\u0159\u00edklad pom\u00e1h\u00e1 odhalovat kontejnery b\u011b\u017e\u00edc\u00ed bez omezen\u00ed, se superu\u017eivatelsk\u00fdmi pr\u00e1vy, zneu\u017e\u00edvaj\u00edc\u00edmi privilegium nebo pou\u017e\u00edvaj\u00edc\u00ed v\u00fdchoz\u00ed ServiceAccount.<\/p>\n<p>Kubeaudit m\u00e1 i dal\u0161\u00ed zaj\u00edmav\u00e9 funkce. Nap\u0159\u00edklad dok\u00e1\u017ee analyzovat m\u00edstn\u00ed YAML soubory, odhalovat nedostatky v konfiguraci, kter\u00e9 by mohly zp\u016fsobit bezpe\u010dnostn\u00ed probl\u00e9my, a automaticky je opravovat.<\/p>\n<h3>Kubesec<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/kubesec.io\/\">kubesec.io<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/73e395cdcbe89af391b80ff9dccad5f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubesec je zvl\u00e1\u0161tn\u00ed n\u00e1stroj v tom smyslu, \u017ee p\u0159\u00edmo skenuje YAML soubory popisuj\u00edc\u00ed Kubernetes zdroje ve vyhled\u00e1v\u00e1n\u00ed slab\u00fdch parametr\u016f, kter\u00e9 mohou ovlivnit bezpe\u010dnost.<\/p>\n<p>Nap\u0159\u00edklad m\u016f\u017ee odhalit nadbyte\u010dn\u00e1 opr\u00e1vn\u011bn\u00ed a povolen\u00ed poskytnut\u00e1 pod&#8217;u, spu\u0161t\u011bn\u00ed kontejneru s root&#8217;em jako u\u017eivatelsk\u00fdm \u00fa\u010dtem, p\u0159ipojen\u00ed k s\u00ed\u0165ov\u00e9mu namespace hostitele nebo nebezpe\u010dn\u00e1 montov\u00e1n\u00ed jako <code>\/proc<\/code> hosta nebo socketu Dockeru. Dal\u0161\u00ed zaj\u00edmavou funkc\u00ed Kubesec je online demo slu\u017eba, do kter\u00e9 lze nahr\u00e1t YAML a okam\u017eit\u011b prov\u00e9st jeho anal\u00fdzu.<\/p>\n<h3>Open Policy Agent<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openpolicyagent.org\/\">www.openpolicyagent.org<\/a><\/noindex><\/li>\n<li> Licence: voln\u00e1 (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/f897b58fbc67d9cb463008621f4e608f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKoncept OPA (Open Policy Agent) spo\u010d\u00edv\u00e1 v odd\u011blen\u00ed bezpe\u010dnostn\u00edch politik a nejlep\u0161\u00edch prax\u00ed v oblasti bezpe\u010dnosti od konkr\u00e9tn\u00ed runtime platformy: Docker, Kubernetes, Mesosphere, OpenShift nebo jak\u00e9koli jejich kombinace.<\/p>\n<p>Nap\u0159\u00edklad m\u016f\u017eete nasadit OPA jako backend pro admission controller Kubernetes, kter\u00e9mu delegujete bezpe\u010dnostn\u00ed rozhodnut\u00ed. T\u00edmto zp\u016fsobem m\u016f\u017ee agent OPA kontrolovat, zam\u00edtat a dokonce m\u011bnit po\u017eadavky za b\u011bhu, \u010d\u00edm\u017e zajist\u00ed dodr\u017eov\u00e1n\u00ed stanoven\u00fdch bezpe\u010dnostn\u00edch parametr\u016f. Bezpe\u010dnostn\u00ed politiky v OPA jsou naps\u00e1ny v jeho vlastn\u00edm DSL jazyce Rego.<\/p>\n<p><i><b>Pozn. p\u0159ek.<\/b>: O OPA (a SPIFFE) jsme psali v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/353808\/\">tomto materi\u00e1lu<\/a><\/noindex>.<\/i><\/p>\n<h2>Komplexn\u00ed komer\u010dn\u00ed n\u00e1stroje pro anal\u00fdzu bezpe\u010dnosti Kubernetes<\/h2>\n<p>\nRozhodli jsme se vytvo\u0159it samostatnou kategorii pro komer\u010dn\u00ed platformy, proto\u017ee obvykle pokr\u00fdvaj\u00ed n\u011bkolik oblast\u00ed bezpe\u010dnosti. Celkov\u00fd p\u0159ehled jejich mo\u017enost\u00ed lze z\u00edskat z tabulky:<\/p>\n<p><img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/0dbe925006238ee242c452f05d9f7302.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>* Pokro\u010dil\u00e1 odbornost a post mortem anal\u00fdza s \u00fapln\u00fdm <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/use-cases\/container-forensics\/\">zachycen\u00edm syst\u00e9mov\u00fdch vol\u00e1n\u00ed.<\/a><\/noindex>.<\/i><\/p>\n<h3>Aqua Security<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aquasec.com\/\">www.aquasec.com<\/a><\/noindex><\/li>\n<li> Licence: komer\u010dn\u00ed<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/d02026209908e9dac53be53fbdb178cd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTento komer\u010dn\u00ed n\u00e1stroj je ur\u010den pro kontejnery a cloudov\u00e9 pracovn\u00ed z\u00e1t\u011b\u017ee. Poskytuje:<\/p>\n<ul>\n<li> Skenov\u00e1n\u00ed obraz\u016f, integrovan\u00e9 s registrac\u00ed kontejner\u016f nebo CI\/CD pipeline;<\/li>\n<li> Runtime ochrana s detekc\u00ed zm\u011bn v kontejnerech a jin\u00e9 podez\u0159el\u00e9 aktivity;<\/li>\n<li> Nativn\u00ed firewall pro kontejnery;<\/li>\n<li> Bezpe\u010dnost pro serverless v cloudov\u00fdch slu\u017eb\u00e1ch;<\/li>\n<li> Kontrola souladu s p\u0159edpisy a audit, spojen\u00e9 s logov\u00e1n\u00edm ud\u00e1lost\u00ed.<\/li>\n<\/ul>\n<p>\n<i><b>Pozn. p\u0159ek.<\/b>: Je tak\u00e9 t\u0159eba poznamenat, \u017ee existuje <b>bezplatn\u00e1 \u010d\u00e1st produktu pod n\u00e1zvem <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/microscanner\">MicroScanner<\/a><\/noindex><\/b>, kter\u00e1 umo\u017e\u0148uje skenovat obrazy kontejner\u016f na zranitelnosti. Porovn\u00e1n\u00ed jej\u00edch schopnost\u00ed s placen\u00fdmi verzemi je uvedeno v <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/microscanner#aqua-security-edition-comparison\">t\u00e9to tabulce<\/a><\/noindex>.<\/i><\/p>\n<h3>Capsule8<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/\">capsule8.com<\/a><\/noindex><\/li>\n<li> Licence: komer\u010dn\u00ed<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/122be33f15d31f8f083189bca5c7158c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nCapsule8 se integruje do infrastruktury instalac\u00ed detektoru v m\u00edstn\u00edm nebo cloudov\u00e9m clusteru Kubernetes. Tento detektor shroma\u017e\u010fuje telemetrii hostitele a s\u00edt\u011b a porovn\u00e1v\u00e1 ji s r\u016fzn\u00fdmi typy \u00fatok\u016f.<\/p>\n<p>T\u00fdm Capsule8 vid\u00ed svou \u00falohu v \u010dasn\u00e9 detekci a prevenci \u00fatok\u016f vyu\u017e\u00edvaj\u00edc\u00edch nov\u00e9 <i>(0-day)<\/i> zranitelnosti. Capsule8 um\u00ed nahr\u00e1vat up\u0159esn\u011bn\u00e1 pravidla bezpe\u010dnosti p\u0159\u00edmo na detektory v reakci na ned\u00e1vno objeven\u00e9 hrozby a zranitelnosti softwaru.<\/p>\n<h3>Cavirin<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cavirin.com\/\">www.cavirin.com<\/a><\/noindex><\/li>\n<li> Licence: komer\u010dn\u00ed<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/896310c9258943041664ca55b3926d35.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCavirin vystupuje jako zprost\u0159edkovatel pro firmu v r\u016fzn\u00fdch \u00fa\u0159adech zab\u00fdvaj\u00edc\u00edch se standardy bezpe\u010dnosti. M\u016f\u017ee nejen skenovat obrazy, ale tak\u00e9 se integrovat do CI\/CD pipeline, blokuj\u00edc nespln\u011bn\u00e9 standardy obrazy p\u0159ed jejich um\u00edst\u011bn\u00edm do uzav\u0159en\u00fdch repozit\u00e1\u0159\u016f.<\/p>\n<p>Bezpe\u010dnostn\u00ed bal\u00edk Cavirin vyu\u017e\u00edv\u00e1 strojov\u00e9 u\u010den\u00ed k hodnocen\u00ed stavu kybernetick\u00e9 bezpe\u010dnosti, nab\u00edz\u00ed rady pro zv\u00fd\u0161en\u00ed bezpe\u010dnosti a zlep\u0161en\u00ed souladu s bezpe\u010dnostn\u00edmi standardy.<\/p>\n<h3>Google Cloud Security Command Center<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/cloud.google.com\/security-command-center\/\">cloud.google.com\/security-command-center<\/a><\/noindex><\/li>\n<li> Licence: komer\u010dn\u00ed<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/d9ac37b3d2b9be7fd6fcd6afe0d985e6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCloud Security Command Center pom\u00e1h\u00e1 bezpe\u010dnostn\u00edm t\u00fdm\u016fm sb\u00edrat data, identifikovat hrozby a odstra\u0148ovat je d\u0159\u00edve, ne\u017e zp\u016fsob\u00ed \u0161kodu spole\u010dnosti.<\/p>\n<p>Jak je vid\u011bt z n\u00e1zvu, Google Cloud SCC je unified dashboard, do kter\u00e9ho lze integrovat r\u016fzn\u00e9 bezpe\u010dnostn\u00ed zpr\u00e1vy, mechanismy \u00fa\u010detnictv\u00ed aktiv a t\u0159et\u00ed strany bezpe\u010dnostn\u00ed syst\u00e9my a spravovat je z jednoho centralizovan\u00e9ho zdroje.<\/p>\n<p>Interoperabiln\u00ed API, kter\u00e9 nab\u00edz\u00ed Google Cloud SCC, usnad\u0148uje integraci bezpe\u010dnostn\u00edch ud\u00e1lost\u00ed p\u0159ich\u00e1zej\u00edc\u00edch z r\u016fzn\u00fdch zdroj\u016f, jako je Sysdig Secure (bezpe\u010dnost kontejner\u016f pro cloud-native aplikace) nebo Falco (Open Source runtime bezpe\u010dnostn\u00ed syst\u00e9m).<\/p>\n<h3>Layered Insight (Qualys)<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/layeredinsight.com\/\">layeredinsight.com<\/a><\/noindex><\/li>\n<li> Licence: komer\u010dn\u00ed<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/31e0266c670a991824c029f9445cf480.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLayered Insight (nyn\u00ed sou\u010d\u00e1st Qualys Inc) je postaven na konceptu \u201evstaven\u00e9 bezpe\u010dnosti\u201c. Po skenov\u00e1n\u00ed p\u016fvodn\u00edho obrazu na zranitelnosti za pou\u017eit\u00ed metod statistick\u00e9 anal\u00fdzy a prov\u00e1d\u011bn\u00ed kontrol podle CVE, Layered Insight jej nahrad\u00ed na instrumentovan\u00fd obraz, kter\u00fd obsahuje agenta ve form\u011b bin\u00e1rn\u00edho souboru.<\/p>\n<p>Tento agent obsahuje testy bezpe\u010dnosti runtime pro anal\u00fdzu s\u00ed\u0165ov\u00e9ho provozu kontejneru, I\/O tok\u016f a \u010dinnosti aplikace. Krom\u011b toho m\u016f\u017ee prov\u00e1d\u011bt dal\u0161\u00ed bezpe\u010dnostn\u00ed kontroly ur\u010den\u00e9 spr\u00e1vcem infrastruktury nebo t\u00fdmy DevOps.<\/p>\n<h3>NeuVector<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/neuvector.com\/\">neuvector.com<\/a><\/noindex><\/li>\n<li> Licence: komer\u010dn\u00ed<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/db9558498c4c5cd876083d7a5bb41ab4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNeuVector prov\u00e1d\u00ed kontrolu bezpe\u010dnosti kontejneru a zaji\u0161\u0165uje runtime ochranu anal\u00fdzou s\u00ed\u0165ov\u00e9 aktivity a chov\u00e1n\u00ed aplikace, \u010d\u00edm\u017e vytv\u00e1\u0159\u00ed individu\u00e1ln\u00ed profil bezpe\u010dnosti pro ka\u017ed\u00fd kontejner. M\u016f\u017ee tak\u00e9 samostatn\u011b blokovat hrozby izolov\u00e1n\u00edm podez\u0159el\u00e9 aktivity pomoc\u00ed zm\u011bny pravidel m\u00edstn\u00edho firewallu.<\/p>\n<p>S\u00ed\u0165ov\u00e1 integrace NeuVector, zn\u00e1m\u00e1 jako Security Mesh, je schopna prov\u00e1d\u011bt hlubokou anal\u00fdzu paket\u016f a filtrov\u00e1n\u00ed na 7. \u00farovni pro v\u0161echny s\u00ed\u0165ov\u00e9 spojen\u00ed v service mesh.<\/p>\n<h3>StackRox<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.stackrox.com\/\">www.stackrox.com<\/a><\/noindex><\/li>\n<li> Licence: komer\u010dn\u00ed<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/9b8d013860518fab67e84344eaa1de91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPlatforma pro bezpe\u010dnost kontejner\u016f StackRox se sna\u017e\u00ed pokr\u00fdt cel\u00fd \u017eivotn\u00ed cyklus aplikac\u00ed Kubernetes v klastru. Stejn\u011b jako ostatn\u00ed komer\u010dn\u00ed platformy v tomto seznamu, StackRox generuje runtime profil na z\u00e1klad\u011b pozorovan\u00e9ho chov\u00e1n\u00ed kontejneru a automaticky vyvol\u00e1v\u00e1 poplach p\u0159i jak\u00fdchkoli odchylk\u00e1ch.<\/p>\n<p>Krom\u011b toho StackRox analyzuje konfigurace Kubernetes pomoc\u00ed CIS Kubernetes a dal\u0161\u00edch soubor\u016f pravidel pro hodnocen\u00ed shody kontejner\u016f.<\/p>\n<h3>Sysdig Secure<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/\">sysdig.com\/products\/secure<\/a><\/noindex><\/li>\n<li> Licence: komer\u010dn\u00ed<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/a36518809970479fe435e505c231eff8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSysdig Secure chr\u00e1n\u00ed aplikace po celou dobu \u017eivotn\u00edho cyklu kontejneru a Kubernetes. On <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/image-scanning\/\">skenuje obrazy<\/a><\/noindex> kontejner\u016f, zaji\u0161\u0165uje <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/runtime-security\/\">runtime ochranu<\/a><\/noindex> na z\u00e1klad\u011b strojov\u00e9ho u\u010den\u00ed, prov\u00e1d\u00ed kriminalistick\u00e9 vy\u0161et\u0159ov\u00e1n\u00ed pro zji\u0161t\u011bn\u00ed zranitelnost\u00ed, blokuje hrozby, sleduje <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/container-compliance\/\">shodu s nastaven\u00fdmi standardy<\/a><\/noindex> a prov\u00e1d\u00ed audit aktivity v mikroslu\u017eb\u00e1ch.<\/p>\n<p>Sysdig Secure se integruje s n\u00e1stroji CI\/CD, jako je Jenkins, a kontroluje obrazy stahovan\u00e9 z registr\u016f Docker, \u010d\u00edm\u017e zabra\u0148uje v\u00fdskytu nebezpe\u010dn\u00fdch obraz\u016f v produkci. Zaji\u0161\u0165uje tak\u00e9 komplexn\u00ed runtime bezpe\u010dnost, v\u010detn\u011b:<\/p>\n<ul>\n<li> runtime profilace na z\u00e1klad\u011b ML a detekce anom\u00e1li\u00ed;<\/li>\n<li> runtime politiky zalo\u017een\u00e9 na syst\u00e9mov\u00fdch ud\u00e1lostech, API K8s-audit, spole\u010dn\u00fdch projektech komunity (FIM \u2014 sledov\u00e1n\u00ed integrity soubor\u016f; cryptojacking) a frameworku <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/blog\/mitre-attck-framework-for-container-runtime-security-with-sysdig-falco\/\">MITRE ATT&amp;CK<\/a><\/noindex>;<\/li>\n<li> reakce a odstran\u011bn\u00ed incident\u016f.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Tenable Container Security<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/products\/tenable-io\/container-security\">www.tenable.com\/products\/tenable-io\/container-security<\/a><\/noindex><\/li>\n<li> Licence: komer\u010dn\u00ed<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/2b3799ee94628c04104f6cead8be8749.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nP\u0159ed vznikem kontejner\u016f byla Tenable \u0161iroce zn\u00e1m\u00e1 v oboru jako spole\u010dnost, kter\u00e1 vyvinula Nessus \u2014 obl\u00edben\u00fd n\u00e1stroj pro hled\u00e1n\u00ed zranitelnost\u00ed a auditu bezpe\u010dnosti.<\/p>\n<p>Tenable Container Security vyu\u017e\u00edv\u00e1 zku\u0161enosti spole\u010dnosti v oblasti po\u010d\u00edta\u010dov\u00e9 bezpe\u010dnosti k integraci CI\/CD pipeline s datab\u00e1zemi zranitelnost\u00ed, specializovan\u00fdmi bal\u00ed\u010dky pro detekci malware a doporu\u010den\u00edmi pro eliminaci bezpe\u010dnostn\u00edch hrozeb.<\/p>\n<h3>Twistlock (Palo Alto Networks)<\/h3>\n<p><\/p>\n<ul>\n<li> Web: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.twistlock.com\/\">www.twistlock.com<\/a><\/noindex><\/li>\n<li> Licence: komer\u010dn\u00ed<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ n\u00e1stroj\u016f pro bezpe\u010dnost Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/98213c84bafaeca1e0d6bca3e1a80d23.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTwistlock se propaguje jako platforma zam\u011b\u0159en\u00e1 na cloudov\u00e9 slu\u017eby a kontejnery. Twistlock podporuje r\u016fzn\u00e9 cloudov\u00e9 poskytovatele (AWS, Azure, GCP), orchestrace kontejner\u016f (Kubernetes, Mesosphere, OpenShift, Docker), bezserverov\u00e1 provozn\u00ed prost\u0159ed\u00ed, mesh frameworky a n\u00e1stroje CI\/CD.<\/p>\n<p>Krom\u011b b\u011b\u017en\u00fdch metod zabezpe\u010den\u00ed na podnikov\u00e9 \u00farovni, jako je integrace do CI\/CD pipeline nebo skenov\u00e1n\u00ed obraz\u016f, Twistlock vyu\u017e\u00edv\u00e1 strojov\u00e9 u\u010den\u00ed k generov\u00e1n\u00ed behavior\u00e1ln\u00edch vzorc\u016f a s\u00ed\u0165ov\u00fdch pravidel zohled\u0148uj\u00edc\u00edch zvl\u00e1\u0161tnosti kontejner\u016f.<\/p>\n<p>P\u0159ed n\u011bjak\u00fdm \u010dasem koupila Twistlock spole\u010dnost Palo Alto Networks, vlastn\u00edc\u00ed projekty Evident.io a RedLock. Jak p\u0159esn\u011b budou tyto t\u0159i platformy integrov\u00e1ny v PRISMA <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/cloud-security\">od Palo Alto.<\/a><\/noindex> Pomozte n\u00e1m vytvo\u0159it nejlep\u0161\u00ed katalog n\u00e1stroj\u016f pro zabezpe\u010den\u00ed Kubernetes!<\/p>\n<h2>Usilujeme o to, aby byl tento katalog co nejkompletn\u011bj\u0161\u00ed, a k tomu pot\u0159ebujeme va\u0161i pomoc! Kontaktujte n\u00e1s (<\/h2>\n<p>\n@sysdig<noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/sysdig\">), pokud m\u00e1te doporu\u010den\u00ed na skv\u011bl\u00fd n\u00e1stroj, kter\u00fd by m\u011bl b\u00fdt za\u0159azen do tohoto seznamu, nebo jste na\u0161li chybu\/zastaral\u00e9 informace.<\/a><\/noindex>M\u016f\u017eete se tak\u00e9 p\u0159ihl\u00e1sit k na\u0161emu<\/p>\n<p>m\u011bs\u00ed\u010dn\u00edmu newsletteru <noindex><a rel=\"nofollow\" href=\"https:\/\/go.sysdig.com\/container-newsletter-signup.html\">s novinkami z cloud-native ekosyst\u00e9mu a zaj\u00edmav\u00fdmi projekty ze sv\u011bta zabezpe\u010den\u00ed Kubernetes.<\/a><\/noindex> Po 6 letech neaktivity je k dispozici fetchmail 6.4.0<\/p>\n<h2>P.S. od p\u0159ekladatele<\/h2>\n<p>\nP\u0159e\u010dt\u011bte si tak\u00e9 n\u00e1\u0161 blog:<\/p>\n<ul>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443190\/\">\u00davod do s\u00ed\u0165ov\u00fdch politik Kubernetes pro odborn\u00edky na zabezpe\u010den\u00ed<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440504\/\">Docker a Kubernetes v prost\u0159ed\u00edch citliv\u00fdch na bezpe\u010dnost<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/436300\/\">9 nejlep\u0161\u00edch praktik pro zaji\u0161t\u011bn\u00ed bezpe\u010dnosti v Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/417905\/\">11 zp\u016fsob\u016f, jak (ne)se st\u00e1t ob\u011bt\u00ed hacknut\u00ed v Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/353808\/\">OPA a SPIFFE \u2014 dva nov\u00e9 projekty v CNCF pro bezpe\u010dnost cloudov\u00fdch aplikac\u00ed<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Zdroj: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/465141\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0415\u0441\u043b\u0438 \u0432\u044b \u0437\u0430\u0434\u0430\u0451\u0442\u0435\u0441\u044c \u0432\u043e\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Kubernetes, \u044d\u0442\u043e\u0442 \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0437\u043e\u0440 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Sysdig \u0441\u0442\u0430\u043d\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u043d\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0434\u043b\u044f \u0431\u0435\u0433\u043b\u043e\u0433\u043e \u0437\u043d\u0430\u043a\u043e\u043c\u0441\u0442\u0432\u0430 \u0441 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u044f\u043c\u0438. \u0412 \u043d\u0435\u0433\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u0433\u0440\u043e\u043a\u043e\u0432 \u0440\u044b\u043d\u043a\u0430, \u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u0441\u043a\u0440\u043e\u043c\u043d\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0442\u0443 \u0438\u043b\u0438 \u0438\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0410 \u0432 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u043c\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28890,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38497","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.3 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.3\" \/>\n\t\t<meta property=\"og:locale\" content=\"cs_CZ\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4733+ \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Kubernetes | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:24:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:24:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4733+ n\u00e1stroj\u016f pro zabezpe\u010den\u00ed Kubernetes | ProHoster","description":"Pozn.","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4733+ \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Kubernetes | ProHoster","og:description":"\u041f\u0440\u0438\u043c.","og:url":"https:\/\/prohoster.info\/cs\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:24:06+00:00","article:modified_time":"2019-10-31T19:24:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38497","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 22:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:08:31","updated":"2026-01-23 22:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=38497"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/38497\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/28890"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=38497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=38497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=38497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}