{"id":38497,"date":"2019-10-31T22:24:06","date_gmt":"2019-10-31T19:24:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/33-instrumenta-dlya-bezopasnosti-kubernetes\/"},"modified":"2019-10-31T22:24:06","modified_gmt":"2019-10-31T19:24:06","slug":"33-instrumenta-dlya-bezopasnosti-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","title":{"rendered":"33+ Kubernetes dro\u0161\u012bbas r\u012bki","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i><b>Piez\u012bme:<\/b>: Ja j\u016bs uztraucaties par dro\u0161\u012bbu infrastrukt\u016br\u0101, kas balst\u012bta uz Kubernetes, \u0161is lieliskais p\u0101rskats no Sysdig var b\u016bt lieliska s\u0101kumpunkts \u0101trai iepaz\u012b\u0161anai ar m\u016bsdien\u0101s aktu\u0101lajiem risin\u0101jumiem. Taj\u0101 iek\u013cautas gan visaptvero\u0161as sist\u0113mas no zin\u0101miem tirgus dal\u012bbniekiem, gan daudz skromn\u0101kas util\u012btas, kas risina konkr\u0113tas probl\u0113mas. Un m\u0113s, k\u0101 vienm\u0113r, b\u016bsim priec\u012bgi uzzin\u0101t par j\u016bsu pieredzi, izmantojot \u0161os r\u012bkus, un redz\u0113t saites uz citiem projektiem.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/4d9aa6583128844afadc1b06996c29b6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nProgrammatuurproduktiem Kubernetes dro\u0161\u012bbas nodro\u0161in\u0101\u0161anai\u2026 ir tik daudz, un katram ir savi m\u0113r\u0137i, izmanto\u0161anas jomas un licences.<\/p>\n<p>T\u0101p\u0113c m\u0113s nol\u0113m\u0101m izveidot \u0161o sarakstu un iek\u013cauj\u0101m taj\u0101 gan atv\u0113rtos projektus, gan komerci\u0101l\u0101s platformas no da\u017e\u0101diem pieg\u0101d\u0101t\u0101jiem. Ceram, ka tas pal\u012bdz\u0113s jums izv\u0113l\u0113ties tos, kas ir visinteresant\u0101kie un novirz\u012bs pareizaj\u0101 virzien\u0101 atkar\u012bb\u0101 no konkr\u0113taj\u0101m pras\u012bb\u0101m Kubernetes dro\u0161\u012bbas nodro\u0161in\u0101\u0161anai.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Kategorijas<\/h2>\n<p>\nLai atvieglotu navig\u0101ciju sarakst\u0101, r\u012bki ir sadal\u012bti galvenaj\u0101s funkcij\u0101s un izmanto\u0161anas jom\u0101s. Izv\u0113rt\u0101s \u0161\u0101das sada\u013cas:<\/p>\n<ul>\n<li> Kubernetes att\u0113lu sken\u0113\u0161ana un statisk\u0101 anal\u012bze;<\/li>\n<li> Re\u0101llaika dro\u0161\u012bba;<\/li>\n<li> Kubernetes t\u012bkla dro\u0161\u012bba;<\/li>\n<li> Att\u0113lu izplat\u012b\u0161ana un slepeno datu p\u0101rvald\u012bba;<\/li>\n<li> Kubernetes dro\u0161\u012bbas audits;<\/li>\n<li> Visaptvero\u0161i komerci\u0101li produkti.<\/li>\n<\/ul>\n<p>\nP\u0101riesim pie lietas:<\/p>\n<h2>Kubernetes att\u0113lu sken\u0113\u0161ana<\/h2>\n<p><\/p>\n<h3>Anchore<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/anchore.com\">anchore.com<\/a><\/noindex><\/li>\n<li> Licence: br\u012bva (Apache) un komerci\u0101lais pied\u0101v\u0101jums<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/2c942e5a104feb4840a426157d5457f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAnchore pakotne analiz\u0113 konteineru att\u0113lus un \u013cauj veikt dro\u0161\u012bbas p\u0101rbaudes, pamatojoties uz lietot\u0101ja noteiktaj\u0101m politik\u0101m.<\/p>\n<p>Papildus parastajai konteineru att\u0113lu sken\u0113\u0161anai, lai identific\u0113tu zin\u0101m\u0101s ievainojam\u012bbas no CVE datu b\u0101zes, Anchore veic daudz papildu p\u0101rbaudes sken\u0113\u0161anas politik\u0101: p\u0101rbauda Dockerfile, datu nopl\u016bdes, izmantoto programmat\u016bras valodu paketes (npm, maven u.c.), programmat\u016bras licences un daudz ko citu.<\/p>\n<h3>Clair<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/coreos.com\/clair\">coreos.com\/clair<\/a><\/noindex> <i>(tagad zem Red Hat uzraudz\u012bbas)<\/i><\/li>\n<li> Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/81be8927c1fcbfa5d714836a1db3c7d8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nClair bija viens no pirmajiem atv\u0113rt\u0101 koda projektiem att\u0113lu sken\u0113\u0161anai. Tas ir pla\u0161i paz\u012bstams k\u0101 dro\u0161\u012bbas skeneris, kas kalpo k\u0101 pamats Quay att\u0113lu re\u0123istram <i>(t\u0101pat no CoreOS \u2014 <b>piez. tulk.<\/b>)<\/i>Clair sp\u0113j v\u0101kts inform\u0101ciju par CVE no daudziem avotiem, tostarp specifisku Linux distrib\u016bciju ievainojam\u012bbu sarakstiem, kurus vada Debian, Red Hat vai Ubuntu dro\u0161\u012bbas komandas.<\/p>\n<p>At\u0161\u0137ir\u012bb\u0101 no Anchore, Clair galvenok\u0101rt nodarbojas ar ievainojam\u012bbu mekl\u0113\u0161anu un datu sal\u012bdzin\u0101\u0161anu ar CVE. Tom\u0113r produkts pied\u0101v\u0101 lietot\u0101jiem da\u017eas iesp\u0113jas papla\u0161in\u0101t funkcionalit\u0101ti, izmantojot papla\u0161in\u0101jumus.<\/p>\n<h3>Dagda<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/eliasgranderubio\/dagda\">github.com\/eliasgranderubio\/dagda<\/a><\/noindex><\/li>\n<li> Licence: bezmaksas (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/242930fcb99017f80f7cfc2a676e16ef.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDagda veic statisku anal\u012bzi konteineru att\u0113liem attiec\u012bb\u0101 uz zin\u0101maj\u0101m ievainojam\u012bb\u0101m, trojaniem, v\u012brusiem, \u013caunpr\u0101t\u012bgaj\u0101m programm\u0101m un cit\u0101m draudiem.<\/p>\n<p>No citiem l\u012bdz\u012bgiem r\u012bkiem Dagda izce\u013cas ar div\u0101m iev\u0113rojam\u0101m iez\u012bm\u0113m:<\/p>\n<ul>\n<li> Tas lieliski integr\u0113jas ar <noindex><a rel=\"nofollow\" href=\"https:\/\/www.clamav.net\/\">ClamAV<\/a><\/noindex>, kalpojot ne tikai k\u0101 r\u012bks konteineru att\u0113lu sken\u0113\u0161anai, bet ar\u012b k\u0101 antiv\u012bruss.<\/li>\n<li> Tas ar\u012b nodro\u0161ina runtime aizsardz\u012bbu, re\u0101laj\u0101 laik\u0101 sa\u0146emot notikumus no Docker demona un integr\u0113joties ar Falco <i>(skat\u012bt zem\u0101k)<\/i> dro\u0161\u012bbas notikumu v\u0101k\u0161anai darb\u012bbas laik\u0101 konteiner\u0101.<\/li>\n<\/ul>\n<p><\/p>\n<h3>KubeXray<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jfrog\/kubexray\">github.com\/jfrog\/kubexray<\/a><\/noindex><\/li>\n<li> Licence: bezmaksas (Apache), bet prasa datus no JFrog Xray (komerci\u0101la produkta)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/f3aafb0d694b810fd5a7046c270e3b4d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubeXray \u00abuzrauga\u00bb API servera Kubernetes notikumus un ar JFrog Xray metadatu pal\u012bdz\u012bbu nodro\u0161ina, ka tiek palaisti tikai t\u0101di pod&#8217;i, kuri atbilst pa\u0161reiz\u0113jai politikai.<\/p>\n<p>KubeXray ne tikai audit\u0113 jaunus vai atjaunin\u0101tus konteinerus deployment&#8217;os (t\u0101pat k\u0101 admission controller Kubernetes), bet ar\u012b dinamiski p\u0101rbauda str\u0101d\u0101jo\u0161os konteinerus, lai tie atbilstu jaunaj\u0101m dro\u0161\u012bbas politik\u0101m, no\u0146emot resursus, kas atsaucas uz ievainojam\u0101m att\u0113liem.<\/p>\n<h3>Snyk<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/snyk.io\/\">snyk.io<\/a><\/noindex><\/li>\n<li> Licence: bezmaksas (Apache) un komerci\u0101l\u0101s versijas<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/a36ded26e3a659474c1c154bc3e753bb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSnyk ir neparasts ievainojam\u012bbu skeneris, jo tas \u012bpa\u0161i v\u0113r\u0161as pie izstr\u0101des procesa un tiek reklam\u0113ts k\u0101 \u201eneat\u0146emams risin\u0101jums\u201d izstr\u0101d\u0101t\u0101jiem.<\/p>\n<p>Snyk tie\u0161i piesl\u0113dzas koda repozitorijiem, analiz\u0113 projekta manifestu un p\u0113ta iek\u013cauto kodu kop\u0101 ar tie\u0161aj\u0101m un netie\u0161aj\u0101m atkar\u012bb\u0101m. Snyk atbalsta daudzus popul\u0101rus programm\u0113\u0161anas valodas un sp\u0113j atkl\u0101t sl\u0113ptos licenc\u0113\u0161anas riskus.<\/p>\n<h3>Trivy<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/knqyf263\/trivy\">github.com\/knqyf263\/trivy<\/a><\/noindex><\/li>\n<li> Licence: bezmaksas (AGPL)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/b21dd72d590d719a7d13741117002999.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTrivy \u2014 vienk\u0101r\u0161s, bet jaud\u012bgs dro\u0161\u012bbas skeneris konteineriem, ko viegli integr\u0113t CI\/CD pl\u016bsm\u0101. T\u0101 izcila iez\u012bme ir vienk\u0101r\u0161a uzst\u0101d\u012b\u0161ana un lieto\u0161ana: lietotne sast\u0101v no viena bin\u0101ra faila un neprasa datu b\u0101zes vai papildu bibliot\u0113ku instal\u0113\u0161anu.<\/p>\n<p>Trivy vienk\u0101r\u0161\u012bbas otra puse ir t\u0101, ka b\u016bs j\u0101apg\u016bst, k\u0101 pars\u0113t un nos\u016bt\u012bt rezult\u0101tus JSON form\u0101t\u0101, lai tos var\u0113tu izmantot citi Kubernetes dro\u0161\u012bbas r\u012bki.<\/p>\n<h2>Runtime dro\u0161\u012bba Kubernetes<\/h2>\n<p><\/p>\n<h3>Falco<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/falco.org\/\">falco.org<\/a><\/noindex><\/li>\n<li> Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/0e2601a1ec4ec56ed9daea5f34f36e9a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFalco \u2014 r\u012bku kopums, lai nodro\u0161in\u0101tu dro\u0161\u012bbu m\u0101ko\u0146u izpildes vid\u0113s. Tas ietilpst projektu \u0123imen\u0113 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cncf.io\/sandbox-projects\/\">CNCF<\/a><\/noindex>.<\/p>\n<p>Izmantojot Sysdig r\u012bkus, kas darbojas Linux kodol\u0101 un profiliizes sist\u0113mas izsaukumus, Falco \u013cauj dzi\u013ci iedzi\u013cin\u0101ties sist\u0113mas uzved\u012bb\u0101. T\u0101s runtime noteikumu meh\u0101nisms var atkl\u0101t aizdom\u012bgas aktivit\u0101tes lietojumprogrammu, konteineru, pamatviesu un Kubernetes or\u0137estratora vid\u016b.<\/p>\n<p>Falco nodro\u0161ina piln\u012bgu caurredzam\u012bbu runtime&#8217;a darb\u012bb\u0101 un draudu atkl\u0101\u0161anu, izvietojot \u012bpa\u0161us a\u0123entus Kubernetes mezglos. T\u0101d\u0113j\u0101di nav nepiecie\u0161ams modific\u0113t konteinerus, ievie\u0161ot tajos tre\u0161o pu\u0161u kodu vai pievienojot sidecar konteinerus.<\/p>\n<h3>Linux dro\u0161\u012bbas ietvari runtime<\/h3>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/18f219ca98e481376265b753b638a7ec.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0160ie Linux kodol\u0101 ieb\u016bv\u0113tie ietvari nav \u201cKubernetes dro\u0161\u012bbas r\u012bki\u201d tradicion\u0101laj\u0101 izpratn\u0113, tom\u0113r ir peln\u012bju\u0161i piemin\u0113\u0161anu, jo ir svar\u012bgs elements dro\u0161\u012bbas jom\u0101 runtime, kas iek\u013caujas Kubernetes Pod Security Policy (PSP).<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/gitlab.com\/apparmor\/apparmor\/wikis\/home\/\">AppArmor<\/a><\/noindex> Pievieno dro\u0161\u012bbas profilu procesiem, kas darbojas konteiner\u0101, nosakot failu sist\u0113mas privil\u0113\u0123ijas, t\u012bkla piek\u013cuves noteikumus, bibliot\u0113ku piesl\u0113g\u0161anu utt. Tas ir sist\u0113ma, kas balst\u012bta uz oblig\u0101to piek\u013cuves kontroli (Mandatory Access Control, MAC). Citiem v\u0101rdiem sakot, t\u0101 nov\u0113r\u0161 aizliegto darb\u012bbu izpildi.<\/p>\n<p>Security-Enhanced Linux (<noindex><a rel=\"nofollow\" href=\"https:\/\/selinuxproject.org\/page\/Main_Page\">SELinux<\/a><\/noindex>) \u2014 tas ir dro\u0161\u012bbas papla\u0161in\u0101juma modulis Linux kodol\u0101, kas da\u017ei aspekti ir l\u012bdz\u012bgi AppArmor un bie\u017ei tiek sal\u012bdzin\u0101ts ar to. SELinux p\u0101rsp\u0113j AppArmor p\u0113c jaudas, elast\u012bbas un precizit\u0101tes nastat\u0113. T\u0101 tr\u016bkumi ir ilga apg\u016b\u0161ana un paaugstin\u0101ta sare\u017e\u0123\u012bt\u012bba.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/seccomp\/libseccomp\">Seccomp<\/a><\/noindex> Un seccomp-bpf \u013cauj filtr\u0113t sist\u0113mas izsaukumus, blo\u0137\u0113t izpildi tiem, kas potenci\u0101li ir b\u012bstami pamatoper\u0113t\u0101jsist\u0113mai un nav nepiecie\u0161ami norm\u0101lai lietot\u0101ja lietojumprogrammu darb\u012bbai. Seccomp da\u017e\u0101s jom\u0101s ir l\u012bdz\u012bgs Falco, tom\u0113r neizprot konteineru specifiku.<\/p>\n<h3>Sysdig atv\u0113rta koda<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sysdig.com\/opensource\">www.sysdig.com\/opensource<\/a><\/noindex><\/li>\n<li> Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/4f8849a6cc819cef89f10ab80911c504.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSysdig ir pilnv\u0113rt\u012bgs instruments Linux sist\u0113mu anal\u012bzei, diagnostikai un k\u013c\u016bdu nov\u0113r\u0161anai (t\u0101pat darbojas Windows un macOS, bet ar ierobe\u017eot\u0101m funkcij\u0101m). To var izmantot deta\u013cu v\u0101k\u0161anai, p\u0101rbaudei un krimin\u0101listikas izp\u0113tei <i>(krimin\u0101listika)<\/i> pamatnost\u0101d\u0146u un visu uz t\u0101s balst\u012bto konteineru darb\u012bbai.<\/p>\n<p>Turkl\u0101t Sysdig s\u0101kotn\u0113ji atbalsta izpildes vid\u0113jumus konteineriem un Kubernetes metadatus, pievienojot papildu dimensijas un mar\u0137\u0113jumus visai sav\u0101ktajai inform\u0101cijai par sist\u0113mas uzved\u012bbu. Ir vair\u0101ki veidi, k\u0101 analiz\u0113t Kubernetes klasteri, izmantojot Sysdig: var veikt uz\u0146em\u0161anu noteikt\u0101 laik\u0101, izmantojot <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sysdiglabs\/kubectl-capture\">kubectl capture<\/a><\/noindex> vai ar\u012b palaist interakt\u012bvo saskarni, pamatojoties uz ncurses, ar spraud\u0146a pal\u012bdz\u012bbu <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sysdiglabs\/kubectl-dig\">kubectl dig<\/a><\/noindex>.<\/p>\n<h2>Kubernetes t\u012bkla dro\u0161\u012bba<\/h2>\n<p><\/p>\n<h3>Aporeto<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aporeto.com\/\">www.aporeto.com<\/a><\/noindex><\/li>\n<li> Licences: komerci\u0101la<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/9692c50339a6c304c7f32f90619aaed1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAporeto nodro\u0161ina \"dro\u0161\u012bbu, atdal\u012btu no t\u012bkla un infrastrukt\u016bras\". Tas noz\u012bm\u0113, ka Kubernetes pakalpojumi ne tikai sa\u0146em viet\u0113jo ID (proti, ServiceAccount Kubernetes), bet ar\u012b univers\u0101lu identifikatoru\/p\u0113du, ko var izmantot dro\u0161ai un savstarp\u0113jai verific\u0113\u0161anai ar citiem pakalpojumiem, piem\u0113ram, OpenShift klaster\u012b.<\/p>\n<p>Aporeto sp\u0113j \u0123ener\u0113t unik\u0101lu identifikatoru ne tikai Kubernetes\/konteineriem, bet ar\u012b hostiem, m\u0101ko\u0146u funkcij\u0101m un lietot\u0101jiem. Atkar\u012bb\u0101 no \u0161iem identifikatoriem un administratora noteiktajiem t\u012bkla dro\u0161\u012bbas noteikumiem, komunik\u0101cija tiks at\u013cauta vai blo\u0137\u0113ta.<\/p>\n<h3>Calico<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.projectcalico.org\/\">www.projectcalico.org<\/a><\/noindex><\/li>\n<li> Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/5902a133d4afc496f035de0f63129f99.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCalico parasti tiek izvietots container orchestration instal\u0101cijas laik\u0101, kas \u013cauj izveidot virtu\u0101lo t\u012bklu, kas saista konteinerus. Papildus \u0161ai pamatvajadz\u012bbai Calico projekts darbojas ar Kubernetes t\u012bkla politik\u0101m un savu profilu t\u012bkla dro\u0161\u012bbai, atbalsta ACL (piek\u013cuves kontroli) endpoint&#8217;iem un anot\u0101ciju balst\u012btas t\u012bkla dro\u0161\u012bbas noteikumus Ingress un Egress datpl\u016bsm\u0101m.<\/p>\n<h3>Cilium<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cilium.io\/\">www.cilium.io<\/a><\/noindex><\/li>\n<li> Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/2a9f3d1de52936c2f1a06d96fab054fb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCilium darbojas k\u0101 ugunsm\u016bris konteineriem un sniedz t\u012bkla dro\u0161\u012bbas iesp\u0113jas, s\u0101kotn\u0113ji piel\u0101gotas Kubernetes un mikroservisu slodz\u0113m. Cilium izmanto jaunu Linux kodola tehnolo\u0123iju, ko sauc par BPF (Berkeley Packet Filter), lai filtr\u0113tu, uzraudz\u012btu, p\u0101rs\u016bt\u012btu un kori\u0123\u0113tu datus.<\/p>\n<p>Cilium sp\u0113j izvietot t\u012bkla piek\u013cuves politikas, balstoties uz konteineru identifikatoriem, izmantojot Docker vai Kubernetes mar\u0137\u0113jumus un metadatus. Cilium ar\u012b saprot un filtr\u0113 da\u017e\u0101dus 7. l\u012bme\u0146a protokolus, piem\u0113ram, HTTP vai gRPC, \u013caujot defin\u0113t REST izsaukumu kopas, kuras, piem\u0113ram, tiks at\u013cautas starp diviem Kubernetes deployment&#8217;iem.<\/p>\n<h3>Istio<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/\">istio.io<\/a><\/noindex><\/li>\n<li> Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/da9e18500fffdf2c310182a4820c722d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIstio ir pla\u0161i paz\u012bstams k\u0101 pakalpojumu sadal\u012bjuma paradigmas \u012bstenojums, izvietojot platformai neatkar\u012bgu kontrolpl\u0101nu un novirzot visu p\u0101rvald\u012bto pakalpojumu satiksmi caur dinamisk\u0101 veid\u0101 konfigur\u0113jamiem Envoy proksijiem. Istio izmanto \u0161o progres\u012bvo izpratni par visiem mikroservisiem un konteineriem, lai \u012bstenotu da\u017e\u0101das t\u012bkla dro\u0161\u012bbas strat\u0113\u0123ijas.<\/p>\n<p>Istio t\u012bkla dro\u0161\u012bbas iesp\u0113jas ietver caursp\u012bd\u012bgu TLS \u0161ifr\u0113\u0161anu, autom\u0101tiski uzlabojot komunik\u0101cijas protokolu starp mikroservisiem l\u012bdz HTTPS un savu RBAC sist\u0113mu identifik\u0101cijai un autoriz\u0101cijai, lai at\u013cautu\/ierobe\u017eotu datu apmai\u0146u starp da\u017e\u0101d\u0101m slodz\u0113m klaster\u012b.<\/p>\n<p><i><b>Piez\u012bme:<\/b>: Lasiet vair\u0101k par Istio dro\u0161\u012bbai v\u0113rstaj\u0101m iesp\u0113j\u0101m <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443668\/\">\u0161aj\u0101 rakst\u0101<\/a><\/noindex>.<\/i><\/p>\n<h3>Tigera<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tigera.io\/\">www.tigera.io<\/a><\/noindex><\/li>\n<li> Licences: komerci\u0101la<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/3568cf2fc634d4c40c45f0db4a08aa77.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0160aj\u0101 risin\u0101jum\u0101, ko sauc par \"Kubernetes ugunsm\u016bri\", tiek uzsv\u0113rts t\u012bkla dro\u0161\u012bbas zero trust pieejas princips.<\/p>\n<p>T\u0101pat k\u0101 citi Kubernetes dzimtie t\u012bkla risin\u0101jumi, Tigera pa\u013caujas uz metadatiem, identific\u0113jot da\u017e\u0101dus pakalpojumus un objektus klaster\u012b, un nodro\u0161ina probl\u0113mu atkl\u0101\u0161anu re\u0101llaik\u0101, nep\u0101rtrauktu atbilst\u012bbas p\u0101rbaudi un t\u012bkla caursp\u012bd\u012bgumu daudzm\u0101kon\u012b vai hibr\u012bda monol\u012bts-konteineriz\u0113tas infrastrukt\u016br\u0101.<\/p>\n<h3>Trireme<\/h3>\n<p><\/p>\n<ul>\n<li>M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aporeto.com\/opensource\/\">www.aporeto.com\/opensource<\/a><\/noindex><\/li>\n<li>Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/5924b4c2a0f6324e9d946c0261cbc53f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTrireme-Kubernetes ir vienk\u0101r\u0161a un saprotama Kubernetes t\u012bkla politiku specifik\u0101cijas \u012bsteno\u0161ana. Atz\u012bm\u0113jama iez\u012bme ir t\u0101, ka, at\u0161\u0137ir\u012bb\u0101 no l\u012bdz\u012bgiem Kubernetes t\u012bkla dro\u0161\u012bbas produktiem, tam nav nepiecie\u0161ama centr\u0101l\u0101 kontrolpunkts, lai koordin\u0113tu t\u012bklu (mesh). Tas padara risin\u0101jumu ac\u012bmredzami m\u0113rogojamu. Trireme to sasniedz, uzst\u0101dot a\u0123entu katr\u0101 mezgl\u0101, kas tie\u0161i savienojas ar vies\u0113jo TCP\/IP steku.<\/p>\n<h2>Att\u0113lu izplat\u012b\u0161ana un slepeno p\u0101rvald\u012bba<\/h2>\n<p><\/p>\n<h3>Grafeas<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/grafeas.io\/\">grafeas.io<\/a><\/noindex><\/li>\n<li> Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/92c9986b36991d280cce0b1093e1938f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGrafeas ir atv\u0113rt\u0101 koda API programmat\u016bras pieg\u0101des audita un p\u0101rvald\u012bbas nodro\u0161in\u0101\u0161anai. Pamata l\u012bmen\u012b Grafeas ir instruments metadatu un audita rezult\u0101tu v\u0101k\u0161anai. To var izmantot, lai izsekotu atbilst\u012bbu dro\u0161\u012bbas lab\u0101kaj\u0101m praks\u0113m organiz\u0101cij\u0101.<\/p>\n<p>\u0160is centraliz\u0113tais paties\u012bbas avots pal\u012bdz atbild\u0113t uz jaut\u0101jumiem, piem\u0113ram,<\/p>\n<ul>\n<li> Kas izstr\u0101d\u0101ja un parakst\u012bja konkr\u0113tu konteineru?<\/li>\n<li> Vai tas iztur\u0113ja visus dro\u0161\u012bbas skenerus un p\u0101rbaudes, kas noteiktas dro\u0161\u012bbas politik\u0101? Kad? K\u0101di bija rezult\u0101ti? <\/li>\n<li> Kas to izvietoja ra\u017eo\u0161an\u0101? K\u0101di tie\u0161i parametri tika izmantoti izvieto\u0161anas proces\u0101?<\/li>\n<\/ul>\n<p><\/p>\n<h3>In-toto<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/in-toto.github.io\/\">in-toto.github.io<\/a><\/noindex><\/li>\n<li> Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/91f0ba618f41dbadb07b37ec6999a736.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIn-toto ir ietvars, kas izstr\u0101d\u0101ts programmat\u016bras pieg\u0101des \u0137\u0113des integrit\u0101tes, autentifik\u0101cijas un audit\u0113\u0161anas nodro\u0161in\u0101\u0161anai. Izvietojot In-toto infrastrukt\u016br\u0101, vispirms tiek noteikts pl\u0101ns, kas apraksta da\u017e\u0101dus posmus cauru\u013cvad\u0101 (repozitorijs, CI\/CD r\u012bki, QA r\u012bki, artefakta veidot\u0101ji utt.) un lietot\u0101jus (atbild\u012bg\u0101s personas), kam ir at\u013cauts tos inici\u0113t.<\/p>\n<p>In-toto kontrol\u0113 pl\u0101na izpildi, p\u0101rbaudot, vai katra uzdevuma izpilde \u0137\u0113d\u0113 tiek veikta tikai ar autoriz\u0113tu person\u0101lu un vai procesa laik\u0101 ar produktu netika veikti nek\u0101di nesankcion\u0113ti manevri.<\/p>\n<h3>Portieris<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/IBM\/portieris\">github.com\/IBM\/portieris<\/a><\/noindex><\/li>\n<li> Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/ff9c24c88cd9a06c8bd35dfe4f3558cf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPortieris ir admission controller Kubernetes; tiek izmantots, lai piespiestu p\u0101rbaud\u012bt saturu uzticam\u012bbu. Portieris izmanto serveri <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/theupdateframework\/notary\">Notary<\/a><\/noindex> <i>(m\u0113s par to rakst\u012bj\u0101m beig\u0101s <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/340366\/\">\u0161\u012b raksta<\/a><\/noindex> \u2014 <b>piez. tulk.<\/b>)<\/i> k\u0101 paties\u012bbas avotu, lai apstiprin\u0101tu uzticamus un parakst\u012btus artefaktus (t.i., apstiprin\u0101tus konteineru att\u0113lus).<\/p>\n<p>Izveidojot vai mainot darba slodzi Kubernetes, Portieris iel\u0101d\u0113 paraksta inform\u0101ciju un satura ticam\u012bbas politiku piepras\u012btajiem konteineru att\u0113liem, un p\u0113c vajadz\u012bbas uz vietas veic izmai\u0146as JSON objekta API, lai palaistu parakst\u012btas \u0161o att\u0113lu versijas.<\/p>\n<h3>Vault<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.vaultproject.io\/\">www.vaultproject.io<\/a><\/noindex><\/li>\n<li> Licenze: br\u012bva (MPL)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/19191a10051dc6349af017a06f0fd43e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVault ir dro\u0161a risin\u0101jums nosl\u0113gt\u0101s inform\u0101cijas glab\u0101\u0161anai: paroli, OAuth simbolu, PKI sertifik\u0101tu, piek\u013cuves kontu, Kubernetes slepen\u012bbu utt. Vault atbalsta daudzas progres\u012bvas funkcijas, piem\u0113ram, \u012bslaic\u012bgu dro\u0161\u012bbas simbolu nomu vai atsl\u0113gu rot\u0101ciju.<\/p>\n<p>Izmantojot Helm chart Vault, var izveidot jaunu deployment Kubernetes klaster\u012b ar Consul k\u0101 backend kr\u0101tuvi. Tas atbalsta Kubernetes ieb\u016bv\u0113t\u0101s resursus, piem\u0113ram, ServiceAccount tokenus un pat var darboties k\u0101 Kubernetes noklus\u0113juma slepeno kr\u0101tuve.<\/p>\n<p><i><b>Piez\u012bme:<\/b>: Starp citu, tie\u0161i vakar uz\u0146\u0113mums HashiCorp, kas izstr\u0101d\u0101 Vault, pazi\u0146oja par da\u017eiem uzlabojumiem Vault izmanto\u0161anai Kubernetes, \u012bpa\u0161i tie attiecas uz Helm grafiku. S\u012bk\u0101ku inform\u0101ciju lasiet <noindex><a rel=\"nofollow\" href=\"https:\/\/www.hashicorp.com\/blog\/whats-next-for-vault-and-kubernetes\">izstr\u0101d\u0101t\u0101ja emu\u0101r\u0101<\/a><\/noindex>.<\/i><\/p>\n<h2>Kubernetes dro\u0161\u012bbas audits<\/h2>\n<p><\/p>\n<h3>Kube-bench<\/h3>\n<p><\/p>\n<ul>\n<li>M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/kube-bench\">github.com\/aquasecurity\/kube-bench<\/a><\/noindex><\/li>\n<li>Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/8e0e101503f02ea3033f7b29c9ee9ddf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKube-bench ir Go lietotne, kas p\u0101rbauda, vai Kubernetes ir dro\u0161i izvietots, veicot testus no saraksta <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/container-compliance\/\">CIS Kubernetes Standarts<\/a><\/noindex>.<\/p>\n<p>Kube-bench mekl\u0113 nedro\u0161us konfigur\u0101cijas parametrus klastera komponentos (etcd, API, kontroliera vad\u012bt\u0101js utt.), ap\u0161aub\u0101mus piek\u013cuves ties\u012bbas uz failiem, neaizsarg\u0101tus kontus vai atv\u0113rtas portus, resursu kvotas, API piek\u013cuves ierobe\u017eojumu iestat\u012bjumus, lai pasarg\u0101tu no DoS uzbrukumiem utt.<\/p>\n<h3>Kube-hunter<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/kube-hunter\">github.com\/aquasecurity\/kube-hunter<\/a><\/noindex><\/li>\n<li> Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/e5e38368af8bf086da149cbfd71a5e6d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKube-hunter \"med\u012b\" potenci\u0101l\u0101s ievainojam\u012bbas (piem\u0113ram, att\u0101lin\u0101tas koda izpildes vai datu nopl\u016bdes) Kubernetes klasteros. Kube-hunter var palaist k\u0101 att\u0101lu skeneri \u2014 \u0161aj\u0101 gad\u012bjum\u0101 tas nov\u0113rt\u0113s klasteri no \u013caunpr\u0101t\u012bga uzbruc\u0113ja viedok\u013ca \u2014 vai k\u0101 pod iek\u0161\u0101 klaster\u012b.<\/p>\n<p>Izcil\u0101k\u0101 iez\u012bme Kube-hunter&#8217;am ir \u00abakt\u012bv\u0101s med\u012bbas\u00bb re\u017e\u012bms, kur\u0101 tas ne tikai zi\u0146o par probl\u0113m\u0101m, bet ar\u012b m\u0113\u0123ina izmantot m\u0113r\u0137a klaster\u012b atkl\u0101t\u0101s ievainojam\u012bbas, kas potenci\u0101li var\u0113tu kait\u0113t t\u0101 darb\u012bbai. T\u0101d\u0113\u013c izmantojiet to ar piesardz\u012bbu!<\/p>\n<h3>Kubeaudit<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Shopify\/kubeaudit\">github.com\/Shopify\/kubeaudit<\/a><\/noindex><\/li>\n<li> Licenze: br\u012bva (MIT)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/84651a05f714b9c841245cb38f78324a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubeaudit ir konsoles r\u012bks, kas s\u0101kotn\u0113ji izstr\u0101d\u0101ts Shopify, lai auditojot Kubernetes konfigur\u0101ciju atkl\u0101tu da\u017e\u0101das dro\u0161\u012bbas probl\u0113mas. Piem\u0113ram, tas pal\u012bdz identific\u0113t konteinerus, kas darbojas bez ierobe\u017eojumiem, ar superlietot\u0101ja piek\u013cuvi, kas \u013caunpr\u0101t\u012bgi izmanto privil\u0113\u0123ijas vai izmanto noklus\u0113juma ServiceAccount.<\/p>\n<p>Kubeaudit ir ar\u012b citas interesantas iesp\u0113jas. Piem\u0113ram, tas sp\u0113j analiz\u0113t viet\u0113jos YAML failus, identific\u0113jot konfigur\u0101cijas tr\u016bkumus, kas var novest pie dro\u0161\u012bbas probl\u0113m\u0101m, un autom\u0101tiski tos labot.<\/p>\n<h3>Kubesec<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/kubesec.io\/\">kubesec.io<\/a><\/noindex><\/li>\n<li> Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/73e395cdcbe89af391b80ff9dccad5f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubesec ir \u012bpa\u0161s r\u012bks, jo tie\u0161i sken\u0113 YAML failus, kuros aprakst\u012bti Kubernetes resursi, mekl\u0113jot v\u0101j\u0101s konfigur\u0101cijas, kas var ietekm\u0113t dro\u0161\u012bbu.<\/p>\n<p>Piem\u0113ram, tas var atkl\u0101t p\u0101rsp\u012bl\u0113tas privil\u0113\u0123ijas un at\u013caujas, kas pie\u0161\u0137irtas pod&#8217;am, palaidot konteineru ar root&#8217;a ties\u012bb\u0101m k\u0101 noklus\u0113juma lietot\u0101ju, piesl\u0113dzoties host v\u0101ka nosac\u012bjumu telpai vai b\u012bstam\u0101m piek\u013cau\u0161an\u0101m, piem\u0113ram, <code>\/proc<\/code> hostu vai Docker socket. V\u0113l viena interesanta Kubesec iesp\u0113ja ir pieejamais tie\u0161saistes demo pakalpojums, kur\u0101 var aug\u0161upiel\u0101d\u0113t YAML un nekav\u0113joties veikt t\u0101 anal\u012bzi.<\/p>\n<h3>Open Policy Agent<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openpolicyagent.org\/\">www.openpolicyagent.org<\/a><\/noindex><\/li>\n<li> Licence: br\u012bva (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/f897b58fbc67d9cb463008621f4e608f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOPA (Open Policy Agent) koncepcija ir atdal\u012bt dro\u0161\u012bbas politikas un lab\u0101k\u0101s prakses no konkr\u0113tu laika izpildes platform\u0101m: Docker, Kubernetes, Mesosphere, OpenShift vai jebkura to kombin\u0101cija.<\/p>\n<p>Piem\u0113ram, var izvietot OPA k\u0101 backend admission controller Kubernetes, dele\u0123\u0113jot tam dro\u0161\u012bbas l\u0113mumu pie\u0146em\u0161anu. T\u0101d\u0113j\u0101di OPA a\u0123ents var p\u0101rbaud\u012bt, noraid\u012bt un pat main\u012bt piepras\u012bjumus re\u0101laj\u0101 laik\u0101, nodro\u0161inot nor\u0101d\u012bto dro\u0161\u012bbas parametru iev\u0113ro\u0161anu. Dro\u0161\u012bbas politikas OPA ir uzrakst\u012btas t\u0101 pa\u0161reiz\u0113j\u0101 DSL valod\u0101 Rego.<\/p>\n<p><i><b>Piez\u012bme:<\/b>: Pla\u0161\u0101k par OPA (un SPIFFE) m\u0113s rakst\u012bj\u0101m <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/353808\/\">\u0161aj\u0101 materi\u0101l\u0101<\/a><\/noindex>.<\/i><\/p>\n<h2>Integr\u0113ti komerci\u0101li r\u012bki Kubernetes dro\u0161\u012bbas anal\u012bzei<\/h2>\n<p>\nM\u0113s nol\u0113m\u0101m izveidot atsevi\u0161\u0137u kategoriju komerci\u0101l\u0101m platform\u0101m, jo t\u0101s parasti aptver vair\u0101kas dro\u0161\u012bbas jomas. Visp\u0101r\u0113ju ieskatu to iesp\u0113j\u0101s var ieg\u016bt no tabulas:<\/p>\n<p><img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/0dbe925006238ee242c452f05d9f7302.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>* Progres\u012bva ekspert\u012bze un post mortem anal\u012bze ar piln\u012bgu <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/use-cases\/container-forensics\/\">sist\u0113mu izsaukumu sag capturing<\/a><\/noindex>.<\/i><\/p>\n<h3>Aqua Security<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aquasec.com\/\">www.aquasec.com<\/a><\/noindex><\/li>\n<li> Licences: komerci\u0101la<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/d02026209908e9dac53be53fbdb178cd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\n\u0160is komerci\u0101lais r\u012bks ir dom\u0101ts konteineriem un m\u0101kon\u012b balst\u012bt\u0101m darba slodz\u0113m. Tas nodro\u0161ina:<\/p>\n<ul>\n<li> Att\u0113lu sken\u0113\u0161ana, kas integr\u0113ta ar konteineru re\u0123istru vai CI\/CD caurpl\u016bsmu;<\/li>\n<li> Izpildes aizsardz\u012bba, mekl\u0113jot izmai\u0146as konteineros un citu aizdom\u012bgu aktivit\u0101ti;<\/li>\n<li> Dabas ugunsm\u016bris konteineriem;<\/li>\n<li> Dro\u0161\u012bba serverless risin\u0101jumiem m\u0101ko\u0146u pakalpojumos;<\/li>\n<li> Atbilst\u012bbas p\u0101rbaude un audits, apvienoti ar notikumu \u017eurn\u0101lu.<\/li>\n<\/ul>\n<p>\n<i><b>Piez\u012bme:<\/b>: V\u0113rts atz\u012bm\u0113t, ka past\u0101v ar\u012b <b>bezmaksas produkta sast\u0101vda\u013ca ar nosaukumu <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/microscanner\">MicroScanner<\/a><\/noindex><\/b>, kas \u013cauj sken\u0113t konteineru att\u0113lus p\u0113c ievainojam\u012bb\u0101m. Sal\u012bdzin\u0101jums ar maksas versij\u0101m ir sniegts <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/microscanner#aqua-security-edition-comparison\">\u0161aj\u0101 tabul\u0101<\/a><\/noindex>.<\/i><\/p>\n<h3>Capsule8<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/\">capsule8.com<\/a><\/noindex><\/li>\n<li> Licences: komerci\u0101la<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/122be33f15d31f8f083189bca5c7158c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nCapsule8 integr\u0113jas infrastrukt\u016br\u0101, uzst\u0101dot detektoru lok\u0101l\u0101 vai m\u0101ko\u0146u Kubernetes klaster\u012b. \u0160is detektors v\u0101ca mitin\u0101\u0161anas un t\u012bkla telemetriju, sal\u012bdzinot to ar da\u017e\u0101diem uzbrukuma veidiem.<\/p>\n<p>Capsule8 komanda uzskata, ka vi\u0146u uzdevums ir laikus atkl\u0101t un nov\u0113rst uzbrukumus, kas izmanto jaunus <i>(0-day)<\/i> ievainojam\u012bbas. Capsule8 sp\u0113j aug\u0161upiel\u0101d\u0113t preciz\u0113tus dro\u0161\u012bbas noteikumus tie\u0161i uz detektoriem k\u0101 atbildi uz nesen atkl\u0101tiem apdraud\u0113jumiem un programmat\u016bras ievainojam\u012bb\u0101m.<\/p>\n<h3>Cavirin<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cavirin.com\/\">www.cavirin.com<\/a><\/noindex><\/li>\n<li> Licences: komerci\u0101la<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/896310c9258943041664ca55b3926d35.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCavirin darbojas k\u0101 pret\u0113j\u0101 puse da\u017e\u0101d\u0101m dro\u0161\u012bbas standartiem atbilsto\u0161\u0101m iest\u0101d\u0113m. Tas ne tikai sp\u0113j sken\u0113t att\u0113lus, bet ar\u012b integr\u0113ties CI\/CD caurpl\u016bsm\u0101, blo\u0137\u0113jot standartiem neatbilsto\u0161us att\u0113lus pirms to non\u0101k\u0161anas sl\u0113gtajos re\u0123istros.<\/p>\n<p>Cavirin dro\u0161\u012bbas pakete izmanto ma\u0161\u012bnm\u0101c\u012b\u0161anos, lai nov\u0113rt\u0113tu kiberdro\u0161\u012bbas st\u0101vokli, pied\u0101v\u0101 ieteikumus dro\u0161\u012bbas uzlabo\u0161anai un standartiem atbilst\u012bbas paaugstin\u0101\u0161anai.<\/p>\n<h3>Google Cloud Security Command Center<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/cloud.google.com\/security-command-center\/\">cloud.google.com\/security-command-center<\/a><\/noindex><\/li>\n<li> Licences: komerci\u0101la<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/d9ac37b3d2b9be7fd6fcd6afe0d985e6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCloud Security Command Center pal\u012bdz dro\u0161\u012bbas komand\u0101m apkopot datus, identific\u0113t apdraud\u0113jumus un nov\u0113rst tos pirms tiem nodara kait\u0113jumu uz\u0146\u0113mumam.<\/p>\n<p>K\u0101 redzams no nosaukuma, Google Cloud SCC ir centraliz\u0113ts kontroles panelis, kur\u0101 var integr\u0113t da\u017e\u0101dus dro\u0161\u012bbas p\u0101rskatus, akt\u012bvu uzskaites meh\u0101nismus un tre\u0161o pu\u0161u dro\u0161\u012bbas sist\u0113mas, k\u0101 ar\u012b p\u0101rvald\u012bt tos no vienota, centraliz\u0113ta avota.<\/p>\n<p>Interoperabls API, ko pied\u0101v\u0101 Google Cloud SCC, atvieglo dro\u0161\u012bbas notikumu integr\u0101ciju no da\u017e\u0101diem avotiem, piem\u0113ram, Sysdig Secure (konteineru dro\u0161\u012bba cloud-native lietojumiem) vai Falco (Open Source izpildes dro\u0161\u012bbas sist\u0113ma).<\/p>\n<h3>Layered Insight (Qualys)<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/layeredinsight.com\/\">layeredinsight.com<\/a><\/noindex><\/li>\n<li> Licences: komerci\u0101la<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/31e0266c670a991824c029f9445cf480.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLayered Insight (tagad da\u013ca no Qualys Inc) ir izstr\u0101d\u0101ts, balstoties uz \"ieb\u016bv\u0113tas dro\u0161\u012bbas\" koncepciju. P\u0113c s\u0101kotn\u0113j\u0101 att\u0113la sken\u0113\u0161anas, lai identific\u0113tu ievainojam\u012bbas, izmantojot statistisk\u0101s anal\u012bzes metodes un CVE p\u0101rbaudes, Layered Insight to aizvieto ar instrument\u0113tu att\u0113lu, kas ietver a\u0123entu k\u0101 bin\u0101ro failu.<\/p>\n<p>\u0160is a\u0123ents ietver dro\u0161\u012bbas testus izpildes laik\u0101, lai analiz\u0113tu konteinera t\u012bkla trafiku, I\/O pl\u016bsmas un lietojumprogrammas darb\u012bbu. Turkl\u0101t tas var veikt papildu dro\u0161\u012bbas p\u0101rbaudes, ko nosaka infrastrukt\u016bras administratori vai DevOps komandas.<\/p>\n<h3>NeuVector<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/neuvector.com\/\">neuvector.com<\/a><\/noindex><\/li>\n<li> Licences: komerci\u0101la<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/db9558498c4c5cd876083d7a5bb41ab4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNeuVector veic konteinera dro\u0161\u012bbas p\u0101rbaudi un nodro\u0161ina runtime aizsardz\u012bbu, analiz\u0113jot t\u012bkla aktivit\u0101ti un lietojumprogrammas uzved\u012bbu, radot individu\u0101lu dro\u0161\u012bbas profilu katram konteineram. Tas ar\u012b var patst\u0101v\u012bgi blo\u0137\u0113t draudus, izol\u0113jot aizdom\u012bgu aktivit\u0101ti, mainot lok\u0101l\u0101 ugunsm\u016bra noteikumus.<\/p>\n<p>NeuVector t\u012bkla integr\u0101cija, kas paz\u012bstama k\u0101 Security Mesh, ir sp\u0113j\u012bga veikt dzi\u013cu pakot\u0146u anal\u012bzi un filtr\u0113\u0161anu 7. l\u012bmen\u012b vis\u0101m t\u012bkla savienojumiem service mesh.<\/p>\n<h3>StackRox<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.stackrox.com\/\">www.stackrox.com<\/a><\/noindex><\/li>\n<li> Licences: komerci\u0101la<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/9b8d013860518fab67e84344eaa1de91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nStackRox konteinera dro\u0161\u012bbas platforma cen\u0161as aptvert visu Kubernetes lietojumprogrammu dz\u012bves ciklu klaster\u012b. T\u0101pat k\u0101 citas komerci\u0101l\u0101s platformas \u0161aj\u0101 sarakst\u0101, StackRox \u0123ener\u0113 izpildes laika profilu balstoties uz nov\u0113rojamo konteinera uzved\u012bbu un autom\u0101tiski br\u012bdina par jebk\u0101d\u0101m novirz\u0113m.<\/p>\n<p>Turkl\u0101t StackRox analiz\u0113 Kubernetes konfigur\u0101cijas, izmantojot CIS Kubernetes un citus noteikumu kopumus, lai nov\u0113rt\u0113tu konteinera atbilst\u012bbu.<\/p>\n<h3>Sysdig Secure<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/\">sysdig.com\/products\/secure<\/a><\/noindex><\/li>\n<li> Licences: komerci\u0101la<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/a36518809970479fe435e505c231eff8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSysdig Secure aizsarg\u0101 lietojumprogrammas vis\u0101 konteinera un Kubernetes dz\u012bves cikl\u0101. Tas <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/image-scanning\/\">skan\u0113 att\u0113lus<\/a><\/noindex> konteineru, nodro\u0161ina <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/runtime-security\/\">izpildes laika aizsardz\u012bbu<\/a><\/noindex> balstoties uz ma\u0161\u012bnm\u0101c\u012b\u0161an\u0101s datiem, veic krimin\u0101listikas ekspert\u012bzi, lai identific\u0113tu ievainojam\u012bbas, blo\u0137\u0113 draudus, uzrauga <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/container-compliance\/\">atbilst\u012bbu noteikumiem<\/a><\/noindex> un veic mikroservisu aktivit\u0101tes rev\u012bziju.<\/p>\n<p>Sysdig Secure integr\u0113jas ar CI\/CD r\u012bkiem, piem\u0113ram, Jenkins, un uzrauga att\u0113lus, kas tiek iel\u0101d\u0113ti no Docker re\u0123istra, nov\u0113r\u0161ot b\u012bstamu att\u0113lu par\u0101d\u012b\u0161anos ra\u017eo\u0161an\u0101. Tas ar\u012b nodro\u0161ina visaptvero\u0161u izpildes laika dro\u0161\u012bbu, tostarp:<\/p>\n<ul>\n<li> izpildes laika profil\u0113\u0161anu, balstoties uz ML, un anom\u0101liju atkl\u0101\u0161anu;<\/li>\n<li> darbpl\u0101na politikas, balst\u012btas uz sist\u0113mas notikumiem, K8s-audit API, kopienas sadarb\u012bbas projektiem (FIM \u2014 failu integrit\u0101tes uzraudz\u012bba; kriptoval\u016btu z\u0101dz\u012bba) un ietvaru <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/blog\/mitre-attck-framework-for-container-runtime-security-with-sysdig-falco\/\">MITRE ATT&amp;CK<\/a><\/noindex>;<\/li>\n<li> incidentu reakcija un nov\u0113r\u0161ana.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Tenable konteineru dro\u0161\u012bba<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/products\/tenable-io\/container-security\">www.tenable.com\/products\/tenable-io\/container-security<\/a><\/noindex><\/li>\n<li> Licences: komerci\u0101la<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/2b3799ee94628c04104f6cead8be8749.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPirms konteineru par\u0101d\u012b\u0161an\u0101s Tenable bija pla\u0161i paz\u012bstama nozares k\u0101 uz\u0146\u0113mums, kas izstr\u0101d\u0101ja Nessus \u2014 popul\u0101ru r\u012bku ievainojam\u012bbu mekl\u0113\u0161anai un dro\u0161\u012bbas auditiem.<\/p>\n<p>Tenable konteineru dro\u0161\u012bba izmanto uz\u0146\u0113muma pieredzi datoru dro\u0161\u012bb\u0101, lai integr\u0113tu CI\/CD caurules ar ievainojam\u012bbu datub\u0101z\u0113m, specializ\u0113t\u0101m \u013caunprogrammat\u016bras atkl\u0101\u0161anas pakotn\u0113m un dro\u0161\u012bbas draudu nov\u0113r\u0161anas ieteikumiem.<\/p>\n<h3>Twistlock (Palo Alto Networks)<\/h3>\n<p><\/p>\n<ul>\n<li> M\u0101jaslapa: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.twistlock.com\/\">www.twistlock.com<\/a><\/noindex><\/li>\n<li> Licences: komerci\u0101la<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ Kubernetes dro\u0161\u012bbas r\u012bki\" src=\"\/wp-content\/uploads\/2019\/09\/98213c84bafaeca1e0d6bca3e1a80d23.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTwistlock sevi reklam\u0113 k\u0101 platformu, kas v\u0113rsta uz m\u0101ko\u0146servisiem un konteineriem. Twistlock atbalsta da\u017e\u0101dus m\u0101ko\u0146pakalpojumu sniedz\u0113jus (AWS, Azure, GCP), konteineru or\u0137estratorus (Kubernetes, Mesosphere, OpenShift, Docker), bez-servera izpildes vidus, mezglu ietvarus un CI\/CD r\u012bkus.<\/p>\n<p>Papildus parastajiem korporat\u012bv\u0101s dro\u0161\u012bbas pa\u0146\u0113mieniem, piem\u0113ram, integr\u0101ciju CI\/CD caurul\u0113 vai att\u0113lu sken\u0113\u0161anai, Twistlock izmanto ma\u0161\u012bnm\u0101c\u012b\u0161anos, lai \u0123ener\u0113tu uzved\u012bbas paraugus un t\u012bkla noteikumus, kas \u0146em v\u0113r\u0101 konteineru \u012bpatn\u012bbas.<\/p>\n<p>Neilgi p\u0113c tam Twistlock ieg\u0101d\u0101j\u0101s Palo Alto Networks, kuram pieder projekti Evident.io un RedLock. V\u0113l nav skaidrs, k\u0101 tie\u0161i \u0161\u012bs tr\u012bs platformas tiks integr\u0113tas <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/cloud-security\">PRISMA<\/a><\/noindex> no Palo Alto.<\/p>\n<h2>Pal\u012bdzi izveidot lab\u0101ko Kubernetes dro\u0161\u012bbas r\u012bku katalogu!<\/h2>\n<p>\nM\u0113s cen\u0161amies padar\u012bt \u0161o katalogu p\u0113c iesp\u0113jas piln\u012bg\u0101ku, un tam mums nepiecie\u0161ama j\u016bsu pal\u012bdz\u012bba! Sazinieties ar mums (<noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/sysdig\">@sysdig<\/a><\/noindex>), ja jums ir k\u0101ds for\u0161s r\u012bks, ko v\u0113rts iek\u013caut \u0161aj\u0101 sarakst\u0101, vai esat atradis k\u013c\u016bdu\/novecoju\u0161u inform\u0101ciju.<\/p>\n<p>J\u016bs varat ar\u012b pierakst\u012bties m\u016bsu <noindex><a rel=\"nofollow\" href=\"https:\/\/go.sysdig.com\/container-newsletter-signup.html\">m\u0113ne\u0161a bi\u013cetenam<\/a><\/noindex> ar jaunumiem cloud-native ekosist\u0113m\u0101 un st\u0101stiem par interesantiem projektiem no Kubernetes dro\u0161\u012bbas pasaules.<\/p>\n<h2>P.S. no tulka<\/h2>\n<p>\nLasiet ar\u012b m\u016bsu emu\u0101ra rakstos:<\/p>\n<ul>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443190\/\">Kubernetes t\u012bklu politiku ievads dro\u0161\u012bbas speci\u0101listiem<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440504\/\">Docker un Kubernetes dro\u0161\u012bbas pras\u012bg\u0101s vid\u0113s<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/436300\/\">9 lab\u0101k\u0101s prakses dro\u0161\u012bbas nodro\u0161in\u0101\u0161anai Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/417905\/\">11 veidi, k\u0101 (ne) k\u013c\u016bt par uzlau\u0161anas upuri Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/353808\/\">OPA un SPIFFE \u2014 divi jauni projekti CNCF dro\u0161\u012bbas jom\u0101 m\u0101ko\u0146u lietojumprogramm\u0101m<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Avots: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/465141\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0415\u0441\u043b\u0438 \u0432\u044b \u0437\u0430\u0434\u0430\u0451\u0442\u0435\u0441\u044c \u0432\u043e\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Kubernetes, \u044d\u0442\u043e\u0442 \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0437\u043e\u0440 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Sysdig \u0441\u0442\u0430\u043d\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u043d\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0434\u043b\u044f \u0431\u0435\u0433\u043b\u043e\u0433\u043e \u0437\u043d\u0430\u043a\u043e\u043c\u0441\u0442\u0432\u0430 \u0441 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u044f\u043c\u0438. \u0412 \u043d\u0435\u0433\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u0433\u0440\u043e\u043a\u043e\u0432 \u0440\u044b\u043d\u043a\u0430, \u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u0441\u043a\u0440\u043e\u043c\u043d\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0442\u0443 \u0438\u043b\u0438 \u0438\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0410 \u0432 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u043c\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28890,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38497","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"lv_LV\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4733+ \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Kubernetes | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:24:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:24:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4733+ r\u012bki Kubernetes dro\u0161\u012bbai | ProHoster","description":"Piez.","canonical_url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"lv_LV","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4733+ \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Kubernetes | ProHoster","og:description":"\u041f\u0440\u0438\u043c.","og:url":"https:\/\/prohoster.info\/lv\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:24:06+00:00","article:modified_time":"2019-10-31T19:24:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38497","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 22:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:08:31","updated":"2026-01-23 22:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/38497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/comments?post=38497"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/posts\/38497\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media\/28890"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/media?parent=38497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/categories?post=38497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/lv\/wp-json\/wp\/v2\/tags?post=38497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}