\nTo simplify navigation through the list, the tools are divided by main functions and areas of application. The sections are as follows:<\/p>\n
\n Kubernetes image scanning and static analysis;<\/li>\n Runtime security;<\/li>\n Kubernetes network security;<\/li>\n Image distribution and secret management;<\/li>\n Kubernetes security auditing;<\/li>\n Comprehensive commercial products.<\/li>\n<\/ul>\n\nLet's get to the point:<\/p>\n
Kubernetes Image Scanning<\/h2>\n <\/p>\n
Anchore<\/h3>\n <\/p>\n
\n Website: anchore.com<\/a><\/noindex><\/li>\n License: free (Apache) and commercial offering<\/li>\n<\/ul>\n\n
In addition to the usual scanning of container images for known vulnerabilities from the CVE database, Anchore conducts numerous additional checks within the scanning policy: it verifies the Dockerfile, looks for credential leaks, checks packages from used programming languages (npm, maven, etc.), software licenses, and much more.<\/p>\n
Clair<\/h3>\n <\/p>\n
\n Website: coreos.com\/claire<\/a><\/noindex> (now under Red Hat's stewardship)<\/i><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\n(also from CoreOS \u2014 translator's note.<\/b>)<\/i>Clair collects information about CVEs from a wide range of sources, including vulnerability lists specific to Linux distributions maintained by security teams from Debian, Red Hat, and Ubuntu.<\/p>\n
Unlike Anchore, Clair primarily focuses on vulnerability detection and matching data with CVEs. However, the product offers users some capabilities to extend functionality through plug-in drivers.<\/p>\n
Dagda<\/h3>\n <\/p>\n
\n Website: github.com\/eliasgranderubio\/dagda<\/a><\/noindex><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\n
Two notable features distinguish the Dagda package from other similar tools:<\/p>\n
\n It integrates excellently with ClamAV<\/a><\/noindex>, functioning not only as a container image scanning tool but also as an antivirus.<\/li>\n It also provides runtime protection, receiving events in real-time from the Docker daemon and integrating with Falco (see below)<\/i> to collect security events during container operation.<\/li>\n<\/ul>\n <\/p>\n
KubeXray<\/h3>\n <\/p>\n
\n Website: github.com\/jfrog\/kubexray<\/a><\/noindex><\/li>\n License: free (Apache), but requires data from JFrog Xray (a commercial product)<\/li>\n<\/ul>\n\n
KubeXray not only audits new or updated containers in deployments (similar to the admission controller in Kubernetes), but also dynamically checks running containers against new security policies, removing resources that reference vulnerable images.<\/p>\n
Snyk<\/h3>\n <\/p>\n
\n Website: snyk.io<\/a><\/noindex><\/li>\n License: free (Apache) and commercial versions<\/li>\n<\/ul>\n\n
Snyk directly connects to code repositories, parses the project's manifest, and analyzes the imported code along with direct and transitive dependencies. Snyk supports many popular programming languages and can identify hidden licensing risks.<\/p>\n
Trivy<\/h3>\n <\/p>\n
\n Website: github.com\/knqyf263\/trivy<\/a><\/noindex><\/li>\n License: free (AGPL)<\/li>\n<\/ul>\n\n
The downside of Trivy's simplicity is that it requires understanding how to parse and forward results in JSON format to be usable by other Kubernetes security tools.<\/p>\n
Runtime Security in Kubernetes<\/h2>\n <\/p>\n
Falco<\/h3>\n <\/p>\n
\n Website: falco.org<\/a><\/noindex><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\nCNCF<\/a><\/noindex>.<\/p>\nUsing the Sysdig toolkit for kernel-level operations and system call profiling, Falco allows deep insights into system behavior. Its runtime rules engine can detect suspicious activity in applications, containers, the underlying host, and the Kubernetes orchestrator.<\/p>\n
Falco provides full runtime transparency and threat detection by deploying specialized agents on Kubernetes nodes. As a result, there is no need to modify containers by injecting third-party code or attaching sidecar containers.<\/p>\n
Linux Security Frameworks for Runtime<\/h3>\n \n
AppArmor<\/a><\/noindex> attaches a security profile to processes running in a container, defining file system privileges, network access rules, library connections, etc. It is a system based on Mandatory Access Control (MAC). In other words, it prevents unauthorized actions from being executed.<\/p>\nSecurity-Enhanced Linux (SELinux<\/a><\/noindex>) is an enhanced security module in the Linux kernel, similar to AppArmor in certain aspects and often compared to it. SELinux surpasses AppArmor in power, flexibility, and granularity of settings. Its drawbacks are a steep learning curve and increased complexity.<\/p>\nSeccomp<\/a><\/noindex> Seccomp and seccomp-bpf allow for the filtering of system calls, blocking the execution of those that are potentially dangerous to the underlying OS and unnecessary for the normal operation of user applications. Seccomp is similar to Falco in some respects, although it does not understand container specifics.<\/p>\nSysdig open source<\/h3>\n <\/p>\n
\n Website: www.sysdig.com\/opensource<\/a><\/noindex><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\n(forensics)<\/i> the underlying system and any containers running on it.<\/p>\n
Sysdig also natively supports execution environments for containers and Kubernetes metadata, adding additional metrics and tags to all collected information about system behavior. There are several ways to analyze a Kubernetes cluster using Sysdig: you can capture at a specific point in time via kubectl capture<\/a><\/noindex> or launch an interactive interface based on ncurses using the plugin kubectl dig<\/a><\/noindex>.<\/p>\nKubernetes Network Security<\/h2>\n <\/p>\n
Aporeto<\/h3>\n <\/p>\n
\n Website: www.aporeto.com<\/a><\/noindex><\/li>\n License: commercial<\/li>\n<\/ul>\n\n
Aporeto is able to generate a unique identifier not only for Kubernetes\/containers but also for hosts, cloud functions, and users. Depending on these identifiers and the set of network security rules defined by the administrator, communications will be permitted or blocked.<\/p>\n
Calico<\/h3>\n <\/p>\n
\n Website: www.projectcalico.org<\/a><\/noindex><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\n
Cilium<\/h3>\n <\/p>\n
\n Website: www.cilium.io<\/a><\/noindex><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\n
Cilium can deploy network access policies based on container identifiers, using Docker or Kubernetes labels and metadata. Cilium also understands and filters various Layer 7 protocols, such as HTTP or gRPC, allowing for the definition of sets of REST calls that, for example, will be permitted between two Kubernetes deployments.<\/p>\n
Istio<\/h3>\n <\/p>\n
\n Website: istio.io<\/a><\/noindex><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\n
Istio's capabilities for ensuring network security include transparent TLS encryption to automatically enhance the communication protocol between microservices to HTTPS, as well as its own RBAC system for identification and authorization to permit\/deny data exchange between different workloads in the cluster.<\/p>\n
Note: translation.<\/b>: For more information on Istio's security-oriented features, read in from one of the authors.<\/a><\/noindex>.<\/i><\/p>\nTigera<\/h3>\n <\/p>\n
\n Website: www.tigera.io<\/a><\/noindex><\/li>\n License: commercial<\/li>\n<\/ul>\n\n
Similar to other native Kubernetes networking solutions, Tigera relies on metadata to identify various services and objects in the cluster, ensuring runtime problem detection, continuous compliance checking, and network transparency for multicloud or hybrid monolith-containerized infrastructures.<\/p>\n
Trireme<\/h3>\n <\/p>\n
\nWebsite: www.aporeto.com\/opensource<\/a><\/noindex><\/li>\nLicense: free (Apache)<\/li>\n<\/ul>\n\n
Image distribution and secret management<\/h2>\n <\/p>\n
Grafeas<\/h3>\n <\/p>\n
\n Website: grafeas.io<\/a><\/noindex><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\n
This centralized source of truth helps answer questions such as:<\/p>\n
\n Who built and signed a particular container?<\/li>\n Did it pass all security scans and checks specified by the security policy? When? What were the results? <\/li>\n Who deployed it in production? What specific parameters were used during deployment?<\/li>\n<\/ul>\n<\/p>\n
In-toto<\/h3>\n <\/p>\n
\n Website: in-toto.github.io<\/a><\/noindex><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\n
In-toto monitors the execution of the plan, ensuring that each task in the chain is carried out properly by authorized personnel and that no unauthorized manipulations occur during the product's progression.<\/p>\n
Portieris<\/h3>\n <\/p>\n
\n Website: github.com\/IBM\/portieris<\/a><\/noindex><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\nNotary<\/a><\/noindex> (we wrote about it at the end of this article<\/a><\/noindex> \u2014 translator's note.<\/b>)<\/i> as a source of truth to verify trusted and signed artifacts (i.e., approved container images).<\/p>\n When creating or modifying a workload in Kubernetes, Portieris retrieves signature information and content trust policies for the requested container images, and modifies the API JSON object on the fly as needed to launch signed versions of these images.<\/p>\n
Vault<\/h3>\n <\/p>\n
\n Website: www.vaultproject.io<\/a><\/noindex><\/li>\n License: open (MPL)<\/li>\n<\/ul>\n\n
Using the Helm chart, Vault can be deployed as a new deployment in the Kubernetes cluster with Consul as the backend storage. It supports native Kubernetes resources like ServiceAccount tokens and can even serve as the default Kubernetes secrets storage.<\/p>\n
Note: translation.<\/b>: By the way, just yesterday, HashiCorp, the company behind Vault, announced some improvements for using Vault in Kubernetes, specifically regarding the Helm chart. Read the details in the developer blog<\/a><\/noindex>.<\/i><\/p>\nKubernetes Security Audit<\/h2>\n <\/p>\n
Kube-bench<\/h3>\n <\/p>\n
\nWebsite: github.com\/aquasecurity\/kube-bench<\/a><\/noindex><\/li>\nLicense: free (Apache)<\/li>\n<\/ul>\n\nCIS Kubernetes Benchmark<\/a><\/noindex>.<\/p>\nKube-bench inspects for insecure configuration parameters among cluster components (etcd, API, controller manager, etc.), questionable file access permissions, unsecured accounts, open ports, resource quotas, API rate limiting settings to protect against DoS attacks, and more.<\/p>\n
Kube-hunter<\/h3>\n <\/p>\n
\n Website: github.com\/aquasecurity\/kube-hunter<\/a><\/noindex><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\n
A distinctive feature of Kube-hunter is its \"active hunting\" mode, during which it not only reports issues but also attempts to exploit vulnerabilities found in the target cluster that could potentially harm its operation. So use it with caution!<\/p>\n
Kubeaudit<\/h3>\n <\/p>\n
\n Website: github.com\/Shopify\/kubeaudit<\/a><\/noindex><\/li>\n License: open (MIT)<\/li>\n<\/ul>\n\n
Kubeaudit also has other interesting features. For example, it can analyze local YAML files, identifying configuration flaws that could lead to security issues, and automatically fix them.<\/p>\n
Kubesec<\/h3>\n <\/p>\n
\n Website: kubesec.io<\/a><\/noindex><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\n
For example, it can detect excessive privileges and permissions granted to a pod, launching the container with root as the default user, connecting to the host network namespace, or risky mounts. \/proc<\/code> Docker host or socket. Another interesting feature of Kubesec is the online demo service, where you can upload YAML and immediately conduct its analysis.<\/p>\nand that this action is permitted.<\/h3>\n <\/p>\n
\n Website: www.openpolicyagent.org<\/a><\/noindex><\/li>\n License: free (Apache)<\/li>\n<\/ul>\n\n
For example, you can deploy OPA as a backend for the Kubernetes admission controller, delegating security decisions to it. This way, the OPA agent can check, reject, and even modify requests on the fly, ensuring compliance with specified security parameters. Security policies in OPA are written in its own DSL language, Rego.<\/p>\n
Note: translation.<\/b>: We discussed OPA (and SPIFFE) further in this article.<\/a><\/noindex>.<\/i><\/p>\nComprehensive commercial tools for Kubernetes security analysis<\/h2>\n \nWe decided to create a separate category for commercial platforms since they typically cover multiple security areas at once. An overview of their capabilities can be obtained from the table:<\/p>\n
* Advanced expertise and post-mortem analysis with complete system call capture.<\/a><\/noindex>.<\/i><\/p>\nAqua Security<\/h3>\n <\/p>\n
![\"33+](\"\/wp-content\/uploads\/2019\/09\/4d9aa6583128844afadc1b06996c29b6.png\")