Note: translation.: If you have security questions regarding Kubernetes-based infrastructure, this excellent overview from Sysdig will serve as a great starting point for a quick introduction to the currently relevant solutions. It includes both comprehensive systems from well-known market players and significantly more modest utilities that address specific issues. As always, we welcome your experiences with these tools in the comments and would love to see links to other projects.
There are many software products for ensuring Kubernetes security... each with its own objectives, areas of application, and licenses.
This is why we decided to create this list, which includes both open-source projects and commercial platforms from various providers. We hope it helps you select the ones that are of the greatest interest and guides you in the right direction based on specific Kubernetes security needs.
Categories
To simplify navigation through the list, the tools are divided by main functions and areas of application. The sections are as follows:
- Kubernetes image scanning and static analysis;
- Runtime security;
- Kubernetes network security;
- Image distribution and secret management;
- Kubernetes security auditing;
- Comprehensive commercial products.
Let's get to the point:
Kubernetes Image Scanning
Anchore
- Website:
- License: free (Apache) and commercial offering
The Anchore package analyzes container images and performs security checks based on user-defined policies.
In addition to the usual scanning of container images for known vulnerabilities from the CVE database, Anchore conducts numerous additional checks within the scanning policy: it verifies the Dockerfile, looks for credential leaks, checks packages from used programming languages (npm, maven, etc.), software licenses, and much more.
Clair
- Website: (now under Red Hat's stewardship)
- License: free (Apache)
Clair was one of the first open-source projects for image scanning. It is widely known as the security scanner that underpins the Quay image registry (also from CoreOS — translator's note.)Clair collects information about CVEs from a wide range of sources, including vulnerability lists specific to Linux distributions maintained by security teams from Debian, Red Hat, and Ubuntu.
Unlike Anchore, Clair primarily focuses on vulnerability detection and matching data with CVEs. However, the product offers users some capabilities to extend functionality through plug-in drivers.
Dagda
- Website:
- License: free (Apache)
Dagda performs static analysis of container images for known vulnerabilities, trojans, viruses, malware, and other threats.
Two notable features distinguish the Dagda package from other similar tools:
- It integrates excellently with , functioning not only as a container image scanning tool but also as an antivirus.
- It also provides runtime protection, receiving events in real-time from the Docker daemon and integrating with Falco (see below) to collect security events during container operation.
KubeXray
- Website:
- License: free (Apache), but requires data from JFrog Xray (a commercial product)
KubeXray listens to events from the Kubernetes API server and uses metadata from JFrog Xray to ensure that only pods compliant with current policies are launched.
KubeXray not only audits new or updated containers in deployments (similar to an admission controller in Kubernetes), but also dynamically checks running containers against new security policies, removing resources referencing vulnerable images.
Snyk
- Website:
- License: free (Apache) and commercial versions
Snyk is an unusual vulnerability scanner in that it is specifically aimed at the development process and is marketed as an "essential solution" for developers.
Snyk directly connects to code repositories, parses the project's manifest, and analyzes the imported code along with direct and transitive dependencies. Snyk supports many popular programming languages and can identify hidden licensing risks.
Trivy
- Website:
- License: free (AGPL)
Trivy is a simple yet powerful vulnerability scanner for containers, easily integrated into a CI/CD pipeline. Its notable feature is ease of installation and use: the application consists of a single binary and does not require a database or additional libraries.
The downside of Trivy's simplicity is that it requires understanding how to parse and forward results in JSON format to be usable by other Kubernetes security tools.
Runtime Security in Kubernetes
Falco
- Website:
- License: free (Apache)
Falco is a set of tools for securing cloud runtime environments. It is part of the .
Using the Sysdig toolkit for kernel-level operations and system call profiling, Falco allows deep insights into system behavior. Its runtime rules engine can detect suspicious activity in applications, containers, the underlying host, and the Kubernetes orchestrator.
Falco provides complete transparency into runtime operations and threat detection by deploying specialized agents on Kubernetes nodes. As a result, there is no need to modify containers by embedding third-party code or attaching sidecar containers.
Linux Security Frameworks for Runtime
These kernel-native Linux frameworks are not 'Kubernetes security tools' in the conventional sense but deserve mention as they play an important role in the context of runtime security, which is included in the Kubernetes Pod Security Policy (PSP).
attaches a security profile to processes running in a container, defining file system privileges, network access rules, library connections, etc. It is a system based on Mandatory Access Control (MAC). In other words, it prevents unauthorized actions from being executed.
Security-Enhanced Linux () is an enhanced security module in the Linux kernel, similar to AppArmor in certain aspects and often compared to it. SELinux surpasses AppArmor in power, flexibility, and granularity of settings. Its drawbacks are a steep learning curve and increased complexity.
Seccomp and seccomp-bpf allow for the filtering of system calls, blocking the execution of those that are potentially dangerous to the underlying OS and unnecessary for the normal operation of user applications. Seccomp is similar to Falco in some respects, although it does not understand container specifics.
Sysdig open source
- Website:
- License: free (Apache)
Sysdig is a comprehensive tool for analyzing, diagnosing, and debugging Linux systems (it also works on Windows and macOS, but with limited features). It can be used to collect detailed information, auditing, and forensic analysis. (forensics) the underlying system and any containers running on it.
Sysdig also natively supports execution environments for containers and Kubernetes metadata, adding additional metrics and tags to all collected information about system behavior. There are several ways to analyze a Kubernetes cluster using Sysdig: you can capture at a specific point in time via or launch an interactive interface based on ncurses using the plugin .
Kubernetes Network Security
Aporeto
- Website:
- License: commercial
Aporeto offers "security decoupled from network and infrastructure." This means that Kubernetes services not only receive a local ID (that is, ServiceAccount in Kubernetes) but also a universal identifier/fingerprint that can be used for secure and mutually authenticated interactions with any other service, for example, within an OpenShift cluster.
Aporeto is able to generate a unique identifier not only for Kubernetes/containers but also for hosts, cloud functions, and users. Depending on these identifiers and the set of network security rules defined by the administrator, communications will be permitted or blocked.
Calico
- Website:
- License: free (Apache)
Calico is typically deployed during the installation of the container orchestrator, creating a virtual network linking containers. In addition to this basic network functionality, the Calico project works with Kubernetes Network Policies and its own set of security profiles, supporting ACLs (Access Control Lists) for endpoints and annotation-based network security rules for Ingress and Egress traffic.
Cilium
- Website:
- License: free (Apache)
Cilium acts as a firewall for containers and provides network security features that are originally tailored for Kubernetes and microservice workloads. Cilium utilizes a new Linux kernel technology called BPF (Berkeley Packet Filter) for filtering, monitoring, redirecting, and adjusting data.
Cilium can deploy network access policies based on container IDs, using Docker or Kubernetes labels and metadata. Cilium also understands and filters various layer 7 protocols, such as HTTP or gRPC, allowing the definition of a set of REST calls that, for example, will be permitted between two Kubernetes deployments.
Istio
- Website:
- License: free (Apache)
Istio is widely recognized as an implementation of the service mesh paradigm by deploying a platform-independent control plane and routing all managed service traffic through dynamically configurable Envoy proxies. Istio leverages this advanced view of all microservices and containers to implement various network security strategies.
Istio's capabilities for ensuring network security include transparent TLS encryption to automatically enhance the communication protocol between microservices to HTTPS, as well as its own RBAC system for identification and authorization to permit/deny data exchange between different workloads in the cluster.
Note: translation.: For more information on Istio's security-oriented features, read in .
Tigera
- Website:
- License: commercial
This solution, referred to as the "Kubernetes firewall," emphasizes a zero-trust approach to network security.
Similar to other native Kubernetes networking solutions, Tigera relies on metadata to identify various services and objects in the cluster, ensuring runtime problem detection, continuous compliance checking, and network transparency for multicloud or hybrid monolith-containerized infrastructures.
Trireme
- Website:
- License: free (Apache)
Trireme-Kubernetes is a simple and clear implementation of the Kubernetes Network Policies specification. The most notable feature is that, unlike similar products for Kubernetes network security, it does not require a central control plane to coordinate the mesh. This makes the solution trivially scalable. In Trireme, this is achieved by installing an agent on each node, which connects directly to the host's TCP/IP stack.
Image distribution and secret management
Grafeas
- Website:
- License: free (Apache)
Grafeas is an open-source API for audit and software supply chain management. At its core, Grafeas serves as a tool for collecting metadata and audit results. It can be used to track compliance with best security practices within an organization.
This centralized source of truth helps answer questions such as:
- Who built and signed a particular container?
- Did it pass all security scans and checks specified by the security policy? When? What were the results?
- Who deployed it in production? What specific parameters were used during deployment?
In-toto
- Website:
- License: free (Apache)
In-toto is a framework designed to ensure the integrity, authenticity, and auditability of the entire software supply chain. When deploying In-toto in the infrastructure, a plan is first set up, describing the various steps in the pipeline (repositories, CI/CD tools, QA tools, artifact builders, etc.) and the users (responsible parties) authorized to initiate them.
In-toto monitors the execution of the plan, ensuring that each task in the chain is carried out properly by authorized personnel and that no unauthorized manipulations occur during the product's progression.
Portieris
- Website:
- License: free (Apache)
Portieris is an admission controller for Kubernetes; it is used for mandatory trust checks of content. Portieris utilizes a server (we wrote about it at the end — translator's note.) as a source of truth to verify trusted and signed artifacts (i.e., approved container images).
When creating or modifying a workload in Kubernetes, Portieris retrieves signature information and content trust policies for the requested container images, and modifies the API JSON object on the fly as needed to launch signed versions of these images.
Vault
- Website:
- License: open (MPL)
Vault is a secure solution for storing sensitive information: passwords, OAuth tokens, PKI certificates, access credentials, Kubernetes secrets, etc. Vault supports many advanced features, such as leasing ephemeral security tokens or organizing key rotation.
Using the Vault Helm chart, you can deploy it as a new deployment in a Kubernetes cluster with Consul as the backend storage. It supports Kubernetes-native resources like ServiceAccount tokens and can also act as the default Kubernetes secrets store.
Note: translation.: By the way, just yesterday, HashiCorp, the company behind Vault, announced some improvements for using Vault in Kubernetes, specifically regarding the Helm chart. Read the details in the .
Kubernetes Security Audit
Kube-bench
- Website:
- License: free (Apache)
Kube-bench is a Go application that checks whether Kubernetes is deployed securely by running tests from the .
Kube-bench inspects for insecure configuration parameters among cluster components (etcd, API, controller manager, etc.), questionable file access permissions, unsecured accounts, open ports, resource quotas, API rate limiting settings to protect against DoS attacks, and more.
Kube-hunter
- Website:
- License: free (Apache)
Kube-hunter hunts for potential vulnerabilities (such as remote code execution or data exposure) in Kubernetes clusters. Kube-hunter can be run as a remote scanner—in which case it will assess the cluster from the perspective of an external attacker—or as a pod within the cluster.
A distinctive feature of Kube-hunter is the "active hunting" mode, during which it not only reports issues but also attempts to exploit vulnerabilities found in the target cluster that could potentially harm its operation. So use with caution!
Kubeaudit
- Website:
- License: open (MIT)
Kubeaudit is a command-line tool originally developed at Shopify for auditing Kubernetes configurations for various security issues. For instance, it helps identify containers running with unrestricted privileges, superuser rights, privilege abuses, or those using the default ServiceAccount.
Kubeaudit also has other interesting features. For example, it can analyze local YAML files, identifying configuration flaws that could lead to security issues, and automatically fix them.
Kubesec
- Website:
- License: free (Apache)
Kubesec is a unique tool in that it directly scans YAML files describing Kubernetes resources for weak parameters that could impact security.
For instance, it can detect excessive privileges and permissions granted to a pod, running a container as root by default, connecting to the host network namespace, or risky mounts like /proc the host or Docker socket. Another interesting feature of Kubesec is the available online demo service, where you can upload YAML and immediately conduct an analysis.
and that this action is permitted.
- Website:
- License: free (Apache)
The concept of OPA (Open Policy Agent) is to separate security policies and best practices from specific runtime platforms: Docker, Kubernetes, Mesosphere, OpenShift, or any combination thereof.
For example, OPA can be deployed as a backend for the Kubernetes admission controller, delegating security decisions to it. Thus, the OPA agent can check, deny, and even modify requests on the fly, ensuring compliance with specified security parameters. Security policies in OPA are written in its own DSL language, Rego.
Note: translation.: We discussed OPA (and SPIFFE) further in .
Comprehensive commercial tools for Kubernetes security analysis
We decided to create a separate category for commercial platforms since they typically cover multiple security areas at once. An overview of their capabilities can be obtained from the table:
* Advanced expertise and post-mortem analysis with complete .
Aqua Security
- Website:
- License: commercial
This commercial tool is designed for containers and cloud workloads. It offers:
- Image scanning integrated with the container registry or CI/CD pipeline;
- Runtime protection with change detection in containers and other suspicious activities;
- Native container firewall;
- Security for serverless in cloud services;
- Compliance checks and audits combined with event logging.
Note: translation.: It is also worth noting that there is a free component of the product called , which scans container images for vulnerabilities. A comparison of its features with the paid versions is presented in .
Capsule8
- Website:
- License: commercial
Capsule8 integrates into the infrastructure by deploying a detector in a local or cloud Kubernetes cluster. This detector collects host and network telemetry, matching it against various types of attacks.
The Capsule8 team sees its mission as early detection and prevention of attacks leveraging new (0-day) vulnerabilities. Capsule8 can upload refined security rules directly to detectors in response to newly discovered threats and software vulnerabilities.
Cavirin
- Website:
- License: commercial
Cavirin acts as a contractor for the company across various agencies dealing with security standards. It not only scans images but also integrates into the CI/CD pipeline, blocking non-compliant images before they reach private repositories.
The Cavirin security package uses machine learning to assess cybersecurity posture, offering tips for enhancing security and achieving compliance with security standards.
Google Cloud Security Command Center
- Website:
- License: commercial
Cloud Security Command Center helps security teams collect data, identify threats, and mitigate them before they can harm the company.
As the name suggests, Google Cloud SCC is a unified dashboard that can integrate various security reports, asset tracking mechanisms, and third-party security systems, managing them from a single, centralized source.
An interoperable API offered by Google Cloud SCC facilitates the integration of security events from various sources, such as Sysdig Secure (container security for cloud-native applications) or Falco (Open Source runtime security system).
Layered Insight (Qualys)
- Website:
- License: commercial
Layered Insight (now part of Qualys Inc) is built on the concept of 'embedded security.' After scanning the original image for vulnerabilities using statistical analysis methods and checking against CVE, Layered Insight replaces it with an instrumented image that includes an agent in the form of a binary.
This agent contains runtime security tests to analyze container network traffic, I/O streams, and application activity. Additionally, it can perform further security checks designated by infrastructure administrators or DevOps teams.
NeuVector
- Website:
- License: commercial
NeuVector conducts container security checking and provides runtime protection by analyzing network activity and application behavior, creating a unique security profile for each container. It can also autonomously block threats by isolating suspicious activity through modifications to local firewall rules.
NeuVector's network integration, known as the Security Mesh, is capable of performing deep packet analysis and filtering at Layer 7 for all network connections within a service mesh.
StackRox
- Website:
- License: commercial
The StackRox container security platform aims to cover the entire lifecycle of Kubernetes applications within a cluster. Like other commercial platforms on this list, StackRox generates a runtime profile based on observed container behavior and automatically raises alarms for any deviations.
Furthermore, StackRox analyzes Kubernetes configurations, utilizing CIS Kubernetes and other rule sets to assess container compliance.
Sysdig Secure
- Website:
- License: commercial
Sysdig Secure protects applications throughout the entire container and Kubernetes lifecycle. It of containers, providing based on machine learning, performs forensic analysis to identify vulnerabilities, blocks threats, monitors for and audits activity in microservices.
Sysdig Secure integrates with CI/CD tools like Jenkins and monitors images uploaded from Docker registries, preventing harmful images from entering production. It also offers comprehensive runtime security, including:
- runtime profiling based on ML and anomaly detection;
- event-driven policies based on system events, K8s-audit API, community collaboration projects (FIM — file integrity monitoring; cryptojacking) and framework ;
- incident response and resolution.
Tenable Container Security
- Website:
- License: commercial
Before the advent of containers, Tenable was widely recognized in the industry as the company that developed Nessus — a popular tool for vulnerability scanning and security auditing.
Tenable Container Security leverages the company's expertise in cybersecurity to integrate the CI/CD pipeline with vulnerability databases, specialized malware detection packages, and recommendations for mitigating security threats.
Twistlock (Palo Alto Networks)
- Website:
- License: commercial
Twistlock markets itself as a platform focused on cloud services and containers. Twistlock supports a range of cloud providers (AWS, Azure, GCP), container orchestrators (Kubernetes, Mesosphere, OpenShift, Docker), serverless execution environments, mesh frameworks, and CI/CD tools.
In addition to standard enterprise-level security measures, such as CI/CD pipeline integration or image scanning, Twistlock utilizes machine learning to generate behavioral patterns and network rules tailored to container specifics.
Some time ago, Twistlock was acquired by Palo Alto Networks, which owns the Evident.io and RedLock projects. It is still unknown how these three platforms will be integrated into from Palo Alto.
Help us create the best Kubernetes security tools catalog!
We aim to make this catalog as comprehensive as possible, and we need your help! Contact us (), if you know of a cool tool worthy of inclusion in this list, or if you've found an error/outdated information.
You can also subscribe to our with news from the cloud-native ecosystem and stories about interesting projects in the world of Kubernetes security.
P.S. from the translator
Also read in our blog:
- «»;
- «»;
- «»;
- «»;
- «».
Source: habr.com
