{"id":38497,"date":"2019-10-31T22:24:06","date_gmt":"2019-10-31T19:24:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/33-instrumenta-dlya-bezopasnosti-kubernetes\/"},"modified":"2019-10-31T22:24:06","modified_gmt":"2019-10-31T19:24:06","slug":"33-instrumenta-dlya-bezopasnosti-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","title":{"rendered":"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i><b>Sh\u00ebn. p\u00ebrk.<\/b>: N\u00ebse po pyesni p\u00ebr sigurin\u00eb n\u00eb infrastruktur\u00ebn e bazuar n\u00eb Kubernetes, ky p\u00ebrmbledhje e shk\u00eblqyer nga Sysdig do t\u00eb jet\u00eb nj\u00eb pik\u00eb e shk\u00eblqyer fillestare p\u00ebr t\u00eb njohur zgjidhjet aktuale. Ajo p\u00ebrfshin\u00eb si sisteme komplekse nga lojtar\u00ebt e njohur t\u00eb tregut, ashtu edhe mjetet shum\u00eb m\u00eb modeste q\u00eb zgjidhin probleme t\u00eb caktuara. Dhe n\u00eb komentet ne gjithmon\u00eb do t\u00eb jemi t\u00eb lumtur t\u00eb d\u00ebgjojm\u00eb p\u00ebr p\u00ebrvoj\u00ebn tuaj me k\u00ebto mjete dhe t\u00eb shohim lidhje me projekte t\u00eb tjera.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/4d9aa6583128844afadc1b06996c29b6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nProdukte softuerike p\u00ebr sigurin\u00eb e Kubernetes... ka kaq shum\u00eb, dhe secili ka q\u00ebllimet, fush\u00ebn e p\u00ebrdorimit dhe licencat e tij.<\/p>\n<p>Pik\u00ebrisht p\u00ebr k\u00ebt\u00eb arsye ne vendos\u00ebm t\u00eb krijojm\u00eb k\u00ebt\u00eb list\u00eb dhe p\u00ebrfshim\u00eb si projekte t\u00eb hapura, ashtu edhe platforma komerciale nga ofrues t\u00eb ndrysh\u00ebm. Shpresojm\u00eb se kjo do t\u2019ju ndihmoj\u00eb t\u00eb zgjidhni ato q\u00eb paraqesin interesin m\u00eb t\u00eb madh dhe do t\u2019ju udh\u00ebzoj\u00eb n\u00eb drejtimin e duhur n\u00eb var\u00ebsi t\u00eb nevojave specifike p\u00ebr sigurin\u00eb e Kubernetes.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Kategorit\u00eb<\/h2>\n<p>\nP\u00ebr t\u00eb thjeshtuar navigimin n\u00eb list\u00eb, mjetet jan\u00eb ndar\u00eb sipas funksioneve kryesore dhe fushave t\u00eb p\u00ebrdorimit. K\u00ebto jan\u00eb seksionet e krijuara:<\/p>\n<ul>\n<li> Skanimi i imazheve Kubernetes dhe analiza statike;<\/li>\n<li> Siguria runtime;<\/li>\n<li> Siguria e rrjetit Kubernetes;<\/li>\n<li> Shp\u00ebrndarja e imazheve dhe menaxhimi i sekreteve;<\/li>\n<li> Auditi i siguris\u00eb Kubernetes;<\/li>\n<li> Produkte komerciale t\u00eb integruara.<\/li>\n<\/ul>\n<p>\nLe t\u00eb kalojm\u00eb n\u00eb detaje:<\/p>\n<h2>Skanimi i imazheve Kubernetes<\/h2>\n<p><\/p>\n<h3>Anchore<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/anchore.com\">anchore.com<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache) dhe ofert\u00eb tregtare<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/2c942e5a104feb4840a426157d5457f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPakoja Anchore analizojn\u00eb imazhet e kontejner\u00ebve dhe lejon q\u00eb t\u00eb kryhen kontrolle sigurie bazuar n\u00eb politikat e p\u00ebrcaktuara nga p\u00ebrdoruesi.<\/p>\n<p>P\u00ebrve\u00e7 skanimit t\u00eb zakonsh\u00ebm t\u00eb imazheve t\u00eb kontejner\u00ebve p\u00ebr t\u00eb gjetur dob\u00ebsi t\u00eb njohura nga baza CVE, Anchore kryen nj\u00eb num\u00ebr t\u00eb madh kontrollesh shtes\u00eb si pjes\u00eb e politik\u00ebs s\u00eb skanimit: kontrollon Dockerfile, rrjedhjen e akreditiveve, paketat e gjuh\u00ebve t\u00eb programimit t\u00eb p\u00ebrdorura (npm, maven etj.), licencat e softuerit dhe shum\u00eb m\u00eb tep\u00ebr.<\/p>\n<h3>Clair<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/coreos.com\/clair\">coreos.com\/clair<\/a><\/noindex> <i>(tani n\u00ebn mb\u00ebshtetje t\u00eb Red Hat)<\/i><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/81be8927c1fcbfa5d714836a1db3c7d8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nClair ishte nj\u00eb nga projektet e para Open Source p\u00ebr skanimin e imazheve. Ai \u00ebsht\u00eb i njohur gjer\u00ebsisht si skaneri i siguris\u00eb q\u00eb ndihmon n\u00eb baz\u00ebn e regjistrit t\u00eb imazheve Quay <i>(po ashtu nga CoreOS \u2014 <b>sh\u00ebn. transl.<\/b>)<\/i>. Clair mund t\u00eb mbledh\u00eb informacion rreth CVE nga nj\u00eb num\u00ebr t\u00eb madh burimesh, p\u00ebrfshir\u00eb listat specifike p\u00ebr distribucionet Linux t\u00eb vulnerabilitetit, t\u00eb cilat mbahen nga ekipet e siguris\u00eb t\u00eb Debian, Red Hat ose Ubuntu.<\/p>\n<p>Krahasuar me Anchore, Clair kryesisht merret me gjetjen e vulnerabilitet\u00ebve dhe p\u00ebrputhjen e t\u00eb dh\u00ebnave me CVE. Megjithat\u00eb, produkti ofron p\u00ebrdoruesve disa mund\u00ebsi p\u00ebr t\u00eb zgjeruar funksionalitetet p\u00ebrmes t\u00eb dh\u00ebnave t\u00eb lidhura.<\/p>\n<h3>Dagda<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/eliasgranderubio\/dagda\">github.com\/eliasgranderubio\/dagda<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/242930fcb99017f80f7cfc2a676e16ef.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDagda kryen analiz\u00eb statike t\u00eb imazheve t\u00eb kontejner\u00ebve p\u00ebr t\u00eb identifikuar vulnerabilitete t\u00eb njohura, Trojan\u00eb, viruse, malware dhe k\u00ebrc\u00ebnime t\u00eb tjera.<\/p>\n<p>Disa ve\u00e7ori t\u00eb ve\u00e7anta e ndajn\u00eb paket\u00ebn Dagda nga mjetet e ngjashme:<\/p>\n<ul>\n<li> Ai integrohet shk\u00eblqyer me <noindex><a rel=\"nofollow\" href=\"https:\/\/www.clamav.net\/\">ClamAV<\/a><\/noindex>, duke sh\u00ebrbyer jo vet\u00ebm si nj\u00eb mjet p\u00ebr skanimin e imazheve t\u00eb kontejner\u00ebve, por edhe si antivirus.<\/li>\n<li> Gjithashtu ofron mbrojtje runtime, duke marr\u00eb n\u00eb koh\u00eb reale ngjarje nga fshir\u00ebsi i Docker'it dhe duke u integruar me Falco <i>(shih m\u00eb posht\u00eb)<\/i> p\u00ebr t\u00eb mbledhur ngjarjet e siguris\u00eb gjat\u00eb funksionimit t\u00eb kontejnerit.<\/li>\n<\/ul>\n<p><\/p>\n<h3>KubeXray<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jfrog\/kubexray\">github.com\/jfrog\/kubexray<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache), por k\u00ebrkon marrjen e t\u00eb dh\u00ebnave nga JFrog Xray (produkt komercial)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/f3aafb0d694b810fd5a7046c270e3b4d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubeXray \u00abd\u00ebgjon\u00bb ngjarjet e API-serverit Kubernetes dhe me ndihm\u00ebn e t\u00eb dh\u00ebnave nga JFrog Xray siguron q\u00eb t\u00eb jen\u00eb aktivizuar vet\u00ebm pod&#8217;et q\u00eb p\u00ebrmbushin politik\u00ebn aktuale.<\/p>\n<p>KubeXray jo vet\u00ebm q\u00eb auditon kontejner\u00ebt e rinj ose t\u00eb azhurnuar n\u00eb deployment&#8217;et (ngjash\u00ebm me controller-in e pranimit n\u00eb Kubernetes), por gjithashtu kontrollon dinamik kontejner\u00ebt n\u00eb pun\u00eb p\u00ebr t'u siguruar q\u00eb ata p\u00ebrputhen me politikat e reja t\u00eb siguris\u00eb, duke hequr burimet q\u00eb referojn\u00eb n\u00eb imazhe t\u00eb cenueshme.<\/p>\n<h3>Snyk<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/snyk.io\/\">snyk.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache) dhe versionet komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/a36ded26e3a659474c1c154bc3e753bb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSnyk \u00ebsht\u00eb nj\u00eb skaner i ve\u00e7ant\u00eb i dob\u00ebsive n\u00eb kuptimin q\u00eb ai \u00ebsht\u00eb ve\u00e7an\u00ebrisht i fokusuar n\u00eb procesin e zhvillimit dhe promovohet si \"zgjidhja e paharrueshme\" p\u00ebr zhvilluesit.<\/p>\n<p>Snyk lidhet drejtp\u00ebrdrejt me repo-t e kodit, analizon manifestin e projektit dhe shqyrton kodin e importuar s\u00eb bashku me var\u00ebsit\u00eb direkte dhe indirekte. Snyk mb\u00ebshtet shum\u00eb gjuh\u00eb programimi popullore dhe mund t\u00eb zbuloj\u00eb rreziqe t\u00eb fshehura t\u00eb licenc\u00ebs.<\/p>\n<h3>Trivy<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/knqyf263\/trivy\">github.com\/knqyf263\/trivy<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (AGPL)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/b21dd72d590d719a7d13741117002999.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTrivy \u2014 nj\u00eb skaner i thjesht\u00eb, por t\u00eb fuqish\u00ebm p\u00ebr dob\u00ebsit\u00eb n\u00eb konteiner\u00eb, i integruesh\u00ebm leht\u00ebsisht n\u00eb pipeline-t CI\/CD. Karakteristika e tij e ve\u00e7ant\u00eb \u00ebsht\u00eb thjesht\u00ebsia n\u00eb instalim dhe funksionim: aplikacioni p\u00ebrb\u00ebhet nga nj\u00eb binar t\u00eb vet\u00ebm dhe nuk k\u00ebrkon instalimin e nj\u00eb baze t\u00eb dh\u00ebnash apo bibliotekave shtes\u00eb.<\/p>\n<p>An\u00ebtar\u00ebsia e thjesht\u00ebsis\u00eb n\u00eb Trivy \u00ebsht\u00eb se do t\u00eb duhet t\u00eb kuptoni se si t\u00eb interpretoni dhe d\u00ebrgoni rezultatet n\u00eb formatin JSON, n\u00eb m\u00ebnyr\u00eb q\u00eb mjetet e tjera t\u00eb siguris\u00eb Kubernetes t\u00eb mund t\u2019i shfryt\u00ebzojn\u00eb ato.<\/p>\n<h2>Siguria runtime n\u00eb Kubernetes<\/h2>\n<p><\/p>\n<h3>Falco<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/falco.org\/\">falco.org<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/0e2601a1ec4ec56ed9daea5f34f36e9a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFalco \u00ebsht\u00eb nj\u00eb set mjetesh p\u00ebr sigurimin e ambienteve t\u00eb ekzekutimit n\u00eb cloud. Ai b\u00ebn pjes\u00eb n\u00eb familjen e projekteve <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cncf.io\/sandbox-projects\/\">CNCF<\/a><\/noindex>.<\/p>\n<p>Duke p\u00ebrdorur mjete t\u00eb Sysdig p\u00ebr t\u00eb punuar n\u00eb nivelin e b\u00ebrtham\u00ebs Linux dhe profilizimin e thirrjeve sistemore, Falco lejon nj\u00eb zhytje t\u00eb thell\u00eb n\u00eb sjelljen e sistemit. Mekanizmi i tij t\u00eb rregullave runtime \u00ebsht\u00eb i aft\u00eb t\u00eb zbuloj\u00eb aktivitet t\u00eb dyshimt\u00eb n\u00eb aplikacione, konteiner\u00eb, hostin baz\u00eb dhe orkestruesin Kubernetes.<\/p>\n<p>Falco siguron transparenc\u00eb t\u00eb plot\u00eb n\u00eb operimin runtime&#8217;it dhe zbulimin e k\u00ebrc\u00ebnimeve, duke vendosur p\u00ebr k\u00ebto q\u00ebllime agjent\u00eb t\u00eb ve\u00e7ant\u00eb n\u00eb nodet Kubernetes. Si rezultat, nuk ka nevoj\u00eb t\u00eb modifikoni kontejner\u00ebt, duke futur kod t\u00eb pal\u00ebs s\u00eb tret\u00eb n\u00eb to ose duke vendosur sidecar-kontejner\u00eb.<\/p>\n<h3>Korniza t\u00eb siguris\u00eb Linux p\u00ebr runtime<\/h3>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/18f219ca98e481376265b753b638a7ec.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00ebto korniza native p\u00ebr kernelin Linux nuk jan\u00eb \"mjetet e siguris\u00eb Kubernetes\" n\u00eb kuptimin tradicional, megjithat\u00eb meritojn\u00eb p\u00ebrmendje, pasi ato p\u00ebrb\u00ebjn\u00eb nj\u00eb element t\u00eb r\u00ebnd\u00ebsish\u00ebm n\u00eb kontekstin e siguris\u00eb n\u00eb runtime, q\u00eb p\u00ebrfshihet n\u00eb Politikat e Siguris\u00eb s\u00eb Pod-it Kubernetes (PSP).<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/gitlab.com\/apparmor\/apparmor\/wikis\/home\/\">AppArmor<\/a><\/noindex> lidhen me profilin e siguris\u00eb n\u00eb proceset e ekzekutuara n\u00eb kontejner, duke p\u00ebrcaktuar privilegjet e sistemit t\u00eb skedar\u00ebve, rregullat e qasjes n\u00eb rrjet, lidhjen e biblioteka etj. Kjo \u00ebsht\u00eb nj\u00eb sistem q\u00eb bazohet n\u00eb menaxhimin e detyruesh\u00ebm t\u00eb aksesit (Mandatory Access Control, MAC). N\u00eb fjal\u00eb t\u00eb tjera, ajo parandalon kryerjen e veprimeve t\u00eb ndaluara.<\/p>\n<p>Security-Enhanced Linux (<noindex><a rel=\"nofollow\" href=\"https:\/\/selinuxproject.org\/page\/Main_Page\">SELinux<\/a><\/noindex>) \u2014 \u00ebsht\u00eb nj\u00eb modul sigurie t\u00eb avancuar n\u00eb b\u00ebrtham\u00ebn Linux, i ngjash\u00ebm n\u00eb disa aspekte me AppArmor dhe shpesh krahasohet me t\u00eb. SELinux e tejkalon AppArmor sa i p\u00ebrket fuqis\u00eb, fleksibilitetit dhe nuhatjes s\u00eb konfigurimeve. Disavantazhi i tij \u00ebsht\u00eb procesi i gjat\u00eb i m\u00ebsimit dhe kompleksiteti i lart\u00eb.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/seccomp\/libseccomp\">Seccomp<\/a><\/noindex> dhe seccomp-bpf lejojn\u00eb filtrimin e thirrjeve sistemike, duke bllokuar ekzekutimin e atyre q\u00eb potencialisht jan\u00eb t\u00eb rrezikshme p\u00ebr sistemin baz\u00eb dhe q\u00eb nuk jan\u00eb t\u00eb nevojshme p\u00ebr funksionimin normal t\u00eb aplikacioneve t\u00eb p\u00ebrdoruesve. Seccomp n\u00eb disa aspekte \u00ebsht\u00eb i ngjash\u00ebm me Falco, ndon\u00ebse nuk njeh specifik\u00ebn e kontejner\u00ebve.<\/p>\n<h3>Sysdig open source<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sysdig.com\/opensource\">www.sysdig.com\/open-source<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/4f8849a6cc819cef89f10ab80911c504.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSysdig \u00ebsht\u00eb nj\u00eb mjet i plot\u00eb p\u00ebr analiz\u00ebn, diagnostikimin dhe debugimin e sistemeve Linux (punon gjithashtu n\u00eb Windows dhe macOS, por me funksione t\u00eb kufizuara). Ai mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb mbledhur informacion t\u00eb detajuar, verifikim dhe ekspertiz\u00eb kriminale <i>(forensics)<\/i> t\u00eb sistemit baz\u00eb dhe \u00e7do konteineri q\u00eb funksionon mbi t\u00eb.<\/p>\n<p>Sysdig gjithashtu mb\u00ebshtet fillimisht mjediset ekzekutuese p\u00ebr kontejner\u00ebt dhe metadat\u00ebn Kubernetes, duke shtuar dimensione dhe etiketa t\u00eb tjera n\u00eb t\u00eb gjitha informacionet e mbledhura p\u00ebr sjelljen e sistemit. Ekzistojn\u00eb disa m\u00ebnyra p\u00ebr t\u00eb analizuar klastrin Kubernetes duke p\u00ebrdorur Sysdig: mund t\u00eb kryeni nj\u00eb kapje n\u00eb nj\u00eb moment t\u00eb caktuar p\u00ebrmes <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sysdiglabs\/kubectl-capture\">kapjes kubectl<\/a><\/noindex> apo mund t\u00eb lanconi nj\u00eb nd\u00ebrfaqe interaktive t\u00eb bazuar n\u00eb ncurses duke p\u00ebrdorur pluginin <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sysdiglabs\/kubectl-dig\">kubectl dig<\/a><\/noindex>.<\/p>\n<h2>Siguria n\u00eb rrjetin Kubernetes<\/h2>\n<p><\/p>\n<h3>Aporeto<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aporeto.com\/\">www.aporeto.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/9692c50339a6c304c7f32f90619aaed1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAporeto ofron \u00absiguri t\u00eb ndar\u00eb nga rrjeti dhe infrastruktura\u00bb. Kjo do t\u00eb thot\u00eb se sh\u00ebrbimet Kubernetes jo vet\u00ebm q\u00eb marrin nj\u00eb ID lokale (dmth. ServiceAccount n\u00eb Kubernetes), por gjithashtu nj\u00eb identifikues\/izgjidhje universale q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr shk\u00ebmbim t\u00eb sigurt dhe t\u00eb verifikuar reciprokisht me \u00e7do sh\u00ebrbim tjet\u00ebr, p\u00ebr shembull, n\u00eb klastrin OpenShift.<\/p>\n<p>Aporeto \u00ebsht\u00eb n\u00eb gjendje t\u00eb gjeneroj\u00eb nj\u00eb identifikues unik jo vet\u00ebm p\u00ebr Kubernetes\/kontejner\u00ebt, por edhe p\u00ebr host\u00ebt, funksionet n\u00eb re dhe p\u00ebrdoruesit. N\u00eb var\u00ebsi t\u00eb k\u00ebtyre identifikuesve dhe setit t\u00eb rregullave t\u00eb siguris\u00eb n\u00eb rrjet, t\u00eb caktuara nga administratori, komunikimet do t\u00eb lejohet ose bllokohen.<\/p>\n<h3>Calico<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.projectcalico.org\/\">www.projectcalico.org<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/5902a133d4afc496f035de0f63129f99.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCalico zakonisht \u00ebsht\u00eb instaluar gjat\u00eb vendosjes s\u00eb orkestratorit t\u00eb kontejner\u00ebve, duke lejuar krijimin e nj\u00eb rrjeti virtual q\u00eb lidh kontejner\u00ebt. P\u00ebrve\u00e7 k\u00ebsaj funksionaliteti bazik rrjet\u00ebsor, projekti Calico punon me Politikat e Rrjetit Kubernetes dhe me nj\u00eb grup t\u00eb tij t\u00eb profilit t\u00eb siguris\u00eb rrjet\u00ebsore, mb\u00ebshtet ACL (listat e kontrollit t\u00eb qasjes) t\u00eb endpoint&#8217;eve dhe rregullat e siguris\u00eb rrjet\u00ebsore t\u00eb bazuara n\u00eb anotacione p\u00ebr trafik Ingress dhe Egress.<\/p>\n<h3>Cilium<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cilium.io\/\">www.cilium.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/2a9f3d1de52936c2f1a06d96fab054fb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCilium sh\u00ebrben si nj\u00eb firewall p\u00ebr kontejner\u00ebt dhe ofron funksionalitete p\u00ebr sigurin\u00eb e rrjetit, fillimisht t\u00eb p\u00ebrshtatura p\u00ebr Kubernetes dhe ngarkesat e pun\u00ebs mikrosherbimeve. Cilium p\u00ebrdor nj\u00eb teknologji t\u00eb re n\u00eb b\u00ebrtham\u00ebn Linux t\u00eb quajtur BPF (Berkeley Packet Filter) p\u00ebr filtrimin, monitorimin, redirektimin dhe rregullimin e t\u00eb dh\u00ebnave.<\/p>\n<p>Cilium \u00ebsht\u00eb n\u00eb gjendje t\u00eb zbatoj\u00eb politikat e aksesit n\u00eb rrjet bazuar n\u00eb identifikuesit e kontejner\u00ebve, duke p\u00ebrdorur etiketa Docker ose Kubernetes dhe meta-date. Cilium gjithashtu kupton dhe filtrin protokollet e nivelit t\u00eb 7, si HTTP ose gRPC, duke lejuar p\u00ebrcaktimin e nj\u00eb grupi t\u00eb thirrjeve REST q\u00eb, p\u00ebr shembull, do t\u00eb lejohet midis dy deployment&#8217;eve Kubernetes.<\/p>\n<h3>Istio<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/\">istio.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/da9e18500fffdf2c310182a4820c722d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIstio njihet gjer\u00ebsisht si nj\u00eb implementim i paradigmes service mesh p\u00ebrmes implementimit t\u00eb nj\u00eb plani kontrolli t\u00eb pavarur nga platforma dhe ridrejtimit t\u00eb t\u00ebr\u00eb trafikut t\u00eb sh\u00ebrbimit t\u00eb menaxhuar p\u00ebrmes proxy-ve Envoy t\u00eb konfiguruara dinamikisht. Istio e p\u00ebrdor k\u00ebt\u00eb prezantim t\u00eb avancuar t\u00eb t\u00eb gjitha mikrosh\u00ebrbimeve dhe kontejner\u00ebve p\u00ebr t\u00eb zbatuar strategji t\u00eb ndryshme t\u00eb siguris\u00eb n\u00eb rrjet.<\/p>\n<p>Aft\u00ebsit\u00eb e Istio n\u00eb sigurimin e siguris\u00eb n\u00eb rrjet p\u00ebrfshijn\u00eb enkriptimin transparent TLS p\u00ebr p\u00ebrmir\u00ebsimin automatik t\u00eb protokollit t\u00eb komunikimeve midis mikrosh\u00ebrbimeve n\u00eb HTTPS dhe nj\u00eb sistem t\u00eb brendsh\u00ebm RBAC p\u00ebr identifikimin dhe autorizimin p\u00ebr t\u00eb lejuar\/ndaluar shk\u00ebmbimin e t\u00eb dh\u00ebnave midis ngarkesave t\u00eb ndryshme n\u00eb klaster.<\/p>\n<p><i><b>Sh\u00ebn. p\u00ebrk.<\/b>: M\u00eb shum\u00eb rreth aft\u00ebsive t\u00eb Istio t\u00eb fokusuar n\u00eb siguri, lexoni n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443668\/\">k\u00ebt\u00eb artikull<\/a><\/noindex>.<\/i><\/p>\n<h3>Tigera<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tigera.io\/\">www.tigera.io<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/3568cf2fc634d4c40c45f0db4a08aa77.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb k\u00ebt\u00eb zgjidhje, t\u00eb quajtur \"brennembarr i Kubernetes\", \u00ebsht\u00eb fokusuar n\u00eb nj\u00eb qasje p\u00ebr sigurin\u00eb n\u00eb rrjet me besim zero.<\/p>\n<p>Sipas zgjidhjeve t\u00eb tjera t\u00eb rrjetit natyror p\u00ebr Kubernetes, Tigera mb\u00ebshtetet n\u00eb metadat p\u00ebr t\u00eb identifikuar sh\u00ebrbime dhe objekte t\u00eb ndryshme brenda klasterit dhe siguron zbulimin e problemeve n\u00eb runtime, verifikimin e vazhduesh\u00ebm t\u00eb p\u00ebrputhshm\u00ebris\u00eb dhe transparenc\u00ebn e rrjetit p\u00ebr infrastrukturen multi-recloud ose hibride me monolite t\u00eb kontenierizuara.<\/p>\n<h3>Trireme<\/h3>\n<p><\/p>\n<ul>\n<li>Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aporeto.com\/opensource\/\">www.aporeto.com\/open-source<\/a><\/noindex><\/li>\n<li>Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/5924b4c2a0f6324e9d946c0261cbc53f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTrireme-Kubernetes \u00ebsht\u00eb nj\u00eb implementim i thjesht\u00eb dhe t\u00eb kuptuesh\u00ebm i specifikimeve t\u00eb Politikave t\u00eb Rrjetit t\u00eb Kubernetes. Karakteristika m\u00eb e shquar \u00ebsht\u00eb se, ndryshe nga produktet e ngjashme p\u00ebr sigurin\u00eb e rrjetit Kubernetes, nuk k\u00ebrkon nj\u00eb plan t\u00eb kontrollit qendror p\u00ebr t\u00eb koordinuar rrjetin (mesh). Kjo e b\u00ebn zgjidhjen e thjesht\u00eb p\u00ebr t'u zgjeruar. N\u00eb Trireme, kjo arrihet duke instaluar nj\u00eb agjent n\u00eb \u00e7do nyje, i cili lidhet drejtp\u00ebrdrejt me stek\u00ebn TCP\/IP t\u00eb sistemit prit\u00ebs.<\/p>\n<h2>Shp\u00ebrndarja e imazheve dhe menaxhimi i sekreteve<\/h2>\n<p><\/p>\n<h3>Grafeas<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/grafeas.io\/\">grafeas.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/92c9986b36991d280cce0b1093e1938f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGrafeas \u2014 \u00ebsht\u00eb nj\u00eb API me kod t\u00eb hapur p\u00ebr auditim dhe menaxhimin e zinxhirit t\u00eb furnizimit t\u00eb softuerit. N\u00eb nivelin baz\u00eb, Grafeas paraqet nj\u00eb mjet p\u00ebr mbledhjen e metadatat dhe raporteve t\u00eb auditimit. Ai mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb ndjekur p\u00ebrputhshm\u00ebrin\u00eb me praktikat e mira t\u00eb siguris\u00eb n\u00eb nj\u00eb organizat\u00eb.<\/p>\n<p>Ky burim i centralizuar i s\u00eb v\u00ebrtet\u00ebs ndihmon n\u00eb p\u00ebrgjigjen e pyetjeve si:<\/p>\n<ul>\n<li> Kush e mbledh dhe n\u00ebnshkruan nj\u00eb konteiner t\u00eb caktuar?<\/li>\n<li> A e kaloi ai t\u00eb gjitha skanat e siguris\u00eb dhe verifikimet e parashikuara nga politika e siguris\u00eb? Kur? Cilat ishin rezultatet? <\/li>\n<li> Kush e implementoi at\u00eb n\u00eb production? Cilat parametra u p\u00ebrdor\u00ebn gjat\u00eb implementimit?<\/li>\n<\/ul>\n<p><\/p>\n<h3>In-toto<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/in-toto.github.io\/\">in-toto.github.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/91f0ba618f41dbadb07b37ec6999a736.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIn-toto \u00ebsht\u00eb nj\u00eb korniz\u00eb e zhvilluar p\u00ebr t\u00eb siguruar integritetin, autentikimin dhe auditimin e gjith\u00eb zinxhirit t\u00eb furnizimit t\u00eb softuerit. Kur In-toto implementohet n\u00eb infrastruktur\u00eb, fillimisht krijohet nj\u00eb plan q\u00eb p\u00ebrshkruan hapat e ndrysh\u00ebm n\u00eb pipeline (repositori, mjetet CI\/CD, mjetet QA, nd\u00ebrtuesit e artikujve, etj.) dhe p\u00ebrdoruesit (personat p\u00ebrgjegj\u00ebs) t\u00eb cil\u00ebve u lejohet t'i nisin ato.<\/p>\n<p>In-toto mbik\u00ebqyr p\u00ebrmbushjen e planit, duke verifikuar q\u00eb \u00e7do detyr\u00eb n\u00eb zinxhir p\u00ebrfundohet si\u00e7 duhet nga personeli i autorizuar dhe q\u00eb nuk jan\u00eb kryer manipulime t\u00eb paautorizuara gjat\u00eb procesit t\u00eb l\u00ebvizjes me produktin.<\/p>\n<h3>Portieris<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/IBM\/portieris\">github.com\/IBM\/portieris<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/ff9c24c88cd9a06c8bd35dfe4f3558cf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPortieris \u00ebsht\u00eb nj\u00eb kontrollues pranimi p\u00ebr Kubernetes; p\u00ebrdoret p\u00ebr kontrollin e detyruesh\u00ebm t\u00eb besueshm\u00ebris\u00eb s\u00eb p\u00ebrmbajtjes. Portieris p\u00ebrdor server <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/theupdateframework\/notary\">Notary<\/a><\/noindex> <i>(ne e kemi p\u00ebrmendur at\u00eb n\u00eb fund <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/340366\/\">k\u00ebt\u00eb artikull<\/a><\/noindex> \u2014 <b>sh\u00ebn. transl.<\/b>)<\/i> si burim t\u00eb v\u00ebrtet\u00ebs p\u00ebr konfirmimin e artefakteve t\u00eb besuara dhe t\u00eb n\u00ebnshkruara (dometh\u00ebn\u00eb, imazhe t\u00eb aprovuar kontejner).<\/p>\n<p>Kur krijohet ose modifikohet nj\u00eb ngarkes\u00eb n\u00eb Kubernetes, Portieris ngarkon informacionin e n\u00ebnshkrimit dhe politik\u00ebn e besueshm\u00ebris\u00eb p\u00ebr imazhet e k\u00ebrkuara t\u00eb kontejnerit dhe, n\u00ebse \u00ebsht\u00eb e nevojshme, b\u00ebn ndryshime n\u00eb koh\u00eb reale n\u00eb objektin JSON t\u00eb API-s\u00eb p\u00ebr t\u00eb nisur versionet e n\u00ebnshkruara t\u00eb k\u00ebtyre imazheve.<\/p>\n<h3>Vault<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.vaultproject.io\/\">www.vaultproject.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (MPL)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/19191a10051dc6349af017a06f0fd43e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVault \u2014 \u00ebsht\u00eb nj\u00eb zgjidhje e sigurt p\u00ebr ruajtjen e informacionit t\u00eb ndjesh\u00ebm: fjal\u00ebkalimeve, token\u00ebve OAuth, certifikatave PKI, llogarive p\u00ebr akses, sekretet Kubernetes etj. Vault mb\u00ebshtet shum\u00eb funksionalitete t\u00eb avancuara, si qiraja e token\u00ebve t\u00eb p\u00ebrkohsh\u00ebm t\u00eb siguris\u00eb ose organizimi i rotacionit t\u00eb \u00e7el\u00ebsave.<\/p>\n<p>Me ndihm\u00ebn e Helm chart-it, Vault mund t\u00eb vendoset si nj\u00eb deployment i ri n\u00eb klasterin Kubernetes me Consul&#8217;in si backend ruajtje. Ai mb\u00ebshtet burimet native t\u00eb Kubernetes, si tokenet e ServiceAccount dhe madje mund t\u00eb funksionoj\u00eb si ruajtje e sekretit Kubernetes p\u00ebrpar\u00ebsisht.<\/p>\n<p><i><b>Sh\u00ebn. p\u00ebrk.<\/b>: P\u00ebrve\u00e7 k\u00ebsaj, pik\u00ebrisht dje kompania HashiCorp, q\u00eb zhvillon Vault, shpalli disa p\u00ebrmir\u00ebsime p\u00ebr p\u00ebrdorimin e Vault n\u00eb Kubernetes, t\u00eb cilat ve\u00e7an\u00ebrisht prekin Helm-chart-in. Lexoni detajet n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.hashicorp.com\/blog\/whats-next-for-vault-and-kubernetes\">blogun e zhvilluesit<\/a><\/noindex>.<\/i><\/p>\n<h2>Auditimi i siguris\u00eb n\u00eb Kubernetes<\/h2>\n<p><\/p>\n<h3>Kube-bench<\/h3>\n<p><\/p>\n<ul>\n<li>Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/kube-bench\">github.com\/aquasecurity\/kube-bench<\/a><\/noindex><\/li>\n<li>Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/8e0e101503f02ea3033f7b29c9ee9ddf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKube-bench \u00ebsht\u00eb nj\u00eb aplikacion n\u00eb Go, q\u00eb kontrollon n\u00ebse Kubernetes-i \u00ebsht\u00eb i sigurt, duke kryer teste nga lista <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/container-compliance\/\">CIS Kubernetes Benchmark<\/a><\/noindex>.<\/p>\n<p>Kube-bench k\u00ebrkon konfigurime jo t\u00eb sigurta mes komponent\u00ebve t\u00eb klasterit (etcd, API, menaxher kontrolli, etj.), t\u00eb drejta t\u00eb dyshimta p\u00ebr akses n\u00eb skedar\u00eb, llogari t\u00eb paprojektuara ose porte t\u00eb hapura, kuota burimesh, cil\u00ebsime p\u00ebr kufizimin e numrit t\u00eb thirrjeve n\u00eb API p\u00ebr mbrojtje nga sulmet DoS, etj.<\/p>\n<h3>Kube-hunter<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/kube-hunter\">github.com\/aquasecurity\/kube-hunter<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/e5e38368af8bf086da149cbfd71a5e6d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKube-hunter \"gjufton\" p\u00ebr dob\u00ebsi potenciale (si ekzekutimi i kodit n\u00eb distanc\u00eb ose ekspozimi i t\u00eb dh\u00ebnave) n\u00eb klasteret Kubernetes. Kube-hunter mund t\u00eb ekzekutohet si nj\u00eb skaner n\u00eb distanc\u00eb \u2014 n\u00eb k\u00ebt\u00eb rast ai vler\u00ebson klasterin nga k\u00ebndv\u00ebshtrimi i nj\u00eb sulmuesi t\u00eb jasht\u00ebm \u2014 ose si pod brenda klasterit.<\/p>\n<p>Karakteristika e ve\u00e7ant\u00eb e Kube-hunter&#8217;it \u00ebsht\u00eb moda \"gjuetia aktive\", gjat\u00eb s\u00eb cil\u00ebs ai jo vet\u00ebm q\u00eb raporton p\u00ebr problemet, por gjithashtu p\u00ebrpiqet t\u00eb shfryt\u00ebzoj\u00eb p\u00ebrfitimet e gjetura n\u00eb klasterin e synuar, t\u00eb cilat potencialisht mund t\u00eb d\u00ebmtojn\u00eb funksionimin e tij. Pra, p\u00ebrdoreni me kujdes!<\/p>\n<h3>Kubeaudit<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Shopify\/kubeaudit\">github.com\/Shopify\/kubeaudit<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (MIT)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/84651a05f714b9c841245cb38f78324a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubeaudit \u2014 \u00ebsht\u00eb nj\u00eb mjet konsol, i krijuar fillimisht n\u00eb Shopify, p\u00ebr t\u00eb audituar konfigurimin e Kubernetes n\u00eb lidhje me problemet e ndryshme t\u00eb siguris\u00eb. P\u00ebr shembull, ai ndihmon n\u00eb zbulimin e konteiner\u00ebve q\u00eb funksionojn\u00eb pa kufizime, me privilegje superuser, q\u00eb abuzojn\u00eb me privilegjet ose q\u00eb p\u00ebrdorin ServiceAccount t\u00eb paracaktuar.<\/p>\n<p>Kubeaudit ka edhe disa funksione interesante. P\u00ebr shembull, ai mund t\u00eb analizoj\u00eb skedar\u00ebt lokal\u00eb YAML, duke zbuluar disavantazhe n\u00eb konfigurim q\u00eb mund t\u00eb shkaktojn\u00eb probleme me sigurin\u00eb, dhe t'i korrigjoj\u00eb automatikisht ato.<\/p>\n<h3>Kubesec<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/kubesec.io\/\">kubesec.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/73e395cdcbe89af391b80ff9dccad5f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubesec \u00ebsht\u00eb nj\u00eb mjet i ve\u00e7ant\u00eb sepse skanon drejtp\u00ebrdrejt skedar\u00ebt YAML q\u00eb p\u00ebrshkruajn\u00eb burimet e Kubernetes n\u00eb k\u00ebrkim t\u00eb parametrave t\u00eb dob\u00ebt q\u00eb mund t\u00eb ndikojn\u00eb n\u00eb siguri.<\/p>\n<p>P\u00ebr shembull, ai mund t\u00eb zbuloj\u00eb privilegje dhe leje tep\u00ebr t\u00eb dh\u00ebna pod&#8217;it, t\u00eb filloj\u00eb kontejnerin me root&#8217;in si p\u00ebrdoruesin e paracaktuar, t\u00eb lidhet me hap\u00ebsir\u00ebn emri t\u00eb rrjetit t\u00eb prit\u00ebsit ose montime t\u00eb rrezikshme si <code>\/proc<\/code> hostit ose socketin e Docker-it. Nj\u00eb mund\u00ebsi tjet\u00ebr interesante e Kubesec \u00ebsht\u00eb nj\u00eb sh\u00ebrbim demo i disponuesh\u00ebm n\u00eb internet, n\u00eb t\u00eb cilin mund t\u00eb ngarkohet YAML dhe t\u00eb b\u00ebhet nj\u00eb analiz\u00eb e menj\u00ebhershme.<\/p>\n<h3>Open Policy Agent<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openpolicyagent.org\/\">www.openpolicyagent.org<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/f897b58fbc67d9cb463008621f4e608f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKoncepci OPA (Open Policy Agent) \u00ebsht\u00eb q\u00eb t\u00eb ndash politikat e siguris\u00eb dhe praktikat m\u00eb t\u00eb mira n\u00eb fush\u00ebn e siguris\u00eb nga platforma specifike t\u00eb runtime-it: Docker, Kubernetes, Mesosphere, OpenShift ose \u00e7do kombinim t\u00eb tyre.<\/p>\n<p>P\u00ebr shembull, mund t\u00eb vendosni OPA si backend p\u00ebr admission controller-in e Kubernetes, duke i deleguar vendimet p\u00ebr sigurin\u00eb. K\u00ebshtu, agjenti OPA mund t\u00eb kontrolloj\u00eb, refuzoj\u00eb dhe madje t\u00eb ndryshoj\u00eb k\u00ebrkesat n\u00eb flak\u00eb, duke siguruar p\u00ebrputhshm\u00ebrin\u00eb me parametrat e caktuar t\u00eb siguris\u00eb. Politikat e siguris\u00eb n\u00eb OPA jan\u00eb shkruar n\u00eb gjuh\u00ebn e saj t\u00eb vetme DSL, Rego.<\/p>\n<p><i><b>Sh\u00ebn. p\u00ebrk.<\/b>: M\u00eb shum\u00eb rreth OPA (dhe SPIFFE) kemi shkruar n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/353808\/\">k\u00ebt\u00eb material<\/a><\/noindex>.<\/i><\/p>\n<h2>Mjetet komplekse tregtare p\u00ebr analiz\u00ebn e siguris\u00eb Kubernetes<\/h2>\n<p>\nNe vendos\u00ebm t\u00eb krijojm\u00eb nj\u00eb kategori t\u00eb ve\u00e7ant\u00eb p\u00ebr platformat tregtare, pasi ato zakonisht mbulojn\u00eb disa fusha t\u00eb siguris\u00eb. Nj\u00eb p\u00ebrmbledhje e mund\u00ebsive t\u00eb tyre mund t\u00eb merret nga tabela:<\/p>\n<p><img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/0dbe925006238ee242c452f05d9f7302.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>* Ekspertiz\u00eb t\u00eb avancuar dhe analiza post mortem me t\u00eb plot\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/use-cases\/container-forensics\/\">kapjen e thirrjeve sistemore<\/a><\/noindex>.<\/i><\/p>\n<h3>Aqua Security<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aquasec.com\/\">www.aquasec.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/d02026209908e9dac53be53fbdb178cd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKy mjet komercial \u00ebsht\u00eb i destinuar p\u00ebr kontejner\u00eb dhe ngarkesa pune n\u00eb cloud. Ai ofron:<\/p>\n<ul>\n<li> Skanim t\u00eb imazheve, t\u00eb integruar me regjistrin e kontejner\u00ebve ose pipelines CI\/CD;<\/li>\n<li> Mbrojtje Runtime me k\u00ebrkim t\u00eb ndryshimeve n\u00eb kontejner\u00eb dhe aktivitete t\u00eb tjera t\u00eb dyshimta;<\/li>\n<li> Firewall native p\u00ebr kontejner\u00eb;<\/li>\n<li> Siguri p\u00ebr serverless n\u00eb sh\u00ebrbimet cloud;<\/li>\n<li> Kontrollin p\u00ebr ekuilibrat e k\u00ebrkesave dhe auditimin, t\u00eb kombinuar me regjistrimin e ngjarjeve.<\/li>\n<\/ul>\n<p>\n<i><b>Sh\u00ebn. p\u00ebrk.<\/b>: Duhet t\u00eb theksohet gjithashtu se ka nj\u00eb <b>pjes\u00eb falas t\u00eb produktit quajtur <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/microscanner\">MicroScanner<\/a><\/noindex><\/b>, q\u00eb lejon skanimin e imazheve t\u00eb kontejner\u00ebve p\u00ebr vulnerabilitetet. Krahasimi i mund\u00ebsive t\u00eb saj me versionet e paguara paraqitet n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/microscanner#aqua-security-edition-comparison\">k\u00ebt\u00eb tabel\u00eb<\/a><\/noindex>.<\/i><\/p>\n<h3>Capsule8<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/\">capsule8.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/122be33f15d31f8f083189bca5c7158c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nCapsule8 integrom me infrastruktur\u00ebn, duke instaluar nj\u00eb detektor n\u00eb nj\u00eb kluster Kubernetes lokal ose n\u00eb cloud. Ky detektor mbledh telemetri t\u00eb hostit dhe rrjetit, duke e p\u00ebrputhur me lloje t\u00eb ndryshme sulmesh.<\/p>\n<p>Ekipi i Capsule8 e sheh si detyr\u00eb t\u00eb saj zbulimin e hersh\u00ebm dhe parandalimin e sulmeve q\u00eb p\u00ebrdorin <i>0-day<\/i> dobit\u00eb. Capsule8 mund t\u00eb ngarkoj\u00eb rregulla t\u00eb rafinuara sigurie direkt n\u00eb detektor\u00ebt n\u00eb p\u00ebrgjigje t\u00eb k\u00ebrc\u00ebnimeve t\u00eb reja t\u00eb zbuluara dhe dob\u00ebsive t\u00eb software-it.<\/p>\n<h3>Cavirin<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cavirin.com\/\">www.cavirin.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/896310c9258943041664ca55b3926d35.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCavirin vepron si kontraktues p\u00ebr kompanin\u00eb p\u00ebr agjencit\u00eb e ndryshme q\u00eb merren me standardet e siguris\u00eb. Ai jo vet\u00ebm q\u00eb mund t\u00eb skanoj\u00eb imazhet, por gjithashtu t\u00eb integrohet n\u00eb CI\/CD-kanalin, duke bllokuar imazhet q\u00eb nuk p\u00ebrputhen me standardet para se ato t\u00eb shkojn\u00eb n\u00eb depo t\u00eb mbyllura.<\/p>\n<p>Paketa e siguris\u00eb Cavirin p\u00ebrdor m\u00ebsimin e makineris\u00eb p\u00ebr t\u00eb vler\u00ebsuar gjendjen e siguris\u00eb kibernetike, ofron k\u00ebshilla p\u00ebr rritjen e siguris\u00eb dhe p\u00ebrmir\u00ebsimin e p\u00ebrputhshm\u00ebris\u00eb me standartet e siguris\u00eb.<\/p>\n<h3>Google Cloud Security Command Center<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/cloud.google.com\/security-command-center\/\">cloud.google.com\/security-command-center<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/d9ac37b3d2b9be7fd6fcd6afe0d985e6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nQendra e Komand\u00ebs s\u00eb Siguris\u00eb n\u00eb Cloud ndihmon ekipet e siguris\u00eb t\u00eb grumbullojn\u00eb t\u00eb dh\u00ebna, t\u00eb identifikojn\u00eb k\u00ebrc\u00ebnimet dhe t'i eliminojn\u00eb ato p\u00ebrpara se t\u00eb d\u00ebmtojn\u00eb kompanin\u00eb.<\/p>\n<p>Si\u00e7 e sugjeron emri, Google Cloud SCC \u00ebsht\u00eb nj\u00eb panel i unifikuar kontrolli, n\u00eb t\u00eb cilin mund t\u00eb integrohen raporte t\u00eb ndryshme t\u00eb siguris\u00eb, mekanizma p\u00ebr llogaritjen e aseteve dhe sisteme t\u00eb jashtme sigurie, duke i menaxhuar ato nga nj\u00eb burim t\u00eb vet\u00ebm, t\u00eb centralizuar.<\/p>\n<p>API i nd\u00ebrvepruesh\u00ebm i ofruar nga Google Cloud SCC leht\u00ebson integrimin e ngjarjeve n\u00eb fush\u00ebn e siguris\u00eb t\u00eb marra nga burime t\u00eb ndryshme, si\u00e7 jan\u00eb Sysdig Secure (siguria e kontejner\u00ebve p\u00ebr aplikacione cloud-native) ose Falco (sistem sigurie runtime me burim t\u00eb hapur).<\/p>\n<h3>Layered Insight (Qualys)<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/layeredinsight.com\/\">layeredinsight.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/31e0266c670a991824c029f9445cf480.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLayered Insight (tani pjes\u00eb e Qualys Inc) \u00ebsht\u00eb nd\u00ebrtuar mbi konceptin e \"siguris\u00eb s\u00eb integruar\". Pas skanimit t\u00eb k\u00ebsaj pamjeje origjinale p\u00ebr t\u00eb gjetur vulnerabilitete me metoda t\u00eb analiz\u00ebs statistikore dhe kryerjes s\u00eb kontrollimeve b\u00ebjn\u00eb sipas CVE, Layered Insight e z\u00ebvend\u00ebson at\u00eb me nj\u00eb pamje t\u00eb instrumentuar q\u00eb p\u00ebrfshin nj\u00eb agjent n\u00eb form\u00eb binari.<\/p>\n<p>Ky agjent p\u00ebrmban teste sigurie p\u00ebr runtime p\u00ebr t\u00eb analizuar trafikun rrjetor t\u00eb kontejner\u00ebve, rrjedhat I\/O dhe aktivitetin e aplikacionit. P\u00ebr m\u00eb tep\u00ebr, ai mund t\u00eb kryej\u00eb kontrolle t\u00eb tjera sigurie t\u00eb caktuara nga administratori i infrastruktur\u00ebs ose ekipet DevOps.<\/p>\n<h3>NeuVector<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/neuvector.com\/\">neuvector.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/db9558498c4c5cd876083d7a5bb41ab4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNeuVector b\u00ebn nj\u00eb kontroll t\u00eb siguris\u00eb s\u00eb kontejner\u00ebve dhe siguron mbrojtje n\u00eb runtime duke analizuar aktivitetin e rrjetit dhe sjelljen e aplikacionit, duke krijuar nj\u00eb profil t\u00eb ve\u00e7ant\u00eb t\u00eb siguris\u00eb p\u00ebr \u00e7do kontejner. Ai gjithashtu mund t\u00eb bllokoj\u00eb vet\u00eb k\u00ebrc\u00ebnimet duke izoluar aktivitetin e dyshimt\u00eb p\u00ebrmes ndryshimit t\u00eb rregullave t\u00eb firewall-it lokal.<\/p>\n<p>Integrimi rrjetor i NeuVector, i njohur si Security Mesh, \u00ebsht\u00eb i aft\u00eb t\u00eb kryej\u00eb analiz\u00eb t\u00eb thell\u00eb t\u00eb paketave dhe filtrimin n\u00eb nivelin e 7-t\u00eb p\u00ebr t\u00eb gjitha lidhjet rrjetore n\u00eb service mesh.<\/p>\n<h3>StackRox<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.stackrox.com\/\">www.stackrox.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/9b8d013860518fab67e84344eaa1de91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPlatforma p\u00ebr sigurimin e konteiner\u00ebve StackRox p\u00ebrpiqet t\u00eb mbuloj\u00eb gjith\u00eb ciklin e jet\u00ebs s\u00eb aplikacioneve Kubernetes n\u00eb klaster. Ashtu si platformat e tjera tregtare n\u00eb k\u00ebt\u00eb list\u00eb, StackRox gjeneron nj\u00eb profil n\u00eb koh\u00eb reale bazuar n\u00eb sjelljen e v\u00ebzhguar t\u00eb konteinerit dhe automatikisht jep alarmin n\u00eb rast t\u00eb \u00e7do devijimi.<\/p>\n<p>P\u00ebrve\u00e7 k\u00ebsaj, StackRox analizon konfigurimet e Kubernetes, duke p\u00ebrdorur CIS Kubernetes dhe kode t\u00eb tjera p\u00ebr t\u00eb vler\u00ebsuar p\u00ebrputhshm\u00ebrin\u00eb e konteiner\u00ebve.<\/p>\n<h3>Sysdig Secure<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/\">sysdig.com\/products\/secure<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/a36518809970479fe435e505c231eff8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSysdig Secure mbron aplikacionet gjat\u00eb gjith\u00eb ciklit t\u00eb jet\u00ebs s\u00eb konteinerit dhe Kubernetes. Ai <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/image-scanning\/\">skanon imazhet<\/a><\/noindex> kontejner\u00ebve, siguron <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/runtime-security\/\">mbrojtjen runtime<\/a><\/noindex> sipas t\u00eb dh\u00ebnave t\u00eb m\u00ebsimit t\u00eb makineris\u00eb, kryen ekspertiz\u00eb kriminale p\u00ebr identifikimin e dob\u00ebsive, bllokon k\u00ebrc\u00ebnimet, dhe monitoron <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/container-compliance\/\">p\u00ebrputhshm\u00ebrin\u00eb me standardet e vendosura<\/a><\/noindex> dhe kryen auditimin e aktiviteteve n\u00eb mikroshem\u00f9j.<\/p>\n<p>Sysdig Secure integrohet me vegla CI\/CD, si Jenkins, dhe monitoron imazhet q\u00eb ngarkohen nga regjistrat Docker, duke parandaluar shfaqjen e imazheve t\u00eb rrezikshme n\u00eb production. Ai gjithashtu siguron nj\u00eb mbrojtje t\u00eb plot\u00eb runtime, p\u00ebrfshir\u00eb:<\/p>\n<ul>\n<li> profilizimin runtime t\u00eb bazuar n\u00eb ML dhe zbulimin e anomalis\u00eb;<\/li>\n<li> politikat runtime t\u00eb bazuara n\u00eb ngjarjet sistemore, API K8s-audit, projekte t\u00eb p\u00ebrbashk\u00ebta n\u00eb komunitet (FIM \u2014 monitorimi i integritetit t\u00eb skedave; cryptojacking) dhe korniz\u00ebn <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/blog\/mitre-attck-framework-for-container-runtime-security-with-sysdig-falco\/\">MITRE ATT&amp;CK<\/a><\/noindex>;<\/li>\n<li> reagimin dhe eliminimin e incidenteve.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Tenable Container Security<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/products\/tenable-io\/container-security\">www.tenable.com\/products\/tenable-io\/container-security<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/2b3799ee94628c04104f6cead8be8749.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPara shfaqjes s\u00eb kontejner\u00ebve, Tenable ishte e njohur gjer\u00ebsisht n\u00eb industri si kompania q\u00eb zhvilloi Nessus \u2014 nj\u00eb mjet popullor p\u00ebr identifikimin e dob\u00ebsive dhe auditimin e siguris\u00eb.<\/p>\n<p>Tenable Container Security p\u00ebrdor p\u00ebrvoj\u00ebn e kompanis\u00eb n\u00eb fush\u00ebn e siguris\u00eb kibernetike p\u00ebr t'u integruar me pipeline-in CI\/CD dhe bazat e t\u00eb dh\u00ebnave t\u00eb dob\u00ebsive, paketat e specializuara p\u00ebr zbulimin e malware-it dhe rekomandimet p\u00ebr leht\u00ebsimin e k\u00ebrc\u00ebnimeve t\u00eb siguris\u00eb.<\/p>\n<h3>Twistlock (Palo Alto Networks)<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja e internetit: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.twistlock.com\/\">www.twistlock.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb n\u00eb Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/98213c84bafaeca1e0d6bca3e1a80d23.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTwistlock pozicionohet si nj\u00eb platform\u00eb e orientuar ndaj sh\u00ebrbimeve n\u00eb re dhe kontejner\u00ebve. Twistlock mb\u00ebshtet ofrues t\u00eb ndrysh\u00ebm sh\u00ebrbimesh n\u00eb re (AWS, Azure, GCP), orkestrues kontejner\u00ebsh (Kubernetes, Mesosphere, OpenShift, Docker), ambiente ekzekutimi pa server dhe framework-e p\u00ebr mesh dhe mjete CI\/CD.<\/p>\n<p>P\u00ebrve\u00e7 metodave tradicionale t\u00eb siguris\u00eb p\u00ebr nivelin korporativ, si integrimi n\u00eb pipeline-in CI\/CD ose skanimi i imazheve, Twistlock p\u00ebrdor m\u00ebsimin e makinerive p\u00ebr t\u00eb gjeneruar modele sjelljeje dhe rregulla rrjetesh duke konsideruar karakteristikat e kontejner\u00ebve.<\/p>\n<p>Disa koh\u00eb m\u00eb par\u00eb, Twistlock u ble nga Palo Alto Networks, q\u00eb zot\u00ebron projektet Evident.io dhe RedLock. Nuk dihet ende se si do t\u00eb integrohen k\u00ebto tri platforma n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/cloud-security\">PRISMA<\/a><\/noindex> nga Palo Alto.<\/p>\n<h2>Ndihmoni n\u00eb krijimin e nj\u00eb katalogu m\u00eb t\u00eb mir\u00eb t\u00eb veglave p\u00ebr sigurimin e Kubernetes!<\/h2>\n<p>\nNe synojm\u00eb ta b\u00ebjm\u00eb k\u00ebt\u00eb katalog sa m\u00eb t\u00eb plot\u00eb, dhe p\u00ebr k\u00ebt\u00eb na nevojitet ndihma juaj! Na kontaktoni (<noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/sysdig\">@sysdig<\/a><\/noindex>), n\u00ebse keni parasysh ndonj\u00eb mjet t\u00eb shk\u00eblqyer q\u00eb meriton t\u00eb p\u00ebrfshihet n\u00eb k\u00ebt\u00eb list\u00eb, ose n\u00ebse keni zbuluar nj\u00eb gabim\/informacion t\u00eb vjet\u00ebr.<\/p>\n<p>Gjithashtu mund t\u00eb abonoheni n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/go.sysdig.com\/container-newsletter-signup.html\">newsletter-in ton\u00eb t\u00eb p\u00ebrmuajsh\u00ebm<\/a><\/noindex> me lajmet e ekosistem\u00ebs cloud-native dhe tregime p\u00ebr projekte interesante nga bota e siguris\u00eb n\u00eb Kubernetes.<\/p>\n<h2>P.S. nga p\u00ebrkthyesi<\/h2>\n<p>\nLexoni gjithashtu n\u00eb blogun ton\u00eb:<\/p>\n<ul>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443190\/\">Nj\u00eb hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440504\/\">Docker dhe Kubernetes n\u00eb mjedise t\u00eb k\u00ebrkuara p\u00ebr siguri<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/436300\/\">9 praktikat m\u00eb t\u00eb mira p\u00ebr sigurimin e Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/417905\/\">11 m\u00ebnyra (jo) p\u00ebr t\u00eb qen\u00eb viktim\u00eb e hakimit n\u00eb Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/353808\/\">OPA dhe SPIFFE \u2014 dy projekte t\u00eb reja n\u00eb CNCF p\u00ebr sigurin\u00eb e aplikacioneve n\u00eb re<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/465141\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0415\u0441\u043b\u0438 \u0432\u044b \u0437\u0430\u0434\u0430\u0451\u0442\u0435\u0441\u044c \u0432\u043e\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Kubernetes, \u044d\u0442\u043e\u0442 \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0437\u043e\u0440 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Sysdig \u0441\u0442\u0430\u043d\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u043d\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0434\u043b\u044f \u0431\u0435\u0433\u043b\u043e\u0433\u043e \u0437\u043d\u0430\u043a\u043e\u043c\u0441\u0442\u0432\u0430 \u0441 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u044f\u043c\u0438. \u0412 \u043d\u0435\u0433\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u0433\u0440\u043e\u043a\u043e\u0432 \u0440\u044b\u043d\u043a\u0430, \u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u0441\u043a\u0440\u043e\u043c\u043d\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0442\u0443 \u0438\u043b\u0438 \u0438\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0410 \u0432 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u043c\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28890,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38497","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 4.9.10 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0415\u0441\u043b\u0438 \u0432\u044b \u0437\u0430\u0434\u0430\u0451\u0442\u0435\u0441\u044c \u0432\u043e\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Kubernetes, \u044d\u0442\u043e\u0442 \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0437\u043e\u0440 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Sysdig \u0441\u0442\u0430\u043d\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u043d\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0434\u043b\u044f \u0431\u0435\u0433\u043b\u043e\u0433\u043e \u0437\u043d\u0430\u043a\u043e\u043c\u0441\u0442\u0432\u0430 \u0441 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u044f\u043c\u0438. \u0412 \u043d\u0435\u0433\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u0433\u0440\u043e\u043a\u043e\u0432 \u0440\u044b\u043d\u043a\u0430, \u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u0441\u043a\u0440\u043e\u043c\u043d\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0442\u0443 \u0438\u043b\u0438 \u0438\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0410 \u0432 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u043c\u044b\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 4.9.10\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4733+ \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Kubernetes | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0415\u0441\u043b\u0438 \u0432\u044b \u0437\u0430\u0434\u0430\u0451\u0442\u0435\u0441\u044c \u0432\u043e\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Kubernetes, \u044d\u0442\u043e\u0442 \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0437\u043e\u0440 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Sysdig \u0441\u0442\u0430\u043d\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u043d\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0434\u043b\u044f \u0431\u0435\u0433\u043b\u043e\u0433\u043e \u0437\u043d\u0430\u043a\u043e\u043c\u0441\u0442\u0432\u0430 \u0441 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u044f\u043c\u0438. \u0412 \u043d\u0435\u0433\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u0433\u0440\u043e\u043a\u043e\u0432 \u0440\u044b\u043d\u043a\u0430, \u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u0441\u043a\u0440\u043e\u043c\u043d\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0442\u0443 \u0438\u043b\u0438 \u0438\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0410 \u0432 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u043c\u044b\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:24:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:24:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4733+ mjete p\u00ebr sigurin\u00eb e Kubernetes | ProHoster","description":"Sh\u00ebn. p\u00ebrkth: N\u00ebse jeni t\u00eb interesuar p\u00ebr pyetje mbi sigurin\u00eb n\u00eb infrastruktur\u00ebn e bazuar n\u00eb Kubernetes, kjo p\u00ebrmbledhje e shk\u00eblqyer nga Sysdig do t\u00eb jet\u00eb nj\u00eb pik\u00ebnisje e shk\u00eblqyer p\u00ebr t\u2019u njohur me zgjidhjet m\u00eb aktuale. Ajo p\u00ebrfshin sisteme komplekse nga lojtar\u00ebt e njohur n\u00eb treg, si dhe mjete shum\u00eb m\u00eb t\u00eb modest\u00eb q\u00eb adresojn\u00eb ndonj\u00eb problem t\u00eb caktuar. Dhe n\u00eb komentet ne","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4733+ \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Kubernetes | ProHoster","og:description":"\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0415\u0441\u043b\u0438 \u0432\u044b \u0437\u0430\u0434\u0430\u0451\u0442\u0435\u0441\u044c \u0432\u043e\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Kubernetes, \u044d\u0442\u043e\u0442 \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0437\u043e\u0440 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Sysdig \u0441\u0442\u0430\u043d\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u043d\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0434\u043b\u044f \u0431\u0435\u0433\u043b\u043e\u0433\u043e \u0437\u043d\u0430\u043a\u043e\u043c\u0441\u0442\u0432\u0430 \u0441 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u044f\u043c\u0438. \u0412 \u043d\u0435\u0433\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u0433\u0440\u043e\u043a\u043e\u0432 \u0440\u044b\u043d\u043a\u0430, \u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u0441\u043a\u0440\u043e\u043c\u043d\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0442\u0443 \u0438\u043b\u0438 \u0438\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0410 \u0432 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u043c\u044b","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:24:06+00:00","article:modified_time":"2019-10-31T19:24:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38497","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 22:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:08:31","updated":"2026-01-23 22:17:19"},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/38497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=38497"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/38497\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/28890"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=38497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=38497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=38497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}