{"id":38497,"date":"2019-10-31T22:24:06","date_gmt":"2019-10-31T19:24:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/33-instrumenta-dlya-bezopasnosti-kubernetes\/"},"modified":"2019-10-31T22:24:06","modified_gmt":"2019-10-31T19:24:06","slug":"33-instrumenta-dlya-bezopasnosti-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","title":{"rendered":"33+ alata za bezbednost Kubernetes-a","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i><b>Op. prev.<\/b>: \u010ce se spra\u0161ujete o varnosti v infrastrukturi, ki temelji na Kubernetesu, bo ta odli\u010den pregled podjetja Sysdig odli\u010dna izhodi\u0161\u010dna to\u010dka za spoznavanje aktualnih re\u0161itev. Vklju\u010deni so tako celoviti sistemi znanih tr\u017enih ponudnikov kot tudi precej skromnej\u0161a orodja, ki pokrivajo dolo\u010dene probleme. V komentarjih pa bomo, kot vedno, veseli va\u0161ih izku\u0161enj z uporabo teh orodij in povezav do drugih projektov.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/4d9aa6583128844afadc1b06996c29b6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nProgramski izdelki za zagotavljanje varnosti Kubernetes\u2026 je tako veliko, vsak ima svoje cilje, podro\u010dje uporabe in licence.<\/p>\n<p>Zato smo se odlo\u010dili, da ustvarimo ta seznam in vanj vklju\u010dimo tako odprtokodne projekte kot komercialne platforme razli\u010dnih ponudnikov. Upamo, da vam bo pomagal izbrati najzanimivej\u0161e ter vas usmeril v pravo smer glede na konkretne potrebe po zagotavljanju varnosti Kubernetes.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Kategorije<\/h2>\n<p>\nZa la\u017eje navigacijo po seznamu so orodja razdeljena po glavnih funkcijah in podro\u010djih uporabe. Ustvarili smo naslednje oddelke:<\/p>\n<ul>\n<li> Skeniranje slik Kubernetes in stati\u010dna analiza;<\/li>\n<li> Varnost med izvajanjem;<\/li>\n<li> Mre\u017ena varnost Kubernetes;<\/li>\n<li> Distribucija slik in upravljanje s skrivnostmi;<\/li>\n<li> Revizija varnosti Kubernetes;<\/li>\n<li> Celoviti komercialni izdelki.<\/li>\n<\/ul>\n<p>\nPojdimo k stvari:<\/p>\n<h2>Skeniranje slik Kubernetes<\/h2>\n<p><\/p>\n<h3>Anchore<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/anchore.com\">anchore.com<\/a><\/noindex><\/li>\n<li> Licenca: prosta (Apache) in komercialna ponudba<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/2c942e5a104feb4840a426157d5457f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPaketi Anchore analizirajo slike kontejnerjev in omogo\u010dajo izvajanje varnostnih preverjanj na podlagi politik, ki jih dolo\u010di uporabnik.<\/p>\n<p>Poleg obi\u010dajnega skeniranja slik kontejnerjev na znane ranljivosti iz baze CVE, Anchore izvaja \u0161tevilne dodatne preglede v okviru politike skeniranja: preverja Dockerfile, morebitne uhajanja poverilnic, pakete uporabljenih programskih jezikov (npm, maven itd.), licence programske opreme in \u0161e ve\u010d.<\/p>\n<h3>Clair<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/coreos.com\/clair\">coreos.com\/clair<\/a><\/noindex> <i>(zdaj pod okriljem Red Hata)<\/i><\/li>\n<li> Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/81be8927c1fcbfa5d714836a1db3c7d8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nClair je bil eden prvih odprtokodnih projektov za skeniranje slik. \u0160iroko je znan kot varnostni skener, ki le\u017ei v zalo\u017ebi slik Quay <i>(prav tako od CoreOS \u2014 <b>op. prev.<\/b>)<\/i>Clair zbira informacije o CVE iz velikog broja izvora, uklju\u010duju\u0107i liste specifi\u010dne za Linux distribucije ranjivosti koje vode sigurnosni timovi Debian, Red Hat ili Ubuntu.<\/p>\n<p>Za razliku od Anchore, Clair se uglavnom bavi pronalaskom ranjivosti i uskla\u0111ivanjem podataka sa CVE. Ipak, proizvod korisnicima nudi odre\u0111ene mogu\u0107nosti za pro\u0161irenje funkcionalnosti putem dodatnih drajvera.<\/p>\n<h3>Dagda<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/eliasgranderubio\/dagda\">github.com\/eliasgranderubio\/dagda<\/a><\/noindex><\/li>\n<li> Licenca: slobodna (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/242930fcb99017f80f7cfc2a676e16ef.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDagda provodi stati\u010dku analizu slika kontejnera u potrazi za poznatim ranjivostima, trojanskim konjima, virusima, malverom i drugim pretnjama.<\/p>\n<p>Dve istaknute karakteristike paketa Dagda koje ga izdvajaju od drugih sli\u010dnih alata su:<\/p>\n<ul>\n<li> Odli\u010dno se integri\u0161e sa <noindex><a rel=\"nofollow\" href=\"https:\/\/www.clamav.net\/\">ClamAV<\/a><\/noindex>, deluju\u0107i ne samo kao alat za skeniranje slika kontejnera, ve\u0107 i kao antivirus.<\/li>\n<li> Tako\u0111e obezbe\u0111uje runtime za\u0161titu, u realnom vremenu primaju\u0107i doga\u0111aje od Docker demona i integri\u0161u\u0107i se sa Falco <i>(\u0441\u043c. \u043d\u0438\u0436\u0435)<\/i> za prikupljanje bezbednosnih doga\u0111aja tokom rada kontejnera.<\/li>\n<\/ul>\n<p><\/p>\n<h3>KubeXray<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jfrog\/kubexray\">github.com\/jfrog\/kubexray<\/a><\/noindex><\/li>\n<li> Licenca: slobodna (Apache), ali zahteva pristup podacima iz JFrog Xray (komercijalni proizvod)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/f3aafb0d694b810fd5a7046c270e3b4d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubeXray \u00ab\u0441\u043b\u0443\u0448\u0430\u0435\u0442\u00bb \u0441\u043e\u0431\u044b\u0442\u0438\u044f API-\u0441\u0435\u0440\u0432\u0435\u0440\u0430 Kubernetes \u0438 \u0441 \u043f\u043e\u043c\u043e\u0449\u044c\u044e \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u043e\u0442 JFrog Xray \u0441\u043b\u0435\u0434\u0438\u0442 \u0437\u0430 \u0442\u0435\u043c, \u0447\u0442\u043e\u0431\u044b \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u043b\u0438\u0441\u044c \u0442\u043e\u043b\u044c\u043a\u043e pod&#8217;\u044b, \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0443\u044e\u0449\u0438\u0435 \u0442\u0435\u043a\u0443\u0449\u0435\u0439 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0435.<\/p>\n<p>KubeXray \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442 \u0430\u0443\u0434\u0438\u0442 \u043d\u043e\u0432\u044b\u0445 \u0438\u043b\u0438 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u0445 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0432 deployment&#8217;\u0430\u0445 (\u043f\u043e \u0430\u043d\u0430\u043b\u043e\u0433\u0438\u0438 \u0441 admission controller \u0432 Kubernetes), \u043d\u043e \u0442\u0430\u043a\u0436\u0435 \u0434\u0438\u043d\u0430\u043c\u0438\u0447\u0435\u0441\u043a\u0438 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0435\u0442 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0449\u0438\u0435 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b \u043d\u0430 \u0441\u043e\u043e\u0442\u0432\u0435\u0442\u0441\u0442\u0432\u0438\u0435 \u043d\u043e\u0432\u044b\u043c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u043c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u0443\u0434\u0430\u043b\u044f\u044f \u0440\u0435\u0441\u0443\u0440\u0441\u044b, \u0441\u0441\u044b\u043b\u0430\u044e\u0449\u0438\u0435\u0441\u044f \u043d\u0430 \u0443\u044f\u0437\u0432\u0438\u043c\u044b\u0435 \u043e\u0431\u0440\u0430\u0437\u044b.<\/p>\n<h3>Snyk<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/snyk.io\/\">snyk.io<\/a><\/noindex><\/li>\n<li> Licenca: slobodna (Apache) i komercijalne verzije<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/a36ded26e3a659474c1c154bc3e753bb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSnyk je neobi\u010dan skener ranjivosti u smislu da je posebno usmeren na proces razvoja i promovi\u0161e se kao \u201enezamenljivo re\u0161enje\u201c za programere.<\/p>\n<p>Snyk se direktno povezuje sa repozitorijumima koda, razdvaja manifest projekta i analizira uvezen kod uz direktne i indirektne zavisnosti. Snyk podr\u017eava mnoge popularne programske jezike i mo\u017ee otkriti skrivene licence rizike.<\/p>\n<h3>Trivy<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/knqyf263\/trivy\">github.com\/knqyf263\/trivy<\/a><\/noindex><\/li>\n<li> Licenca: slobodna (AGPL)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/b21dd72d590d719a7d13741117002999.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTrivy \u2014 en enkel, men kraftig s\u00e5rbarhetsskanner for containere, lett integrerbar i CI\/CD-pipelines. Dets bemerkelsesverdige trekk er enkel installasjon og bruk: applikasjonen best\u00e5r av en enkelt bin\u00e6rfil og krever ikke installasjon av en database eller ekstra biblioteker.<\/p>\n<p>Den bakside av Trivys enkelhet er at man m\u00e5 forst\u00e5 hvordan man parser og sender resultater i JSON-format, slik at andre sikkerhetsverkt\u00f8y for Kubernetes kan bruke dem.<\/p>\n<h2>Runtime sikkerhet i Kubernetes<\/h2>\n<p><\/p>\n<h3>Falco<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/falco.org\/\">falco.org<\/a><\/noindex><\/li>\n<li> Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/0e2601a1ec4ec56ed9daea5f34f36e9a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFalco \u2014 et verkt\u00f8ysett for \u00e5 sikre skybaserte runtime-milj\u00f8er. Det er en del av prosjektfamilien <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cncf.io\/sandbox-projects\/\">CNCF<\/a><\/noindex>.<\/p>\n<p>Ved \u00e5 bruke Sysdig-verkt\u00f8yene til \u00e5 arbeide p\u00e5 Linux-kjerneniv\u00e5 og profilere systemkall, gj\u00f8r Falco det mulig \u00e5 dykke dypt inn i systemets oppf\u00f8rsel. Dets runtime-regelmekanisme kan oppdage mistenkelig aktivitet i applikasjoner, containere, vertsprogramvare og Kubernetes-orchestrator.<\/p>\n<p>Falco \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u0435\u0442 \u043f\u043e\u043b\u043d\u0443\u044e \u043f\u0440\u043e\u0437\u0440\u0430\u0447\u043d\u043e\u0441\u0442\u044c \u0432 \u0440\u0430\u0431\u043e\u0442\u0435 runtime&#8217;\u0430 \u0438 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u0438\u0435 \u0443\u0433\u0440\u043e\u0437, \u0441\u0442\u0430\u0432\u044f \u0434\u043b\u044f \u044d\u0442\u0438\u0445 \u0446\u0435\u043b\u0435\u0439 \u0441\u043f\u0435\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0445 \u0430\u0433\u0435\u043d\u0442\u043e\u0432 \u043d\u0430 \u0443\u0437\u043b\u0430\u0445 Kubernetes. \u0412 \u0440\u0435\u0437\u0443\u043b\u044c\u0442\u0430\u0442\u0435 \u043e\u0442\u043f\u0430\u0434\u0430\u0435\u0442 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u044c \u043c\u043e\u0434\u0438\u0444\u0438\u0446\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b, \u0432\u043d\u0435\u0434\u0440\u044f\u044f \u0432 \u043d\u0438\u0445 \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0439 \u043a\u043e\u0434 \u0438\u043b\u0438 \u043d\u0430\u0432\u0435\u0448\u0438\u0432\u0430\u044f sidecar-\u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b.<\/p>\n<h3>Linux sikkerhetsrammeverk for runtime<\/h3>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/18f219ca98e481376265b753b638a7ec.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDisse kjern.native rammeverkene er ikke \"Kubernetes sikkerhetsverkt\u00f8y\" i vanlig forstand, men fortjener omtale, da de er en viktig del av sikkerhet i runtime som er inkludert i Kubernetes Pod Security Policy (PSP).<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/gitlab.com\/apparmor\/apparmor\/wikis\/home\/\">AppArmor<\/a><\/noindex> tilknytter sikkerhetsprofilen til prosesser som kj\u00f8rer i containeren, og definerer filsystemprivilegier, regler for nettverkstilgang, tilkobling av biblioteker, osv. Dette er et system basert p\u00e5 mandatforvaltning (Mandatory Access Control, MAC). Med andre ord, det forhindrer utf\u00f8relse av forbudte handlinger.<\/p>\n<p>Security-Enhanced Linux (<noindex><a rel=\"nofollow\" href=\"https:\/\/selinuxproject.org\/page\/Main_Page\">SELinux<\/a><\/noindex>) er et modul for utvidet sikkerhet i Linux-kjernen, som p\u00e5 noen omr\u00e5der ligner p\u00e5 AppArmor og ofte sammenlignes med det. SELinux overg\u00e5r AppArmor i kraft, fleksibilitet og granul\u00e6r konfigurasjon. Dets ulemper er lang l\u00e6ringskurve og \u00f8kt kompleksitet.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/seccomp\/libseccomp\">Seccomp<\/a><\/noindex> in seccomp-bpf omogo\u010dajo filtriranje sistemskih klicev, blokiranje izvajanja tistih, ki so potencialno nevarni za osnovni OS in niso potrebni za normalno delovanje uporabni\u0161kih aplikacij. Seccomp je v nekaterih pogledih podoben Falu, \u010deprav ne pozna posebnosti kontejnerjev.<\/p>\n<h3>Sysdig open source<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sysdig.com\/opensource\">www.sysdig.com\/opensource<\/a><\/noindex><\/li>\n<li> Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/4f8849a6cc819cef89f10ab80911c504.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSysdig je celovit pripomo\u010dek za analizo, diagnostiko in odpravljanje te\u017eav v sistemih Linux (deluje tudi na Windows in macOS, vendar z omejenimi funkcijami). Uporablja se lahko za zbiranje podrobnih informacij, preverjanje in forenzi\u010dno preiskavo <i>(forensics)<\/i> osnovnega sistema in vseh kontejnerjev, ki delujejo na njem.<\/p>\n<p>Sysdig poleg tega prvotno podpira izvr\u0161ne okolje za kontejnere in metapodatke Kubernetes, dodaja dodatne dimenzije in oznake v vse zbirane informacije o obna\u0161anju sistema. Obstaja ve\u010d na\u010dinov za analizo Kubernetes klasterja s pomo\u010djo Sysdig: lahko izvedete zajem ob dolo\u010denem trenutku preko <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sysdiglabs\/kubectl-capture\">kubectl capture<\/a><\/noindex> ali za\u017eenete interaktivni vmesnik na osnovi ncurses z uporabo vti\u010dnika <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sysdiglabs\/kubectl-dig\">kubectl dig<\/a><\/noindex>.<\/p>\n<h2>Kubernetes mre\u017ena varnost<\/h2>\n<p><\/p>\n<h3>Aporeto<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aporeto.com\/\">www.aporeto.com<\/a><\/noindex><\/li>\n<li> Licenca: komercialna<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/9692c50339a6c304c7f32f90619aaed1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAporeto nudi 'varnost, lo\u010deno od mre\u017ee in infrastrukture'. To pomeni, da storitve Kubernetes ne dobijo le lokalni ID (tj. ServiceAccount v Kubernetes), temve\u010d tudi splo\u0161ni identifikator\/odtis, ki se lahko uporablja za varno in medsebojno preverjanje z drugimi storitvami, na primer v klasterju OpenShift.<\/p>\n<p>Aporeto je sposoben generirati edinstven identifikator ne le za Kubernetes\/kontejnerje, temve\u010d tudi za gostitelje, obla\u010dne funkcije in uporabnike. Odvisno od teh identifikatorjev in niza pravil mre\u017ene varnosti, ki jih nastavi skrbnik, bodo komunikacije omogo\u010dene ali blokirane.<\/p>\n<h3>Calico<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.projectcalico.org\/\">www.projectcalico.org<\/a><\/noindex><\/li>\n<li> Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/5902a133d4afc496f035de0f63129f99.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCalico \u043e\u0431\u044b\u0447\u043d\u043e \u0440\u0430\u0437\u0432\u043e\u0440\u0430\u0447\u0438\u0432\u0430\u044e\u0442 \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0438 \u043e\u0440\u043a\u0435\u0441\u0442\u0440\u0430\u0442\u043e\u0440\u0430 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u0447\u0442\u043e \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u0435\u0442 \u0441\u043e\u0437\u0434\u0430\u0442\u044c \u0432\u0438\u0440\u0442\u0443\u0430\u043b\u044c\u043d\u0443\u044e \u0441\u0435\u0442\u044c, \u0441\u0432\u044f\u0437\u044b\u0432\u0430\u044e\u0449\u0443\u044e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u044b. \u041f\u043e\u043c\u0438\u043c\u043e \u044d\u0442\u043e\u0439 \u0431\u0430\u0437\u043e\u0432\u043e\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0444\u0443\u043d\u043a\u0446\u0438\u043e\u043d\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u0438 \u043f\u0440\u043e\u0435\u043a\u0442 Calico \u0440\u0430\u0431\u043e\u0442\u0430\u0435\u0442 \u0441 Kubernetes Network Policies \u0438 \u0441\u0432\u043e\u0438\u043c \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u044b\u043c \u043d\u0430\u0431\u043e\u0440\u043e\u043c \u043f\u0440\u043e\u0444\u0438\u043b\u0435\u0439 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438, \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 ACL (\u0441\u043f\u0438\u0441\u043a\u0438 \u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430) endpoint&#8217;\u043e\u0432 \u0438 \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u044b\u0435 \u043d\u0430 \u0430\u043d\u043d\u043e\u0442\u0430\u0446\u0438\u044f\u0445 \u043f\u0440\u0430\u0432\u0438\u043b\u0430 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f Ingress- \u0438 Egress-\u0442\u0440\u0430\u0444\u0438\u043a\u0430.<\/p>\n<h3>Cilium<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cilium.io\/\">www.cilium.io<\/a><\/noindex><\/li>\n<li> Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/2a9f3d1de52936c2f1a06d96fab054fb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCilium slu\u017ei kot po\u017earni zid za kontejnere in zagotavlja funkcije za zagotavljanje omre\u017ene varnosti, ki so prvotno prilagojene Kubernetesu in delovnim obremenitvam mikroservisov. Cilium uporablja novo tehnologijo jedra Linux, imenovano BPF (Berkeley Packet Filter), za filtriranje, spremljanje, preusmerjanje in prilagajanje podatkov.<\/p>\n<p>Cilium \u0441\u043f\u043e\u0441\u043e\u0431\u0435\u043d \u0440\u0430\u0437\u0432\u0435\u0440\u0442\u044b\u0432\u0430\u0442\u044c \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0441\u0435\u0442\u0435\u0432\u043e\u0433\u043e \u0434\u043e\u0441\u0442\u0443\u043f\u0430 \u043d\u0430 \u043e\u0441\u043d\u043e\u0432\u0435 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440\u043e\u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432, \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044f \u043c\u0435\u0442\u043a\u0438 Docker \u0438\u043b\u0438 Kubernetes \u0438 \u043c\u0435\u0442\u0430\u0434\u0430\u043d\u043d\u044b\u0435. Cilium \u0442\u0430\u043a\u0436\u0435 \u043f\u043e\u043d\u0438\u043c\u0430\u0435\u0442 \u0438 \u0444\u0438\u043b\u044c\u0442\u0440\u0443\u0435\u0442 \u0440\u0430\u0437\u043b\u0438\u0447\u043d\u044b\u0435 \u043f\u0440\u043e\u0442\u043e\u043a\u043e\u043b\u044b 7-\u0433\u043e \u0443\u0440\u043e\u0432\u043d\u044f, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a HTTP \u0438\u043b\u0438 gRPC, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044f \u043e\u043f\u0440\u0435\u0434\u0435\u043b\u044f\u0442\u044c \u043d\u0430\u0431\u043e\u0440 \u0432\u044b\u0437\u043e\u0432\u043e\u0432 REST, \u043a\u043e\u0442\u043e\u0440\u044b\u0435, \u043d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u0431\u0443\u0434\u0443\u0442 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u044b \u043c\u0435\u0436\u0434\u0443 \u0434\u0432\u0443\u043c\u044f deployment&#8217;\u0430\u043c\u0438 Kubernetes.<\/p>\n<h3>Istio<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/\">istio.io<\/a><\/noindex><\/li>\n<li> Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/da9e18500fffdf2c310182a4820c722d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIstio je \u0161iroko znan kot uresni\u010ditev paradigme omre\u017ene mre\u017ee (service mesh) z uvedbo neodvisne kontrolne plo\u0161\u010de in preusmerjanjem vsega upravljanega servisnega prometa skozi dinami\u010dno konfigurirane proksije Envoy. Istio koristi to napredno predstavitev vseh mikroservisov in kontejnerjev za izvajanje razli\u010dnih strategij omre\u017ene varnosti.<\/p>\n<p>Zmo\u017enosti Istio za zagotavljanje omre\u017ene varnosti vklju\u010dujejo prozorno \u0161ifriranje TLS za samodejno nadgradnjo komunikacijskega protokola med mikroservisi na HTTPS in svojo lastno sistem RBAC za identifikacijo in avtentikacijo za dovoljevanje\/zaklju\u010ditev izmenjave podatkov med razli\u010dnimi delovnimi obremenitvami v grozdu.<\/p>\n<p><i><b>Op. prev.<\/b>: Ve\u010d o funkcijah Istio, osredoto\u010denih na varnost, najdete v <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443668\/\">this article<\/a><\/noindex>.<\/i><\/p>\n<h3>Tigera<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tigera.io\/\">www.tigera.io<\/a><\/noindex><\/li>\n<li> Licenca: komercialna<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/3568cf2fc634d4c40c45f0db4a08aa77.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nV tem re\u0161enju, imenovanem 'po\u017earni zid Kubernetes', se osredoto\u010da na pristop k omre\u017eni varnosti z ni\u010delnim zaupanjem.<\/p>\n<p>Podobno kot druge re\u0161itve, ki so zna\u010dilne za Kubernetes, Tigera uporablja metapodatke za identifikacijo razli\u010dnih servisov in objektov v grozdu ter zagotavlja odkrivanje te\u017eav v runtime-u, neprekinjeno preverjanje skladnosti in preglednost omre\u017eja za ve\u010doblake ali hibridne monolitne-kontejnerizirane infrastrukture.<\/p>\n<h3>Trireme<\/h3>\n<p><\/p>\n<ul>\n<li>Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aporeto.com\/opensource\/\">www.aporeto.com\/opensource<\/a><\/noindex><\/li>\n<li>Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/5924b4c2a0f6324e9d946c0261cbc53f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTrireme-Kubernetes je enostavna in razumljiva implementacija specifikacije Kubernetes Network Policies. Najopaznej\u0161a zna\u010dilnost je, da \u2014 v nasprotju s podobnimi izdelki za omre\u017eno varnost Kubernetes \u2014 ne zahteva osrednjega kontrolnega sistema za usklajevanje mre\u017ee (mesh). To naredi re\u0161itev izjemno enostavno raz\u0161irljivo. V Trireme je to dose\u017eeno z namestitvijo agenta na vsak vozli\u0161\u010d, ki se neposredno povezuje na TCP\/IP stek hostinga.<\/p>\n<h2>Distribucija slik in upravljanje skrivnosti<\/h2>\n<p><\/p>\n<h3>Grafeas<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/grafeas.io\/\">grafeas.io<\/a><\/noindex><\/li>\n<li> Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/92c9986b36991d280cce0b1093e1938f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGrafeas je API z odprto kodo za revizijo in upravljanje oskrbne verige programske opreme. Na osnovni ravni je Grafeas orodje za zbiranje metapodatkov in povzetkov revizij. Uporabiti ga je mogo\u010de za sledenje skladnosti z najbolj\u0161imi praksami na podro\u010dju varnosti v organizaciji.<\/p>\n<p>Ta centraliziran vir resnice pomaga odgovoriti na vpra\u0161anja, kot so:<\/p>\n<ul>\n<li> Kdo je zbral in podpisal dolo\u010den kontejner?<\/li>\n<li> Ali je prestal vse varnostne skenerje in preglede, predvidene v varnostni politiki? Kdaj? Kak\u0161ni so bili rezultati? <\/li>\n<li> Kdo ga je razporedil v produkcijo? Katere specifi\u010dne nastavitve so bile uporabljene pri razporejanju?<\/li>\n<\/ul>\n<p><\/p>\n<h3>In-toto<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/in-toto.github.io\/\">in-toto.github.io<\/a><\/noindex><\/li>\n<li> Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/91f0ba618f41dbadb07b37ec6999a736.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIn-toto je okvir, razvito za zagotavljanje celovitosti, avtenti\u010dnosti in revizije celotne oskrbne verige programske opreme. Pri razporeditvi In-toto v infrastrukturi se najprej dolo\u010di na\u010drt, ki opisuje razli\u010dne korake v pipeline-u (repozitorij, CI\/CD orodja, QA orodja, zbiralci artefaktov itd.) in uporabnike (odgovorne osebe), ki so upravi\u010deni k njihovemu zagonu.<\/p>\n<p>In-toto spremlja izvajanje na\u010drta tako, da preverja, da se vsaka naloga v verigi izvaja pravilno izklju\u010dno s poobla\u0161\u010denim osebjem in da med premikom s produktom niso bile opravljene nobene nepoobla\u0161\u010dene manipulacije.<\/p>\n<h3>Portieris<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/IBM\/portieris\">github.com\/IBM\/portieris<\/a><\/noindex><\/li>\n<li> Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/ff9c24c88cd9a06c8bd35dfe4f3558cf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPortieris je kontroler sprejema za Kubernetes; uporablja se za izvajanje obveznih preverjanj zaupanja do vsebine. Portieris uporablja stre\u017enik <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/theupdateframework\/notary\">Notary<\/a><\/noindex> <i>(o katerem smo pisali na koncu <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/340366\/\">ovog \u010dlanka<\/a><\/noindex> \u2014 <b>op. prev.<\/b>)<\/i> kot vir resnice za potrditev zaupanja vrednih in podpisanih artefaktov (tj. odobrenih slik kontejnerjev).<\/p>\n<p>\u041f\u0440\u0438 \u0441\u043e\u0437\u0434\u0430\u043d\u0438\u0438 \u0438\u043b\u0438 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u0438 \u0440\u0430\u0431\u043e\u0447\u0435\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438 \u0432 Kubernetes Portieris \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u0435\u0442 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u044e \u043e \u043f\u043e\u0434\u043f\u0438\u0441\u0438 \u0438 \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0443 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u043a \u043a\u043e\u043d\u0442\u0435\u043d\u0442\u0443 \u0434\u043b\u044f \u0437\u0430\u043f\u0440\u043e\u0448\u0435\u043d\u043d\u044b\u0445 \u043e\u0431\u0440\u0430\u0437\u043e\u0432 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u043e\u0432 \u0438 \u043f\u0440\u0438 \u043d\u0435\u043e\u0431\u0445\u043e\u0434\u0438\u043c\u043e\u0441\u0442\u0438 \u0432\u043d\u043e\u0441\u0438\u0442 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u0432 JSON-\u043e\u0431\u044a\u0435\u043a\u0442 API \u0434\u043b\u044f \u0437\u0430\u043f\u0443\u0441\u043a\u0430 \u043f\u043e\u0434\u043f\u0438\u0441\u0430\u043d\u043d\u044b\u0445 \u0432\u0435\u0440\u0441\u0438\u0439 \u044d\u0442\u0438\u0445 \u043e\u0431\u0440\u0430\u0437\u043e\u0432.<\/p>\n<h3>Vault<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.vaultproject.io\/\">www.vaultproject.io<\/a><\/noindex><\/li>\n<li> \u041b\u0438\u0446\u0435\u043d\u0437\u0438\u044f: \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u0430\u044f (MPL)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/19191a10051dc6349af017a06f0fd43e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVault \u2014 \u044d\u0442\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0435 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u0434\u043b\u044f \u0445\u0440\u0430\u043d\u0435\u043d\u0438\u044f \u0437\u0430\u043a\u0440\u044b\u0442\u043e\u0439 \u0438\u043d\u0444\u043e\u0440\u043c\u0430\u0446\u0438\u0438: \u043f\u0430\u0440\u043e\u043b\u0435\u0439, \u0442\u043e\u043a\u0435\u043d\u043e\u0432 OAuth, PKI-\u0441\u0435\u0440\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0432, \u0443\u0447\u0451\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439 \u0434\u043b\u044f \u0434\u043e\u0441\u0442\u0443\u043f\u0430, \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 Kubernetes \u0438 \u0442.\u0434. Vault \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u043c\u043d\u043e\u0433\u0438\u0435 \u043f\u0440\u043e\u0434\u0432\u0438\u043d\u0443\u0442\u044b\u0435 \u0444\u0443\u043d\u043a\u0446\u0438\u0438, \u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u0430\u0440\u0435\u043d\u0434\u0430 \u044d\u0444\u0435\u043c\u0435\u0440\u043d\u044b\u0445 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0438\u043b\u0438 \u043e\u0440\u0433\u0430\u043d\u0438\u0437\u0430\u0446\u0438\u044f \u0440\u043e\u0442\u0430\u0446\u0438\u0438 \u043a\u043b\u044e\u0447\u0435\u0439.<\/p>\n<p>\u0421 \u043f\u043e\u043c\u043e\u0449\u044c\u044e Helm-\u0447\u0430\u0440\u0442\u0430 Vault \u043c\u043e\u0436\u043d\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c \u043a\u0430\u043a \u043d\u043e\u0432\u044b\u0439 deployment \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435 Kubernetes \u0441 Consul&#8217;\u043e\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 backend-\u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430. \u041e\u043d \u043f\u043e\u0434\u0434\u0435\u0440\u0436\u0438\u0432\u0430\u0435\u0442 \u0440\u043e\u0434\u043d\u044b\u0435 \u0440\u0435\u0441\u0443\u0440\u0441\u044b Kubernetes \u0432\u0440\u043e\u0434\u0435 \u0442\u043e\u043a\u0435\u043d\u043e\u0432 ServiceAccount \u0438 \u0434\u0430\u0436\u0435 \u043c\u043e\u0436\u0435\u0442 \u0432\u044b\u0441\u0442\u0443\u043f\u0430\u0442\u044c \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0435\u043c \u0441\u0435\u043a\u0440\u0435\u0442\u043e\u0432 Kubernetes \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e.<\/p>\n<p><i><b>Op. prev.<\/b>: \u041a\u0441\u0442\u0430\u0442\u0438, \u0431\u0443\u043a\u0432\u0430\u043b\u044c\u043d\u043e \u0432\u0447\u0435\u0440\u0430 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u044f HashiCorp, \u0440\u0430\u0437\u0440\u0430\u0431\u0430\u0442\u044b\u0432\u0430\u044e\u0449\u0430\u044f Vault, \u0430\u043d\u043e\u043d\u0441\u0438\u0440\u043e\u0432\u0430\u043b\u0430 \u043d\u0435\u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u0443\u043b\u0443\u0447\u0448\u0435\u043d\u0438\u044f \u0434\u043b\u044f \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f Vault \u0432 Kubernetes, \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e \u043a\u0430\u0441\u0430\u044e\u0449\u0438\u0435\u0441\u044f Helm-\u0447\u0430\u0440\u0442\u0430. \u041f\u043e\u0434\u0440\u043e\u0431\u043d\u043e\u0441\u0442\u0438 \u0447\u0438\u0442\u0430\u0439\u0442\u0435 \u0432 <noindex><a rel=\"nofollow\" href=\"https:\/\/www.hashicorp.com\/blog\/whats-next-for-vault-and-kubernetes\">\u0431\u043b\u043e\u0433\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430<\/a><\/noindex>.<\/i><\/p>\n<h2>\u0410\u0443\u0434\u0438\u0442 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Kubernetes<\/h2>\n<p><\/p>\n<h3>Kube-bench<\/h3>\n<p><\/p>\n<ul>\n<li>Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/kube-bench\">github.com\/aquasecurity\/kube-bench<\/a><\/noindex><\/li>\n<li>Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/8e0e101503f02ea3033f7b29c9ee9ddf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKube-bench \u2014 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u0435 \u043d\u0430 Go, \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u044e\u0449\u0435\u0435, \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e \u043b\u0438 \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442 Kubernetes, \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u044f \u0442\u0435\u0441\u0442\u044b \u0438\u0437 \u0441\u043f\u0438\u0441\u043a\u0430 <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/container-compliance\/\">CIS Kubernetes Benchmark<\/a><\/noindex>.<\/p>\n<p>Kube-bench \u0438\u0449\u0435\u0442 \u043d\u0435\u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u044b \u043a\u043e\u043d\u0444\u0438\u0433\u0443\u0440\u0430\u0446\u0438\u0438 \u0441\u0440\u0435\u0434\u0438 \u043a\u043e\u043c\u043f\u043e\u043d\u0435\u043d\u0442\u043e\u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430 (etcd, API, controller manager \u0438 \u0442.\u0434.), \u0441\u043e\u043c\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0435 \u043f\u0440\u0430\u0432\u0430 \u043d\u0430 \u0434\u043e\u0441\u0442\u0443\u043f \u043a \u0444\u0430\u0439\u043b\u0430\u043c, \u043d\u0435\u0437\u0430\u0449\u0438\u0449\u0435\u043d\u043d\u044b\u0435 \u0443\u0447\u0451\u0442\u043d\u044b\u0435 \u0437\u0430\u043f\u0438\u0441\u0438 \u0438\u043b\u0438 \u043e\u0442\u043a\u0440\u044b\u0442\u044b\u0435 \u043f\u043e\u0440\u0442\u044b, \u043a\u0432\u043e\u0442\u044b \u0440\u0435\u0441\u0443\u0440\u0441\u043e\u0432, \u043d\u0430\u0441\u0442\u0440\u043e\u0439\u043a\u0438 \u043e\u0433\u0440\u0430\u043d\u0438\u0447\u0435\u043d\u0438\u044f \u0447\u0438\u0441\u043b\u0430 \u043e\u0431\u0440\u0430\u0449\u0435\u043d\u0438\u0439 \u043a API \u0434\u043b\u044f \u0437\u0430\u0449\u0438\u0442\u044b \u043e\u0442 DoS-\u0430\u0442\u0430\u043a \u0438 \u0442.\u043f.<\/p>\n<h3>Kube-hunter<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/kube-hunter\">github.com\/aquasecurity\/kube-hunter<\/a><\/noindex><\/li>\n<li> Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/e5e38368af8bf086da149cbfd71a5e6d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKube-hunter \u00ab\u043e\u0445\u043e\u0442\u0438\u0442\u0441\u044f\u00bb \u043d\u0430 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u044b\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 (\u0442\u0430\u043a\u0438\u0435 \u043a\u0430\u043a \u0443\u0434\u0430\u043b\u0435\u043d\u043d\u043e\u0435 \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u0435 \u043a\u043e\u0434\u0430 \u0438\u043b\u0438 \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0438\u0435 \u0434\u0430\u043d\u043d\u044b\u0445) \u0432 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430\u0445 Kubernetes. Kube-hunter \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u043f\u0443\u0441\u043a\u0430\u0442\u044c \u043a\u0430\u043a \u0443\u0434\u0430\u043b\u0451\u043d\u043d\u044b\u0439 \u0441\u043a\u0430\u043d\u0435\u0440 \u2014 \u0432 \u044d\u0442\u043e\u043c \u0441\u043b\u0443\u0447\u0430\u0435 \u043e\u043d \u043e\u0446\u0435\u043d\u0438\u0442 \u043a\u043b\u0430\u0441\u0442\u0435\u0440 \u0441 \u0442\u043e\u0447\u043a\u0438 \u0437\u0440\u0435\u043d\u0438\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0435\u0433\u043e \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430 \u2014 \u0438\u043b\u0438 \u043a\u0430\u043a pod \u0432\u043d\u0443\u0442\u0440\u0438 \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0430.<\/p>\n<p>\u041e\u0442\u043b\u0438\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e\u0439 \u043e\u0441\u043e\u0431\u0435\u043d\u043d\u043e\u0441\u0442\u044c\u044e Kube-hunter&#8217;\u0430 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u0440\u0435\u0436\u0438\u043c \u00ab\u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0439 \u043e\u0445\u043e\u0442\u044b\u00bb, \u0432\u043e \u0432\u0440\u0435\u043c\u044f \u043a\u043e\u0442\u043e\u0440\u043e\u0433\u043e \u043e\u043d \u043d\u0435 \u0442\u043e\u043b\u044c\u043a\u043e \u0441\u043e\u043e\u0431\u0449\u0430\u0435\u0442 \u043e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0430\u0445, \u043d\u043e \u0438 \u043f\u044b\u0442\u0430\u0435\u0442\u0441\u044f \u0432\u043e\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u044c\u0441\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044f\u043c\u0438, \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u043c\u0438 \u0432 \u0446\u0435\u043b\u0435\u0432\u043e\u043c \u043a\u043b\u0430\u0441\u0442\u0435\u0440\u0435, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043f\u043e\u0442\u0435\u043d\u0446\u0438\u0430\u043b\u044c\u043d\u043e \u043c\u043e\u0433\u0443\u0442 \u043d\u0430\u043d\u0435\u0441\u0442\u0438 \u0432\u0440\u0435\u0434 \u0435\u0433\u043e \u0440\u0430\u0431\u043e\u0442\u0435. \u0422\u0430\u043a \u0447\u0442\u043e \u043f\u043e\u043b\u044c\u0437\u0443\u0439\u0442\u0435\u0441\u044c \u0441 \u043e\u0441\u0442\u043e\u0440\u043e\u0436\u043d\u043e\u0441\u0442\u044c\u044e!<\/p>\n<h3>Kubeaudit<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Shopify\/kubeaudit\">github.com\/Shopify\/kubeaudit<\/a><\/noindex><\/li>\n<li> \u041b\u0438\u0446\u0435\u043d\u0437\u0438\u044f: \u0441\u0432\u043e\u0431\u043e\u0434\u043d\u0430\u044f (MIT)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/84651a05f714b9c841245cb38f78324a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubeaudit je konzolni alat, prvotno razvijen u Shopifyu, za audite konfiguracije Kubernetes-a u potrazi za razli\u010ditim sigurnosnim problemima. Na primjer, poma\u017ee u otkrivanju kontejnera koji rade bez ograni\u010denja, s pravima superuser-a, koji zloupotrebljavaju privilegije ili koriste ServiceAccount po defaultu.<\/p>\n<p>Kubeaudit ima i druge zanimljive mogu\u0107nosti. Na primjer, mo\u017ee analizirati lokalne YAML datoteke, otkrivaju\u0107i manjkavosti u konfiguraciji koje mogu dovesti do sigurnosnih problema, te ih automatski ispraviti.<\/p>\n<h3>Kubesec<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/kubesec.io\/\">kubesec.io<\/a><\/noindex><\/li>\n<li> Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/73e395cdcbe89af391b80ff9dccad5f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubesec je poseban alat jer izravno skenira YAML datoteke s opisima Kubernetes resursa u potrazi za slabim parametrima koji mogu utjecati na sigurnost.<\/p>\n<p>\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043e\u043d \u043c\u043e\u0436\u0435\u0442 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u0432\u0430\u0442\u044c \u0438\u0437\u0431\u044b\u0442\u043e\u0447\u043d\u044b\u0435 \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0438 \u0438 \u0440\u0430\u0437\u0440\u0435\u0448\u0435\u043d\u0438\u044f, \u043f\u0440\u0435\u0434\u043e\u0441\u0442\u0430\u0432\u043b\u0435\u043d\u043d\u044b\u0435 pod&#8217;\u0443, \u0437\u0430\u043f\u0443\u0441\u043a \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0441 root&#8217;\u043e\u043c \u0432 \u043a\u0430\u0447\u0435\u0441\u0442\u0432\u0435 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044f \u043f\u043e \u0443\u043c\u043e\u043b\u0447\u0430\u043d\u0438\u044e, \u043f\u043e\u0434\u043a\u043b\u044e\u0447\u0435\u043d\u0438\u0435 \u043a \u043f\u0440\u043e\u0441\u0442\u0440\u0430\u043d\u0441\u0442\u0432\u0443 \u0438\u043c\u0435\u043d \u0441\u0435\u0442\u0438 \u0445\u043e\u0441\u0442\u0430 \u0438\u043b\u0438 \u043e\u043f\u0430\u0441\u043d\u044b\u0435 \u043c\u043e\u043d\u0442\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0432\u0440\u043e\u0434\u0435 <code>\/proc<\/code> \u0445\u043e\u0441\u0442\u0430 \u0438\u043b\u0438 \u0441\u043e\u043a\u0435\u0442\u0430 Docker&#8217;\u0430. \u0415\u0449\u0435 \u043e\u0434\u043d\u0430 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430\u044f \u0432\u043e\u0437\u043c\u043e\u0436\u043d\u043e\u0441\u0442\u044c Kubesec \u2014 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0439 \u0432 \u043e\u043d\u043b\u0430\u0439\u043d\u0435 \u0434\u0435\u043c\u043e-\u0441\u0435\u0440\u0432\u0438\u0441, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u043d\u043e \u0437\u0430\u0433\u0440\u0443\u0437\u0438\u0442\u044c YAML \u0438 \u0441\u0440\u0430\u0437\u0443 \u043f\u0440\u043e\u0432\u0435\u0441\u0442\u0438 \u0435\u0433\u043e \u0430\u043d\u0430\u043b\u0438\u0437.<\/p>\n<h3>Open Policy Agent<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openpolicyagent.org\/\">www.openpolicyagent.org<\/a><\/noindex><\/li>\n<li> Licenca: prosta (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/f897b58fbc67d9cb463008621f4e608f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKoncept OPA (Open Policy Agent) je odvojenje sigurnosnih politika i najboljih praksi u podru\u010dju sigurnosti od konkretne runtime platforme: Docker, Kubernetes, Mesosphere, OpenShift ili bilo koja njihova kombinacija.<\/p>\n<p>\u041d\u0430\u043f\u0440\u0438\u043c\u0435\u0440, \u043c\u043e\u0436\u043d\u043e \u0440\u0430\u0437\u0432\u0435\u0440\u043d\u0443\u0442\u044c OPA \u043a\u0430\u043a \u0431\u044d\u043a\u0435\u043d\u0434 \u0434\u043b\u044f admission controller&#8217;\u0430 Kubernetes, \u0434\u0435\u043b\u0435\u0433\u0438\u0440\u0443\u044f \u0435\u043c\u0443 \u0440\u0435\u0448\u0435\u043d\u0438\u044f \u043f\u043e \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u0422\u0430\u043a\u0438\u043c \u043e\u0431\u0440\u0430\u0437\u043e\u043c \u0430\u0433\u0435\u043d\u0442 OPA \u0441\u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u044f\u0442\u044c, \u043e\u0442\u043a\u043b\u043e\u043d\u044f\u0442\u044c \u0438 \u0434\u0430\u0436\u0435 \u0438\u0437\u043c\u0435\u043d\u044f\u0442\u044c \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043d\u0430 \u043b\u0435\u0442\u0443, \u043e\u0431\u0435\u0441\u043f\u0435\u0447\u0438\u0432\u0430\u044f \u0441\u043e\u0431\u043b\u044e\u0434\u0435\u043d\u0438\u0435 \u0437\u0430\u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043e\u0432 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438. \u041f\u043e\u043b\u0438\u0442\u0438\u043a\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 OPA \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u044b \u043d\u0430 \u0435\u0433\u043e \u0441\u043e\u0431\u0441\u0442\u0432\u0435\u043d\u043d\u043e\u043c DSL-\u044f\u0437\u044b\u043a\u0435 Rego.<\/p>\n<p><i><b>Op. prev.<\/b>: Vi\u0161e o OPA (i SPIFFE) pisali smo u <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/353808\/\">ovom materijalu<\/a><\/noindex>.<\/i><\/p>\n<h2>Kompleksni komercijalni alati za analizu sigurnosti Kubernetes-a<\/h2>\n<p>\nOdlu\u010dili smo stvoriti posebnu kategoriju za komercijalne platforme jer obi\u010dno pokrivaju nekoliko podru\u010dja sigurnosti. Op\u0107i pregled njihovih mogu\u0107nosti mo\u017ee se dobiti iz tablice:<\/p>\n<p><img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/0dbe925006238ee242c452f05d9f7302.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>* Napredna stru\u010dnost i post mortem analiza s potpunim <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/use-cases\/container-forensics\/\">zapisom sistemskih poziva<\/a><\/noindex>.<\/i><\/p>\n<h3>Aqua Security<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aquasec.com\/\">www.aquasec.com<\/a><\/noindex><\/li>\n<li> Licenca: komercialna<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/d02026209908e9dac53be53fbdb178cd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nOvaj komercijalni alat namijenjen je kontejnerima i obla\u010dnim radnim optere\u0107enjima. Pru\u017ea:<\/p>\n<ul>\n<li> Skeniranje slika, integrirano s registrima kontejnera ili CI\/CD skupom;<\/li>\n<li> Za\u0161tita tijekom izvo\u0111enja s pretragom promjena u kontejnerima i drugim sumnjivim aktivnostima;<\/li>\n<li> Izvorni vatrozid za kontejnere;<\/li>\n<li> Sigurnost za serverless u oblaku;<\/li>\n<li> Provjere uskla\u0111enosti i revizije, zajedno s evidentiranjem doga\u0111aja.<\/li>\n<\/ul>\n<p>\n<i><b>Op. prev.<\/b>: Tako\u0111er se treba napomenuti da postoji i <b>besplatna komponenta proizvoda pod nazivom <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/microscanner\">MicroScanner<\/a><\/noindex><\/b>, koja omogu\u0107uje skeniranje kontejnerskih slika na ranjivosti. U usporedbi s pla\u0107enim verzijama, njezine mogu\u0107nosti su prikazane u <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/microscanner#aqua-security-edition-comparison\">ovoj tablici<\/a><\/noindex>.<\/i><\/p>\n<h3>Capsule8<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/\">capsule8.com<\/a><\/noindex><\/li>\n<li> Licenca: komercialna<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/122be33f15d31f8f083189bca5c7158c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nCapsule8 se integrira u infrastrukturu, postavljaju\u0107i detektor u lokalni ili obla\u010dni Kubernetes klaster. Ovaj detektor prikuplja telemetriju od hosta i mre\u017ee, uspore\u0111uju\u0107i je s razli\u010ditim vrstama napada.<\/p>\n<p>Tim Capsule8 vidi svoj zadatak kao rano otkrivanje i spre\u010davanje napada koji koriste nove <i>(0-day)<\/i> ranjivosti. Capsule8 mo\u017ee u\u010ditavati precizna pravila sigurnosti direktno na detektore kao odgovor na nedavno otkrivene prijetnje i ranjivosti softvera.<\/p>\n<h3>Cavirin<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cavirin.com\/\">www.cavirin.com<\/a><\/noindex><\/li>\n<li> Licenca: komercialna<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/896310c9258943041664ca55b3926d35.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCavirin djeluje kao kontragent za kompanije iz raznih agencija koje se bave sigurnosnim standardima. Mo\u017ee skenirati slike, ali se i integrirati u CI\/CD skup, blokiraju\u0107i neskladne slike prije nego \u0161to do\u0111u u zatvorene repozitorije.<\/p>\n<p>Sigurnosni paket Cavirin koristi strojno u\u010denje za ocjenu stanja kiberneti\u010dke sigurnosti, nudi savjete za pobolj\u0161anje sigurnosti i pove\u0107anje uskla\u0111enosti s sigurnosnim standardima.<\/p>\n<h3>Google Cloud Security Command Center<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/cloud.google.com\/security-command-center\/\">cloud.google.com\/security-command-center<\/a><\/noindex><\/li>\n<li> Licenca: komercialna<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/d9ac37b3d2b9be7fd6fcd6afe0d985e6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCloud Security Command Center poma\u017ee timovima za sigurnost prikupljati podatke, otkrivati prijetnje i uklanjati ih prije nego \u0161to na\u0161tete kompaniji.<\/p>\n<p>Kao \u0161to naziv sugerira, Google Cloud SCC je ujedinjena kontrolna plo\u010da u koju se mogu integrirati razli\u010diti izvje\u0161taji o sigurnosti, mehanizmi pra\u0107enja imovine i vanjski sigurnosni sustavi te njima upravljati iz jedinstvenog, sredi\u0161njeg izvora.<\/p>\n<p>Interoperabilni API koji nudi Google Cloud SCC olak\u0161ava integraciju sigurnosnih doga\u0111aja koji dolaze iz razli\u010ditih izvora, kao \u0161to su Sysdig Secure (sigurnost kontejnera za cloud-native aplikacije) ili Falco (sustav otvorenog koda za runtime sigurnost).<\/p>\n<h3>Layered Insight (Qualys)<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/layeredinsight.com\/\">layeredinsight.com<\/a><\/noindex><\/li>\n<li> Licenca: komercialna<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/31e0266c670a991824c029f9445cf480.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLayered Insight (sedaj del podjetja Qualys Inc) temelji na konceptu 'vgrajene varnosti'. Po skeniranju izvirnega slike na ranljivosti s pomo\u010djo statisti\u010dnih metod in preverjanjem po CVE, Layered Insight zamenja sliko z instrumentirano sliko, ki vklju\u010duje agenta v obliki binarne datoteke.<\/p>\n<p>Ta agent vsebuje varnostne teste runtime za analizo omre\u017enega prometa kontejnerja, I\/O tokov in dejavnosti aplikacije. Poleg tega lahko izvaja dodatne varnostne preglede, ki jih dolo\u010di skrbnik infrastrukture ali ekipe DevOps.<\/p>\n<h3>NeuVector<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/neuvector.com\/\">neuvector.com<\/a><\/noindex><\/li>\n<li> Licenca: komercialna<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/db9558498c4c5cd876083d7a5bb41ab4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNeuVector \u043f\u0440\u043e\u0432\u043e\u0434\u0438\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u043a\u0443 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430 \u0438 \u043e\u0441\u0443\u0449\u0435\u0441\u0442\u0432\u043b\u044f\u0435\u0442 runtime-\u0437\u0430\u0449\u0438\u0442\u0443 \u043f\u0443\u0442\u0435\u043c \u0430\u043d\u0430\u043b\u0438\u0437\u0430 \u0441\u0435\u0442\u0435\u0432\u043e\u0439 \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u0438 \u0438 \u043f\u043e\u0432\u0435\u0434\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f, \u0441\u043e\u0437\u0434\u0430\u0432\u0430\u044f \u0438\u043d\u0434\u0438\u0432\u0438\u0434\u0443\u0430\u043b\u044c\u043d\u044b\u0439 \u043f\u0440\u043e\u0444\u0438\u043b\u044c \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0434\u043b\u044f \u043a\u0430\u0436\u0434\u043e\u0433\u043e \u043a\u043e\u043d\u0442\u0435\u0439\u043d\u0435\u0440\u0430. \u041e\u043d \u0442\u0430\u043a\u0436\u0435 \u043c\u043e\u0436\u0435\u0442 \u0441\u0430\u043c\u043e\u0441\u0442\u043e\u044f\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u0433\u0440\u043e\u0437\u044b, \u0438\u0437\u043e\u043b\u0438\u0440\u0443\u044f \u043f\u043e\u0434\u043e\u0437\u0440\u0438\u0442\u0435\u043b\u044c\u043d\u0443\u044e \u0430\u043a\u0442\u0438\u0432\u043d\u043e\u0441\u0442\u044c \u0437\u0430 \u0441\u0447\u0435\u0442 \u0438\u0437\u043c\u0435\u043d\u0435\u043d\u0438\u044f \u043f\u0440\u0430\u0432\u0438\u043b \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e firewall&#8217;\u0430.<\/p>\n<p>Omre\u017ena integracija NeuVector, znana kot Security Mesh, je sposobna izvajati globoko analizo paketov in filtracijo na 7. ravni za vse omre\u017ene povezave v service mesh.<\/p>\n<h3>StackRox<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.stackrox.com\/\">www.stackrox.com<\/a><\/noindex><\/li>\n<li> Licenca: komercialna<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/9b8d013860518fab67e84344eaa1de91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPlatforma StackRox za zagotavljanje varnosti kontejnerjev si prizadeva zajeti celoten \u017eivljenjski cikel Kubernetes aplikacij v klastru. Tako kot druge komercialne platforme na tem seznamu, StackRox generira runtime profil na podlagi opazovanega vedenja kontejnerja in samodejno spro\u017ei alarm ob kakr\u0161nih koli odklonitvah.<\/p>\n<p>Poleg tega StackRox analizira konfiguracije Kubernetes, pri \u010demer uporablja CIS Kubernetes in druge zbirke pravil za oceno skladnosti kontejnerjev.<\/p>\n<h3>Sysdig Secure<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/\">sysdig.com\/products\/secure<\/a><\/noindex><\/li>\n<li> Licenca: komercialna<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/a36518809970479fe435e505c231eff8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSysdig Secure \u0161\u010diti aplikacije skozi celoten \u017eivljenjski cikel kontejnerja in Kubernetes. On <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/image-scanning\/\">preverja slike<\/a><\/noindex> kontejnerjev, zagotavlja <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/runtime-security\/\">runtime-varnost<\/a><\/noindex> na podlagi strojnega u\u010denja, izvaja kriminalisti\u010dno preiskavo za odkrivanje ranljivosti, blokira gro\u017enje, spremlja <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/container-compliance\/\">skladnost s postavljenimi standardi<\/a><\/noindex> in izvaja revizijo aktivnosti v mikroservisih.<\/p>\n<p>Sysdig Secure se integrira z orodji CI\/CD, kot je Jenkins, in nadzira slike, nalo\u017eene iz Docker registrov, s \u010dimer prepre\u010duje pojav nevarnih slik v produkciji. Prav tako zagotavlja celovito runtime-varnost, vklju\u010dno z:<\/p>\n<ul>\n<li> runtime-profiliranjem na podlagi ML in odkrivanjem anomalij;<\/li>\n<li> pol\u00edtica runtime, ki temelji na sistemskih dogodkih, API K8s-audit, skupnostnih projektih (FIM \u2013 spremljanje celovitosti datotek; cryptojacking) in okviru <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/blog\/mitre-attck-framework-for-container-runtime-security-with-sysdig-falco\/\">MITRE ATT&amp;CK<\/a><\/noindex>;<\/li>\n<li> odziv in odpravljanje incidentov.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Tenable Container Security<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/products\/tenable-io\/container-security\">www.tenable.com\/products\/tenable-io\/container-security<\/a><\/noindex><\/li>\n<li> Licenca: komercialna<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/2b3799ee94628c04104f6cead8be8749.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPred pojavom kontejnerjev je bila Tenable v industriji dobro znana kot podjetje, ki je razvilo Nessus \u2013 priljubljeno orodje za iskanje ranljivosti in varnostni auditi.<\/p>\n<p>Tenable Container Security izkori\u0161\u010da znanje podjetja s podro\u010dja ra\u010dunalni\u0161ke varnosti za integracijo CI\/CD-pipeline z bazami ranljivosti, specializiranimi paketi za odkrivanje zlonamerne programske opreme in priporo\u010dili za odpravo varnostnih gro\u017eenj.<\/p>\n<h3>Twistlock (Palo Alto Networks)<\/h3>\n<p><\/p>\n<ul>\n<li> Web stranica: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.twistlock.com\/\">www.twistlock.com<\/a><\/noindex><\/li>\n<li> Licenca: komercialna<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ alata za bezbednost Kubernetes-a\" src=\"\/wp-content\/uploads\/2019\/09\/98213c84bafaeca1e0d6bca3e1a80d23.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTwistlock se predstavlja kot platforma, osredoto\u010dena na obla\u010dne storitve in kontejnerje. Twistlock podpira razli\u010dne obla\u010dne ponudnike (AWS, Azure, GCP), orkestratorje kontejnerjev (Kubernetes, Mesosphere, OpenShift, Docker), brezstre\u017eni izvr\u0161ilni okolja, mesh-okvire in orodja CI\/CD.<\/p>\n<p>Poleg obi\u010dajnih metod zagotavljanja varnosti na ravni podjetij, kot sta integracija v CI\/CD-pipeline ali skeniranje slik, Twistlock uporablja strojno u\u010denje za generiranje vedenjskih vzorcev in mre\u017enih pravil, ki upo\u0161tevajo posebnosti kontejnerjev.<\/p>\n<p>Nekaj \u010dasa nazaj je Twistlock kupila dru\u017eba Palo Alto Networks, ki obvladuje projekte Evident.io in RedLock. Trenutno ni znano, kako bodo te tri platforme integrirane v <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/cloud-security\">PRISMA<\/a><\/noindex> dru\u017ebe Palo Alto.<\/p>\n<h2>Pomagajte ustvariti najbolj\u0161i katalog orodij za varnost Kubernetes!<\/h2>\n<p>\nTrudimo se, da bi bil ta katalog kar se da popoln, in za to potrebujemo va\u0161o pomo\u010d! Stopite v stik z nami (<noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/sysdig\">@sysdig<\/a><\/noindex>), \u010de imate v mislih odli\u010dno orodje, ki si zaslu\u017ei vklju\u010ditev na ta seznam, ali ste odkrili napako\/ostarelo informacijo.<\/p>\n<p>Prav tako se lahko naro\u010dite na na\u0161o <noindex><a rel=\"nofollow\" href=\"https:\/\/go.sysdig.com\/container-newsletter-signup.html\">mese\u010dno glasilo<\/a><\/noindex> z novicami o ekosistemu cloud-native in zgodbami o zanimivih projektih iz sveta varnosti Kubernetes.<\/p>\n<h2>P.S. od prevajalca<\/h2>\n<p>\nPreberite tudi na na\u0161em blogu:<\/p>\n<ul>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443190\/\">Uvod v omre\u017ene politik Kubernetes za strokovnjake za varnost<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440504\/\">Docker in Kubernetes v okoljih, zahtevnih glede varnosti<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/436300\/\">9 najbolj\u0161ih praks za zagotavljanje varnosti v Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/417905\/\">11 na\u010dinov, kako (ne) postati \u017ertev hekerskega napada v Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/353808\/\">OPA in SPIFFE \u2014 dva nova projekta v CNCF za varnost obla\u010dnih aplikacij<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Izvor: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/465141\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0415\u0441\u043b\u0438 \u0432\u044b \u0437\u0430\u0434\u0430\u0451\u0442\u0435\u0441\u044c \u0432\u043e\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Kubernetes, \u044d\u0442\u043e\u0442 \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0437\u043e\u0440 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Sysdig \u0441\u0442\u0430\u043d\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u043d\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0434\u043b\u044f \u0431\u0435\u0433\u043b\u043e\u0433\u043e \u0437\u043d\u0430\u043a\u043e\u043c\u0441\u0442\u0432\u0430 \u0441 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u044f\u043c\u0438. \u0412 \u043d\u0435\u0433\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u0433\u0440\u043e\u043a\u043e\u0432 \u0440\u044b\u043d\u043a\u0430, \u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u0441\u043a\u0440\u043e\u043c\u043d\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0442\u0443 \u0438\u043b\u0438 \u0438\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0410 \u0432 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u043c\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28890,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38497","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"sl_SI\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4733+ \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Kubernetes | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:24:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:24:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4733+ orodij za varnost Kubernetes | ProHoster","description":"Primer.","canonical_url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sl_SI","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4733+ \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Kubernetes | ProHoster","og:description":"\u041f\u0440\u0438\u043c.","og:url":"https:\/\/prohoster.info\/sl\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:24:06+00:00","article:modified_time":"2019-10-31T19:24:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38497","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 22:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:08:31","updated":"2026-01-23 22:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/38497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/comments?post=38497"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/posts\/38497\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media\/28890"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/media?parent=38497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/categories?post=38497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sl\/wp-json\/wp\/v2\/tags?post=38497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}