{"id":38497,"date":"2019-10-31T22:24:06","date_gmt":"2019-10-31T19:24:06","guid":{"rendered":"https:\/\/prohoster.info\/blog\/33-instrumenta-dlya-bezopasnosti-kubernetes\/"},"modified":"2019-10-31T22:24:06","modified_gmt":"2019-10-31T19:24:06","slug":"33-instrumenta-dlya-bezopasnosti-kubernetes","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","title":{"rendered":"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"<p><i><b>Sh\u00ebn. p\u00ebrkth.<\/b>: N\u00ebse po pyesni p\u00ebr sigurin\u00eb n\u00eb infrastrukturat e bazuara n\u00eb Kubernetes, ky p\u00ebrmbledhje e mrekullueshme nga Sysdig do t\u00eb jet\u00eb nj\u00eb pik\u00eb e shk\u00eblqyer fillestare p\u00ebr nj\u00eb njohje t\u00eb shpejt\u00eb me zgjidhjet m\u00eb aktuale. Ajo p\u00ebrfshin sistemet komplekse nga lojtar\u00ebt e njohur t\u00eb tregut, si dhe mjete shum\u00eb m\u00eb modest q\u00eb zgjidhin nj\u00eb ose tjet\u00ebr problem. N\u00eb komentet posht\u00eb do t\u00eb jemi gjithmon\u00eb t\u00eb lumtur t\u00eb d\u00ebgjojm\u00eb p\u00ebr p\u00ebrvojat tuaja me k\u00ebto mjete dhe t\u00eb shohim lidhje me projekte t\u00eb tjera.<\/i><\/p>\n<p><img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/4d9aa6583128844afadc1b06996c29b6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nProdukte softuerike p\u00ebr sigurimin e Kubernetes\u2026 ka aq shum\u00eb, dhe secili ka q\u00ebllimet, fushat e aplikimit dhe licencat e veta.<\/p>\n<p>Pik\u00ebrisht p\u00ebr k\u00ebt\u00eb arsye ne vendos\u00ebm t\u00eb krijojm\u00eb k\u00ebt\u00eb list\u00eb dhe e p\u00ebrfshim\u00eb si projekte t\u00eb hapura ashtu edhe plataforma tregtare nga ofrues t\u00eb ndrysh\u00ebm. Shpresojm\u00eb se ajo do t'ju ndihmoj\u00eb t\u00eb zgjidhni ato q\u00eb ju interesojn\u00eb m\u00eb shum\u00eb dhe do t'ju drejtoj\u00eb n\u00eb drejtimin e duhur n\u00eb var\u00ebsi t\u00eb nevojave specifike p\u00ebr sigurimin e Kubernetes.<noindex><a rel=\"nofollow\" name=\"habracut\"><\/a><\/noindex><\/p>\n<h2>Kategorit\u00eb<\/h2>\n<p>\nP\u00ebr t\u00eb simplifikuar navigimin n\u00eb list\u00eb, mjetet jan\u00eb ndar\u00eb sipas funksioneve kryesore dhe fushave t\u00eb aplikimit. Kemi marr\u00eb p\u00ebrsip\u00ebr k\u00ebto pjes\u00eb:<\/p>\n<ul>\n<li> Skansimi i imazheve t\u00eb Kubernetes dhe analiza statike;<\/li>\n<li> Siguria runtime;<\/li>\n<li> Siguria rrjetit t\u00eb Kubernetes;<\/li>\n<li> Shperndarja e imazheve dhe menaxhimi i sekreteve;<\/li>\n<li> Auditimi i siguris\u00eb s\u00eb Kubernetes;<\/li>\n<li> Produkte komerciale komplekse.<\/li>\n<\/ul>\n<p>\nT\u00eb kalojm\u00eb ne pun\u00eb:<\/p>\n<h2>Skansimi i imazheve t\u00eb Kubernetes<\/h2>\n<p><\/p>\n<h3>Anchore<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/anchore.com\">anchore.com<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache) dhe ofert\u00eb komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/2c942e5a104feb4840a426157d5457f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPaketa Anchore analizon imazhet e konteiner\u00ebve dhe mund\u00ebson kryerjen e verifikimeve t\u00eb siguris\u00eb mbi baz\u00ebn e politikave t\u00eb p\u00ebrcaktuara nga p\u00ebrdoruesi.<\/p>\n<p>P\u00ebrve\u00e7 skanimit t\u00eb zakonsh\u00ebm t\u00eb imazheve t\u00eb konteiner\u00ebve p\u00ebr njohje t\u00eb dob\u00ebsive t\u00eb njohura nga databaza CVE, Anchore kryen nj\u00eb s\u00ebr\u00eb kontrollesh t\u00eb tjera t\u00eb shtuar n\u00eb politik\u00ebn e skanimit: kontrollon Dockerfile, rrjedhjen e kredencialeve, paketat e gjuh\u00ebve t\u00eb programimit t\u00eb p\u00ebrdorura (npm, maven etj.), licencat e softuerit dhe shum\u00eb m\u00eb tep\u00ebr.<\/p>\n<h3>Clair<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/coreos.com\/clair\">coreos.com\/clair<\/a><\/noindex> <i>(tani n\u00ebn mbik\u00ebqyrjen e Red Hat)<\/i><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/81be8927c1fcbfa5d714836a1db3c7d8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nClair ka qen\u00eb nj\u00eb nga projektet e para Open Source p\u00ebr skanimin e imazheve. Ai \u00ebsht\u00eb i njohur gjer\u00ebsisht si skaneri i siguris\u00eb n\u00eb thelb t\u00eb regjistrit t\u00eb imazheve Quay <i>(po ashtu nga CoreOS \u2014 <b>sh\u00ebnim i p\u00ebrkthyesit.<\/b>)<\/i>. Clair \u00ebsht\u00eb n\u00eb gjendje t\u00eb grumbulloj\u00eb informacion mbi CVE nga shum\u00eb burime, duke p\u00ebrfshir\u00eb lista specifike p\u00ebr distribucione Linux t\u00eb dob\u00ebsive, t\u00eb cilat mbahen nga ekipet e siguris\u00eb t\u00eb Debian, Red Hat ose Ubuntu.<\/p>\n<p>N\u00eb ndryshim nga Anchore, Clair kryesisht merret me gjetjen e dob\u00ebsive dhe p\u00ebrputhjen e t\u00eb dh\u00ebnave me CVE. Megjithat\u00eb, produkti ofron p\u00ebrdoruesve disa mund\u00ebsi p\u00ebr t\u00eb zgjeruar funksionalitetet p\u00ebrmes shofer\u00ebve t\u00eb lidhur.<\/p>\n<h3>Dagda<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/eliasgranderubio\/dagda\">github.com\/eliasgranderubio\/dagda<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/242930fcb99017f80f7cfc2a676e16ef.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nDagda kryen nj\u00eb analiz\u00eb statike t\u00eb imazheve t\u00eb kontejner\u00ebve p\u00ebr t\u00eb zbuluar dob\u00ebsi t\u00eb njohura, trojans, viruse, malware dhe k\u00ebrc\u00ebnime t\u00eb tjera.<\/p>\n<p>Nga mjetet e tjera t\u00eb ngjashme, paketa Dagda shquhet p\u00ebr dy karakteristika t\u00eb r\u00ebnd\u00ebsishme:<\/p>\n<ul>\n<li> Ajo integrohet shk\u00eblqyesh\u00ebm me <noindex><a rel=\"nofollow\" href=\"https:\/\/www.clamav.net\/\">ClamAV<\/a><\/noindex>, duke sh\u00ebrbyer jo vet\u00ebm si nj\u00eb mjet p\u00ebr skanimin e imazheve t\u00eb kontejner\u00ebve, por edhe si antivirus.<\/li>\n<li> Gjithashtu ofron mbrojtje runtime, duke marr\u00eb ngjarje n\u00eb koh\u00eb reale nga demoni i Docker dhe duke u integruar me Falco <i>(shih m\u00eb posht\u00eb)<\/i> p\u00ebr t\u00eb grumbulluar ngjarje sigurie gjat\u00eb funksionimit t\u00eb kontejnerit.<\/li>\n<\/ul>\n<p><\/p>\n<h3>KubeXray<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/jfrog\/kubexray\">github.com\/jfrog\/kubexray<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache), por k\u00ebrkon q\u00eb t\u00eb marrin t\u00eb dh\u00ebna nga JFrog Xray (produkt tregtar)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/f3aafb0d694b810fd5a7046c270e3b4d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubeXray \u201endjek\u201c ngjarjet e API-serverit Kubernetes dhe me ndihm\u00ebn e metadatat nga JFrog Xray siguron q\u00eb t\u00eb nisin vet\u00ebm pod\u00ebt q\u00eb p\u00ebrputhen me politik\u00ebn aktuale.<\/p>\n<p>KubeXray jo vet\u00ebm q\u00eb auditon kontejner\u00ebt e rinj ose t\u00eb p\u00ebrdit\u00ebsuar n\u00eb deployment (n\u00eb m\u00ebnyr\u00eb t\u00eb ngjashme me kontrolluesin e pranimit n\u00eb Kubernetes), por gjithashtu kontrollon dinamikisht kontejner\u00ebt n\u00eb pun\u00eb p\u00ebr p\u00ebrputhshm\u00ebrin\u00eb me politikat e reja t\u00eb siguris\u00eb, duke fshir\u00eb burimet q\u00eb lidhen me imazhe t\u00eb cenueshme.<\/p>\n<h3>Snyk<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/snyk.io\/\">snyk.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache) dhe versionet komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/a36ded26e3a659474c1c154bc3e753bb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSnyk \u00ebsht\u00eb nj\u00eb skaner i ve\u00e7ant\u00eb p\u00ebr dob\u00ebsit\u00eb n\u00eb at\u00eb kuptim q\u00eb \u00ebsht\u00eb konkretisht i orientuar drejt procesit t\u00eb zhvillimit dhe promovohet si \"zgjidhja e paz\u00ebvend\u00ebsueshme\" p\u00ebr zhvilluesit.<\/p>\n<p>Snyk lidh drejtp\u00ebrdrejt me repozitorit\u00eb e kodit, analizon manifestin e projektit dhe shqyrton kodin e importuar s\u00eb bashku me var\u00ebsit\u00eb direkte dhe t\u00eb t\u00ebrthorta. Snyk mb\u00ebshtet shum\u00eb gjuh\u00eb programimi popullore dhe mund t\u00eb identifikoj\u00eb rreziqe t\u00eb fshehura t\u00eb licencave.<\/p>\n<h3>Trivy<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/knqyf263\/trivy\">github.com\/knqyf263\/trivy<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (AGPL)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/b21dd72d590d719a7d13741117002999.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTrivy \u2014 nj\u00eb skaner i thjesht\u00eb, por t\u00eb fuqish\u00ebm p\u00ebr dob\u00ebsit\u00eb n\u00eb konteiner\u00eb, i integruesh\u00ebm leht\u00ebsisht n\u00eb pipeline-in CI\/CD. Karakteristika e tij e shquar \u00ebsht\u00eb thjesht\u00ebsia e instalimit dhe funksionimit: aplikacioni p\u00ebrb\u00ebhet nga nj\u00eb binar dhe nuk k\u00ebrkon instalimin e nj\u00eb baze t\u00eb dh\u00ebnash ose bibliotekash shtes\u00eb.<\/p>\n<p>Ankthi i thjesht\u00ebsis\u00eb s\u00eb Trivy \u00ebsht\u00eb se do t\u00eb duhet t\u00eb kuptoni se si t\u00eb lexoni dhe t\u00eb d\u00ebrgoni rezultatet n\u00eb formatin JSON, n\u00eb m\u00ebnyr\u00eb q\u00eb t\u00eb mund t\u00eb shfryt\u00ebzohen nga mjete t\u00eb tjera t\u00eb siguris\u00eb Kubernetes.<\/p>\n<h2>Siguria e runtime n\u00eb Kubernetes<\/h2>\n<p><\/p>\n<h3>Falco<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/falco.org\/\">falco.org<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/0e2601a1ec4ec56ed9daea5f34f36e9a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nFalco \u00ebsht\u00eb nj\u00eb grup tools p\u00ebr sigurimin e mjediseve cloud t\u00eb ekzekutimit. Ai \u00ebsht\u00eb pjes\u00eb e familjes s\u00eb projekteve <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cncf.io\/sandbox-projects\/\">CNCF<\/a><\/noindex>.<\/p>\n<p>Duke p\u00ebrdorur mjetet Sysdig p\u00ebr t\u00eb punuar n\u00eb nivelin e kernel-it Linux dhe profilerimin e thirrjeve sistemi, Falco lejon t\u00eb thellohet n\u00eb sjelljen e sistemit. Mekanizmi i tij i rregullave t\u00eb runtime-it \u00ebsht\u00eb n\u00eb gjendje t\u00eb zbuloj\u00eb aktivitet t\u00eb dyshimt\u00eb n\u00eb aplikacione, konteiner\u00eb, hostin baz\u00eb dhe orkestratorin Kubernetes.<\/p>\n<p>Falco siguron transparenc\u00eb t\u00eb plot\u00eb n\u00eb funksionimin e runtime-it dhe zbulimin e k\u00ebrc\u00ebnimeve, duke vendosur agjent\u00eb t\u00eb ve\u00e7ant\u00eb n\u00eb nyjet Kubernetes. Si rezultat, nuk ka nevoj\u00eb t\u00eb modifikoni kontejner\u00ebt duke inkorporuar kod t\u00eb jasht\u00ebm apo duke shtuar kontejner\u00eb sidecar.<\/p>\n<h3>Kornizat e siguris\u00eb s\u00eb Linux p\u00ebr runtime<\/h3>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/18f219ca98e481376265b753b638a7ec.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nK\u00ebto korniza native p\u00ebr kernel-in Linux nuk jan\u00eb \"mjete sigurie Kubernetes\" n\u00eb kuptimin e zakonsh\u00ebm, megjithat\u00eb meritojn\u00eb t\u00eb p\u00ebrmenden, pasi p\u00ebrfaq\u00ebsojn\u00eb nj\u00eb element t\u00eb r\u00ebnd\u00ebsish\u00ebm n\u00eb kontekstin e siguris\u00eb n\u00eb runtime, e cila p\u00ebrfshihet n\u00eb Politikat e Siguris\u00eb s\u00eb Pod-it Kubernetes (PSP).<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/gitlab.com\/apparmor\/apparmor\/wikis\/home\/\">AppArmor<\/a><\/noindex> lidhen me profilin e siguris\u00eb p\u00ebr proceset q\u00eb ekzekutohen n\u00eb konteiner, duke p\u00ebrcaktuar privilegjet e sistemit t\u00eb skedar\u00ebve, rregullat e aksesit n\u00eb rrjet, lidhjen e bibliotekave, etj. Kjo \u00ebsht\u00eb nj\u00eb sistem i bazuar n\u00eb menaxhimin e detyruar t\u00eb aksesit (Mandatory Access Control, MAC). N\u00eb fjal\u00eb t\u00eb tjera, ajo parandalon ekzekutimin e veprimeve t\u00eb ndaluara.<\/p>\n<p>Security-Enhanced Linux (<noindex><a rel=\"nofollow\" href=\"https:\/\/selinuxproject.org\/page\/Main_Page\">SELinux<\/a><\/noindex>) \u00ebsht\u00eb nj\u00eb modul i zgjeruar i siguris\u00eb n\u00eb kernel-in Linux, n\u00eb disa aspekte i ngjash\u00ebm me AppArmor dhe shpesh i krahasuar me t\u00eb. SELinux \u00ebsht\u00eb m\u00eb i fuqish\u00ebm, m\u00eb fleksib\u00ebl dhe m\u00eb i holl\u00ebsish\u00ebm se AppArmor. Disavantazhet e tij jan\u00eb koha e gjat\u00eb e m\u00ebsimit dhe kompleksiteti i shtuar.<\/p>\n<p><noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/seccomp\/libseccomp\">Seccomp<\/a><\/noindex> seccomp dhe bpf lejojn\u00eb filtrimin e thirrjeve sisteme, duke bllokuar ekzekutimin e atyre q\u00eb mund t\u00eb jen\u00eb t\u00eb rrezikshme p\u00ebr sistemin operativ baz\u00eb dhe q\u00eb nuk jan\u00eb t\u00eb nevojshme p\u00ebr funksionimin normal t\u00eb aplikacioneve t\u00eb p\u00ebrdoruesit. Seccomp n\u00eb disa aspekte \u00ebsht\u00eb i ngjash\u00ebm me Falco, megjith\u00ebse nuk njeh specifikat e konteiner\u00ebve.<\/p>\n<h3>Sysdig open source<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.sysdig.com\/opensource\">www.sysdig.com\/opensource<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/4f8849a6cc819cef89f10ab80911c504.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSysdig \u00ebsht\u00eb nj\u00eb mjet i plot\u00eb p\u00ebr analiz\u00ebn, diagnostikimin dhe depurimin e sistemeve Linux (punon gjithashtu n\u00eb Windows dhe macOS, por me funksione t\u00eb kufizuara). Mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb mbledhur informacione t\u00eb detajuara, p\u00ebr verifikim dhe ekspertiz\u00eb kriminale <i>(ekspertiz\u00eb kriminale)<\/i> sistemit baz\u00eb dhe \u00e7do konteineri q\u00eb funksionon mbi t\u00eb.<\/p>\n<p>P\u00ebrve\u00e7 k\u00ebsaj, Sysdig fillimisht mb\u00ebshtet ambientet e ekzekutimit p\u00ebr konteiner\u00ebt dhe metadata Kubernetes, duke shtuar dimensione dhe etiketa shtes\u00eb n\u00eb t\u00eb gjitha informacionet e mbledhura mbi sjelljen e sistemit. Ekzistojn\u00eb disa m\u00ebnyra p\u00ebr t\u00eb analizuar nj\u00eb kluster Kubernetes me Sysdig: mund t\u00eb kryhet nj\u00eb kapje n\u00eb nj\u00eb moment t\u00eb caktuar p\u00ebrmes <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sysdiglabs\/kubectl-capture\">kubectl capture<\/a><\/noindex> ose mund t\u00eb nisni nj\u00eb nd\u00ebrfaqe interaktive t\u00eb bazuar n\u00eb ncurses me an\u00eb t\u00eb plugin <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/sysdiglabs\/kubectl-dig\">kubectl dig<\/a><\/noindex>.<\/p>\n<h2>Siguria n\u00eb rrjetin e Kubernetes<\/h2>\n<p><\/p>\n<h3>Aporeto<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aporeto.com\/\">www.aporeto.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/9692c50339a6c304c7f32f90619aaed1.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nAporeto ofron \"siguri t\u00eb ndar\u00eb nga rrjeta dhe infrastruktura\". Kjo do t\u00eb thot\u00eb se sh\u00ebrbimet Kubernetes jo vet\u00ebm q\u00eb marrin nj\u00eb ID lokale (kjo \u00ebsht\u00eb, ServiceAccount n\u00eb Kubernetes), por gjithashtu nj\u00eb identifikues universalis\/print q\u00eb mund t\u00eb p\u00ebrdoret p\u00ebr nd\u00ebrveprime t\u00eb sigurta dhe t\u00eb verifikueshme reciprokisht me \u00e7do sh\u00ebrbim tjet\u00ebr, p\u00ebr shembull, n\u00eb nj\u00eb kluster OpenShift.<\/p>\n<p>Aporeto \u00ebsht\u00eb n\u00eb gjendje t\u00eb gjeneroj\u00eb nj\u00eb identifikues unik jo vet\u00ebm p\u00ebr Kubernetes\/konteiner\u00ebt, por edhe p\u00ebr hostet, funksionet cloud dhe p\u00ebrdoruesit. N\u00eb var\u00ebsi t\u00eb k\u00ebtyre identifikuesve dhe nj\u00eb grupi rregullash t\u00eb siguris\u00eb n\u00eb rrjet, t\u00eb vendosura nga administratori, komunikimet do t\u00eb lejohet ose bllokohen.<\/p>\n<h3>Calico<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.projectcalico.org\/\">www.projectcalico.org<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/5902a133d4afc496f035de0f63129f99.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCalico zakonisht vendoset gjat\u00eb instalimit t\u00eb orkestratorit t\u00eb kontejner\u00ebve, duke lejuar krijimin e nj\u00eb rrjeti virtual q\u00eb lidh kontejner\u00ebt. P\u00ebrve\u00e7 k\u00ebsaj funksionaliteti baz\u00eb t\u00eb rrjetit, projekti Calico punon me Politikat e Rrjetit Kubernetes dhe me grupin e vet t\u00eb profileve t\u00eb siguris\u00eb s\u00eb rrjetit, mb\u00ebshtet ACL (listat e kontrollit t\u00eb qasjes) p\u00ebr endpointet dhe rregulla t\u00eb siguris\u00eb s\u00eb rrjetit t\u00eb bazuara n\u00eb annotime p\u00ebr trafik Ingress dhe Egress.<\/p>\n<h3>Cilium<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cilium.io\/\">www.cilium.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/2a9f3d1de52936c2f1a06d96fab054fb.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCilium sh\u00ebrben si nj\u00eb zjarrfik\u00ebs p\u00ebr kontejner\u00ebt dhe ofron funksionalitete p\u00ebr sigurin\u00eb rrjet\u00ebsore, t\u00eb adaptuara origjinalisht p\u00ebr Kubernetes dhe ngarkesat e pun\u00ebs t\u00eb mikroservic\u00ebve. Cilium p\u00ebrdor nj\u00eb teknologji t\u00eb re t\u00eb b\u00ebrtham\u00ebs Linux t\u00eb quajtur BPF (Berkeley Packet Filter) p\u00ebr filtrimin, monitorimin, ridrejtimin dhe rregullimin e t\u00eb dh\u00ebnave.<\/p>\n<p>Cilium \u00ebsht\u00eb n\u00eb gjendje t\u00eb vendos\u00eb politikat e qasjes n\u00eb rrjet t\u00eb bazuara n\u00eb identifikuesit e kontejner\u00ebve, duke p\u00ebrdorur etiketat e Docker-it ose Kubernetes-it dhe metadatat. Cilium gjithashtu kupton dhe filtrojn\u00eb protokollet e nivelit 7, si HTTP ose gRPC, duke lejuar p\u00ebrcaktimin e grupeve t\u00eb thirrjeve REST q\u00eb, p\u00ebr shembull, do t\u00eb lejohet mes dy deployment-eve Kubernetes.<\/p>\n<h3>Istio<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/istio.io\/\">istio.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/da9e18500fffdf2c310182a4820c722d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIstio njihet gjer\u00ebsisht si nj\u00eb realizim i paradigm\u00ebs service mesh duke implementuar nj\u00eb plan kontrolli t\u00eb pavarur nga platforma dhe duke ridrejtuar t\u00eb gjith\u00eb trafikun e sh\u00ebrbimeve t\u00eb menaxhuara p\u00ebrmes proxy-ve t\u00eb konfiguruar dinamikisht Envoy. Istio p\u00ebrfitohet nga kjo prezentim avancuar i t\u00eb gjith\u00eb mikroservic\u00ebve dhe kontejner\u00ebve p\u00ebr t\u00eb zbatuar strategji t\u00eb ndryshme p\u00ebr sigurin\u00eb rrjet\u00ebsore.<\/p>\n<p>Aft\u00ebsit\u00eb e Istio p\u00ebr sigurimin e rrjet\u00ebs p\u00ebrfshijn\u00eb kriptimin n\u00eb m\u00ebnyr\u00eb transparente TLS p\u00ebr p\u00ebrmir\u00ebsimin automatik t\u00eb protokollit t\u00eb komunikimit nd\u00ebrmjet mikroservic\u00ebve deri n\u00eb HTTPS dhe nj\u00eb sistem t\u00eb vetin RBAC p\u00ebr identifikimin dhe autorizimin p\u00ebr lejen\/ndalimin e shk\u00ebmbimit t\u00eb t\u00eb dh\u00ebnave midis ngarkesave t\u00eb ndryshme t\u00eb pun\u00ebs n\u00eb cluster.<\/p>\n<p><i><b>Sh\u00ebn. p\u00ebrkth.<\/b>: M\u00eb shum\u00eb rreth mund\u00ebsive t\u00eb Istio t\u00eb orientuara p\u00ebr sigurin\u00eb, lexoni n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443668\/\">k\u00ebto artikuj<\/a><\/noindex>.<\/i><\/p>\n<h3>Tigera<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tigera.io\/\">www.tigera.io<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/3568cf2fc634d4c40c45f0db4a08aa77.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nN\u00eb k\u00ebt\u00eb zgjidhje, e njohur si \"zjarrfik\u00ebsi Kubernetes\", fokusohet n\u00eb qasjen p\u00ebr sigurin\u00eb rrjet\u00ebsore me besim zero.<\/p>\n<p>N\u00eb p\u00ebrputhje me zgjidhjet e tjera rrjet\u00ebsore native p\u00ebr Kubernetes, Tigera mb\u00ebshtetet n\u00eb metadata p\u00ebr identifikimin e sh\u00ebrbimeve dhe objekteve t\u00eb ndryshme n\u00eb cluster dhe ofron zbardhje t\u00eb problemeve n\u00eb runtime, kontrollin e vazhduesh\u00ebm p\u00ebr p\u00ebrputhshm\u00ebrin\u00eb dhe transparenc\u00ebn e rrjetit p\u00ebr infrastrukturat \u00e7ok-cloud ose hibrid monoton-kontejner\u00eb.<\/p>\n<h3>Trireme<\/h3>\n<p><\/p>\n<ul>\n<li>Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aporeto.com\/opensource\/\">www.aporeto.com\/opensource<\/a><\/noindex><\/li>\n<li>Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/5924b4c2a0f6324e9d946c0261cbc53f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTrireme-Kubernetes \u00ebsht\u00eb nj\u00eb implementim i thjesht\u00eb dhe i qart\u00eb i specifikimit t\u00eb Politikave t\u00eb Rrjetit Kubernetes. Karakteristika m\u00eb e spikatur \u00ebsht\u00eb se, ndryshe nga produktet e ngjashme p\u00ebr sigurin\u00eb rrjetore Kubernetes, nuk k\u00ebrkon nj\u00eb central control plane p\u00ebr t\u00eb koordinuar rrjetin (mesh). Kjo e b\u00ebn zgjidhjen trivialisht t\u00eb shkall\u00ebzueshme. N\u00eb Trireme, kjo arrihet p\u00ebrmes instalimit t\u00eb nj\u00eb agjenti n\u00eb \u00e7do nyje, i cili lidhet drejtp\u00ebrdrejt me TCP\/IP stack-in e hostit.<\/p>\n<h2>Distribuimi i imazheve dhe menaxhimi i sekreteve<\/h2>\n<p><\/p>\n<h3>Grafeas<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/grafeas.io\/\">grafeas.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/92c9986b36991d280cce0b1093e1938f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nGrafeas \u00ebsht\u00eb nj\u00eb API me kod t\u00eb hapur p\u00ebr auditimin dhe menaxhimin e zinxhirit t\u00eb furnizimit t\u00eb softuerit. N\u00eb nivelin baz\u00eb, Grafeas paraqet nj\u00eb mjet p\u00ebr mbledhjen e metadata dhe rezultateve t\u00eb auditimit. Mund t\u00eb p\u00ebrdoret p\u00ebr t\u00eb ndjekur p\u00ebrputhjen me praktikat m\u00eb t\u00eb mira t\u00eb siguris\u00eb brenda organizat\u00ebs.<\/p>\n<p>Ky burim i centralizuar i t\u00eb v\u00ebrtet\u00ebs ndihmon n\u00eb gjenerimin e pyetjeve si:<\/p>\n<ul>\n<li> Kush e ka nd\u00ebrtuar dhe n\u00ebnshkruar nj\u00eb konteiner t\u00eb caktuar?<\/li>\n<li> A ka kaluar t\u00eb gjitha skanime t\u00eb siguris\u00eb dhe verifikimet e p\u00ebrcaktuara nga politika e siguris\u00eb? Kur? Cilat ishin rezultatet? <\/li>\n<li> Kush e shp\u00ebrndau at\u00eb n\u00eb production? Cilat parametra sakt\u00ebsisht u p\u00ebrdor\u00ebn gjat\u00eb shp\u00ebrndarjes?<\/li>\n<\/ul>\n<p><\/p>\n<h3>In-toto<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/in-toto.github.io\/\">in-toto.github.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/91f0ba618f41dbadb07b37ec6999a736.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nIn-toto \u00ebsht\u00eb nj\u00eb korniz\u00eb e dizajnuar p\u00ebr t\u00eb siguruar integritetin, autentikimin dhe auditimin e gjith\u00eb zinxhirit t\u00eb furnizimit t\u00eb softuerit. Gjat\u00eb shp\u00ebrndarjes s\u00eb In-toto n\u00eb infrastruktur\u00ebn, fillimisht vendoset nj\u00eb plan q\u00eb p\u00ebrshkruan hapat e ndryshme n\u00eb pipeline (repo, mjetet CI\/CD, mjetet QA, nd\u00ebrtuesit e artikujve, etj.) dhe p\u00ebrdoruesit (personat p\u00ebrgjegj\u00ebs) q\u00eb kan\u00eb leje p\u00ebr t\u00eb iniciuar ato.<\/p>\n<p>In-toto monitoron ekzekutimin e planit, duke verifikuar q\u00eb \u00e7do detyr\u00eb n\u00eb zinxhir ekzekutohet si\u00e7 duhet vet\u00ebm nga personeli i autorizuar dhe nuk jan\u00eb kryer asnj\u00eb manipulim i paautorizuar gjat\u00eb procesit me produktin.<\/p>\n<h3>Portieris<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/IBM\/portieris\">github.com\/IBM\/portieris<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/ff9c24c88cd9a06c8bd35dfe4f3558cf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPortieris \u00ebsht\u00eb nj\u00eb controller pranimi p\u00ebr Kubernetes; p\u00ebrdoret p\u00ebr kontrolle t\u00eb detyrueshme t\u00eb besueshm\u00ebris\u00eb s\u00eb p\u00ebrmbajtjes. Portieris p\u00ebrdor serverin <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/theupdateframework\/notary\">Notary<\/a><\/noindex> <i>(ne kemi shkruar p\u00ebr t\u00eb n\u00eb fund <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/340366\/\">ky artikull<\/a><\/noindex> \u2014 <b>sh\u00ebnim i p\u00ebrkthyesit.<\/b>)<\/i> si burim i v\u00ebrtet\u00ebs p\u00ebr t\u00eb konfirmuar artifaktet e besueshme dhe t\u00eb n\u00ebnshkruara (do thot\u00eb imazhet e kontejner\u00ebve t\u00eb miratuara).<\/p>\n<p>Kur gjat\u00eb krijimit ose ndryshimit t\u00eb nj\u00eb ngarkese pune n\u00eb Kubernetes, Portieris ngarkon informacionin e n\u00ebnshkrimit dhe politik\u00ebn e besueshm\u00ebris\u00eb p\u00ebr p\u00ebrmbajtjen e imazheve t\u00eb k\u00ebrkuara t\u00eb kontejner\u00ebve dhe, n\u00ebse \u00ebsht\u00eb e nevojshme, b\u00ebn ndryshime n\u00eb koh\u00eb reale n\u00eb objektin JSON t\u00eb API-s\u00eb p\u00ebr t\u00eb nisur versionet e n\u00ebnshkruara t\u00eb k\u00ebtyre imazheve.<\/p>\n<h3>Vault<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.vaultproject.io\/\">www.vaultproject.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (MPL)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/19191a10051dc6349af017a06f0fd43e.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nVault \u00ebsht\u00eb nj\u00eb zgjidhje e sigurt p\u00ebr ruajtjen e informacionit t\u00eb ndjesh\u00ebm: fjal\u00ebkalimeve, tokeneve OAuth, certifikatave PKI, akteve t\u00eb qasjes, sekreteve Kubernetes etj. Vault mb\u00ebshtet shum\u00eb funksione t\u00eb avancuara, t\u00eb tilla si dh\u00ebnie e tokeneve t\u00eb siguris\u00eb t\u00eb p\u00ebrkohshme ose organizimi i rotacionit t\u00eb \u00e7el\u00ebsave.<\/p>\n<p>Me ndihm\u00ebn e Helm-chart-it, Vault mund t\u00eb vihet n\u00eb p\u00ebrdorim si nj\u00eb deployment i ri n\u00eb klasterin Kubernetes me Consul si backend-storage. Ai mb\u00ebshtet burimet native t\u00eb Kubernetes si tokenet ServiceAccount dhe madje mund t\u00eb sh\u00ebrbej\u00eb si magazin\u00eb e sekreteve Kubernetes t\u00eb paracaktuar.<\/p>\n<p><i><b>Sh\u00ebn. p\u00ebrkth.<\/b>: Nga ana tjet\u00ebr, pik\u00ebrisht dje kompania HashiCorp, e cila zhvillon Vault, njoftoi disa p\u00ebrmir\u00ebsime p\u00ebr p\u00ebrdorimin e Vault n\u00eb Kubernetes, dhe n\u00eb ve\u00e7anti ato lidhen me Helm chart-in. M\u00eb shum\u00eb detaje lexoni n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.hashicorp.com\/blog\/whats-next-for-vault-and-kubernetes\">blogun e zhvilluesit<\/a><\/noindex>.<\/i><\/p>\n<h2>Auditimi i siguris\u00eb s\u00eb Kubernetes<\/h2>\n<p><\/p>\n<h3>Kube-bench<\/h3>\n<p><\/p>\n<ul>\n<li>Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/kube-bench\">github.com\/aquasecurity\/kube-bench<\/a><\/noindex><\/li>\n<li>Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/8e0e101503f02ea3033f7b29c9ee9ddf.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKube-bench \u00ebsht\u00eb nj\u00eb aplikacion n\u00eb Go, i cili kontrollon n\u00ebse Kubernetes \u00ebsht\u00eb vendosur n\u00eb m\u00ebnyr\u00eb t\u00eb sigurt duke kryer teste nga lista <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/container-compliance\/\">CIS Kubernetes Benchmark<\/a><\/noindex>.<\/p>\n<p>Kube-bench k\u00ebrkon parametrat e konfigurimit t\u00eb pasigurt n\u00eb mesin e komponenteve t\u00eb klasterit (etcd, API, menaxheri i kontrollit etj.), t\u00eb drejtat e dyshimta mbi skedar\u00ebt, llogarit\u00eb e mbrojtura ose portet e hapura, kuotat e burimeve, cil\u00ebsimet e kufizimit t\u00eb thirrjeve n\u00eb API p\u00ebr mbrojtje nga sulmet DoS etj.<\/p>\n<h3>Kube-hunter<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/kube-hunter\">github.com\/aquasecurity\/kube-hunter<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/e5e38368af8bf086da149cbfd71a5e6d.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKube-hunter \"gjuan\" p\u00ebr dob\u00ebsi t\u00eb mundshme (si\u00e7 \u00ebsht\u00eb ekzekutimi i kodit n\u00eb distanc\u00eb apo zbardhja e t\u00eb dh\u00ebnave) n\u00eb klasteret Kubernetes. Kube-hunter mund t\u00eb ekzekutohet si nj\u00eb skaner nga distanca \u2014 n\u00eb k\u00ebt\u00eb rast ai do t\u00eb vler\u00ebsoj\u00eb klasterin nga perspektiva e nj\u00eb sulmuesi t\u00eb jasht\u00ebm \u2014 ose si pod brenda klasterit.<\/p>\n<p>Karakteristika dalluese e Kube-hunter \u00ebsht\u00eb mode \u2018gjuetia aktive\u2019, gjat\u00eb s\u00eb cil\u00ebs ai jo vet\u00ebm q\u00eb raporton p\u00ebr problemet, por p\u00ebrpiqet gjithashtu t\u00eb shfryt\u00ebzoj\u00eb cenueshm\u00ebrin\u00eb e zbuluar n\u00eb klasterin target, q\u00eb potencialisht mund t\u00eb d\u00ebmtoj\u00eb funksionimin e tij. Prandaj, p\u00ebrdorni me kujdes!<\/p>\n<h3>Kubeaudit<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/Shopify\/kubeaudit\">github.com\/Shopify\/kubeaudit<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (MIT)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/84651a05f714b9c841245cb38f78324a.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubeaudit \u00ebsht\u00eb nj\u00eb mjet konsol\u00eb, fillimisht i zhvilluar n\u00eb Shopify p\u00ebr t\u00eb audituar konfigurimin e Kubernetes p\u00ebr probleme t\u00eb ndryshme n\u00eb fush\u00ebn e siguris\u00eb. P\u00ebr shembull, ai ndihmon n\u00eb identifikimin e kontejner\u00ebve q\u00eb punojn\u00eb pa kufizime, me t\u00eb drejta super p\u00ebrdoruesi, abuzues t\u00eb privilegjeve ose q\u00eb p\u00ebrdorin ServiceAccount-n e paracaktuar.<\/p>\n<p>Kubeaudit ka edhe mund\u00ebsi t\u00eb tjera interesante. P\u00ebr shembull, ai mund t\u00eb analizoj\u00eb skedar\u00ebt lokal\u00eb YAML, duke identifikuar mang\u00ebsi n\u00eb konfigurim q\u00eb mund t\u00eb \u00e7ojn\u00eb n\u00eb probleme t\u00eb siguris\u00eb dhe t'i korrigjoj\u00eb ato automatikisht.<\/p>\n<h3>Kubesec<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/kubesec.io\/\">kubesec.io<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/73e395cdcbe89af391b80ff9dccad5f2.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKubesec \u00ebsht\u00eb nj\u00eb mjet i ve\u00e7ant\u00eb n\u00eb kuptimin se skanon drejtp\u00ebrdrejt skedar\u00ebt YAML me p\u00ebrshkrimin e burimeve Kubernetes p\u00ebr t\u00eb gjetur parametrat e dob\u00ebt q\u00eb mund t\u00eb ndikojn\u00eb n\u00eb siguri.<\/p>\n<p>P\u00ebr shembull, ai mund t\u00eb zbuloj\u00eb privilegje dhe leje t\u00eb tepruara t\u00eb dh\u00ebna pod-it, duke operuar kontejnerin me root si p\u00ebrdorues t\u00eb paracaktuar, lidhjen me hap\u00ebsir\u00ebn em\u00ebrtuese t\u00eb rrjetit t\u00eb hostit ose montimet e rrezikshme si\u00e7 \u00ebsht\u00eb <code>\/proc<\/code> hostave ose Dockerit. Nj\u00eb mund\u00ebsi tjet\u00ebr interesante e Kubesec \u00ebsht\u00eb sh\u00ebrbimi demo n\u00eb internet, ku mund t\u00eb ngarkohet YAML dhe menj\u00ebher\u00eb t\u00eb analizosh at\u00eb.<\/p>\n<h3>Open Policy Agent<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.openpolicyagent.org\/\">www.openpolicyagent.org<\/a><\/noindex><\/li>\n<li> Licenca: e lir\u00eb (Apache)<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/f897b58fbc67d9cb463008621f4e608f.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKoncepti OPA (Open Policy Agent) q\u00ebndron n\u00eb ndarjen e politikave t\u00eb siguris\u00eb dhe praktikave m\u00eb t\u00eb mira t\u00eb siguris\u00eb nga platforma specifike runtime: Docker, Kubernetes, Mesosphere, OpenShift ose ndonj\u00eb kombinim t\u00eb tyre.<\/p>\n<p>P\u00ebr shembull, mund t\u00eb vendosni OPA si backend p\u00ebr kontrolluesin e pranimit t\u00eb Kubernetes, duke i deleguar atij vendimet p\u00ebr sigurin\u00eb. K\u00ebshtu, agjenti OPA do t\u00eb mund t\u00eb kontrolloj\u00eb, refuzoj\u00eb dhe madje t\u00eb ndryshoj\u00eb k\u00ebrkesat n\u00eb koh\u00eb reale, duke siguruar ndjekjen e parametrave t\u00eb caktuar p\u00ebr sigurin\u00eb. Politikat e siguris\u00eb n\u00eb OPA jan\u00eb shkruar n\u00eb DSL-n\u00eb e saj t\u00eb ve\u00e7ant\u00eb, Rego.<\/p>\n<p><i><b>Sh\u00ebn. p\u00ebrkth.<\/b>: M\u00eb shum\u00eb rreth OPA (dhe SPIFFE) kemi shkruar n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/353808\/\">k\u00ebt\u00eb material<\/a><\/noindex>.<\/i><\/p>\n<h2>Mjetet komerciale komplekse p\u00ebr analiz\u00ebn e siguris\u00eb s\u00eb Kubernetes<\/h2>\n<p>\nNe vendos\u00ebm t\u00eb krijojm\u00eb nj\u00eb kategori t\u00eb ve\u00e7ant\u00eb p\u00ebr platformat komerciale, pasi ato zakonisht mbulojn\u00eb disa fusha t\u00eb siguris\u00eb. Nj\u00eb pasqyr\u00eb e p\u00ebrgjithshme e mund\u00ebsive t\u00eb tyre mund t\u00eb merret nga tabela:<\/p>\n<p><img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/0dbe925006238ee242c452f05d9f7302.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<i>* Ekspertiz\u00eb t\u00eb avancuar dhe analiza post mortem me kapjen e plot\u00eb t\u00eb thirrjeve sistemore <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/use-cases\/container-forensics\/\">Aqua Security<\/a><\/noindex>.<\/i><\/p>\n<h3>www.aquasec.com<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.aquasec.com\/\">Ky mjet komercial \u00ebsht\u00eb i dedikuar p\u00ebr kontejner\u00ebt dhe ngarkesat e pun\u00ebs cloud. Ai ofron:<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/d02026209908e9dac53be53fbdb178cd.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nKy ky\u00e7 tregtar \u00ebsht\u00eb i destinuar p\u00ebr kontejner\u00eb dhe ngarkesa pune n\u00eb re. Ai siguron:<\/p>\n<ul>\n<li> Skandimi i imazheve, e integruar me regjistrin e kontejner\u00ebve ose CI\/CD pipeline;<\/li>\n<li> Mbrojtja Runtime me k\u00ebrkimin e ndryshimeve n\u00eb kontejner\u00eb dhe aktivitet tjet\u00ebr t\u00eb dyshimt\u00eb;<\/li>\n<li> Firewal native p\u00ebr konteiner\u00ebt;<\/li>\n<li> Siguria p\u00ebr serverless n\u00eb sh\u00ebrbimet cloud;<\/li>\n<li> Kontrollin e p\u00ebrputhshm\u00ebris\u00eb dhe auditimin, t\u00eb kombinuara me regjistrimin e ngjarjeve.<\/li>\n<\/ul>\n<p>\n<i><b>Sh\u00ebn. p\u00ebrkth.<\/b>: Vlen t\u00eb theksohet se ka gjithashtu nj\u00eb <b>komponent falas t\u00eb produktit t\u00eb quajtur <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/microscanner\">MicroScanner<\/a><\/noindex><\/b>, i cili lejon skanimin e imazheve t\u00eb kontejner\u00ebve p\u00ebr dob\u00ebsi. Krahasimi i mund\u00ebsive t\u00eb saj me versionet me pages\u00eb \u00ebsht\u00eb paraqitur n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/github.com\/aquasecurity\/microscanner#aqua-security-edition-comparison\">k\u00ebt\u00eb tabel\u00eb<\/a><\/noindex>.<\/i><\/p>\n<h3>Capsule8<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/capsule8.com\/\">capsule8.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/122be33f15d31f8f083189bca5c7158c.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\nCapsule8 integrohet n\u00eb infrastruktur\u00eb, duke instaluar nj\u00eb detektues n\u00eb nj\u00eb klaster lokal ose cloud Kubernetes. Ky detektues mbledh telemetri t\u00eb hostit dhe rrjetit, duke e p\u00ebrputhur at\u00eb me lloje t\u00eb ndryshme sulmesh.<\/p>\n<p>Ekipi i Capsule8 e sheh si detyr\u00eb t\u00eb saj zbardhjen e hershme dhe parandalimin e sulmeve q\u00eb p\u00ebrdorin dob\u00ebsi t\u00eb reja <i>(0-day)<\/i> Capsule8 ka aft\u00ebsin\u00eb t\u00eb ngarkoj\u00eb rregulla t\u00eb rafinuara sigurie direkt n\u00eb detektor\u00ebt n\u00eb p\u00ebrgjigje t\u00eb k\u00ebrc\u00ebnimeve dhe dob\u00ebsive t\u00eb zbuluara s\u00eb fundmi.<\/p>\n<h3>Cavirin<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.cavirin.com\/\">www.cavirin.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/896310c9258943041664ca55b3926d35.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nCavirin vepron si nj\u00eb partner p\u00ebr kompanin\u00eb p\u00ebr agjenci t\u00eb ndryshme q\u00eb merren me standardet e siguris\u00eb. Ai jo vet\u00ebm q\u00eb mund t\u00eb skanoj\u00eb imazhe, por gjithashtu mund t\u00eb integrohet n\u00eb CI\/CD pipeline, duke bllokuar imazhet e paspecifikuara para se t\u00eb futen n\u00eb depozit\u00eb t\u00eb mbyllura.<\/p>\n<p>Paketa e siguris\u00eb Cavirin p\u00ebrdor m\u00ebsimin e makinerin\u00eb p\u00ebr t\u00eb vler\u00ebsuar gjendjen e siguris\u00eb kibernetike, ofron k\u00ebshilla p\u00ebr p\u00ebrmir\u00ebsimin e siguris\u00eb dhe rritjen e p\u00ebrputhshm\u00ebris\u00eb me standardet e siguris\u00eb.<\/p>\n<h3>Qendra e Komand\u00ebs s\u00eb Siguris\u00eb s\u00eb Google Cloud<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/cloud.google.com\/security-command-center\/\">cloud.google.com\/security-command-center<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/d9ac37b3d2b9be7fd6fcd6afe0d985e6.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nQendra e Komand\u00ebs s\u00eb Siguris\u00eb s\u00eb Cloud ndihmon ekipet e siguris\u00eb t\u00eb mbledhin t\u00eb dh\u00ebna, t\u00eb zbulojn\u00eb k\u00ebrc\u00ebnime dhe t'i eliminojn\u00eb ato para se t\u00eb shkaktojn\u00eb d\u00ebm n\u00eb kompani.<\/p>\n<p>Si\u00e7 e tregon emri, Google Cloud SCC \u00ebsht\u00eb nj\u00eb panel i unifikuar i kontrollit, n\u00eb t\u00eb cilin mund t\u00eb integrohen raporte t\u00eb ndryshme t\u00eb siguris\u00eb, mekanizma t\u00eb num\u00ebrimit t\u00eb aseteve dhe sisteme t\u00eb jashtme t\u00eb siguris\u00eb, dhe t\u00eb menaxhohen nga nj\u00eb burim t\u00eb vet\u00ebm, t\u00eb centralizuar.<\/p>\n<p>API interoperabil q\u00eb ofrohet nga Google Cloud SCC leht\u00ebson integrimin e ngjarjeve n\u00eb fush\u00ebn e siguris\u00eb q\u00eb vijn\u00eb nga burime t\u00eb ndryshme, si Sysdig Secure (siguria e kontejner\u00ebve p\u00ebr aplikacione cloud-native) ose Falco (sistem sigurie runtime Open Source).<\/p>\n<h3>Layered Insight (Qualys)<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/layeredinsight.com\/\">layeredinsight.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/31e0266c670a991824c029f9445cf480.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nLayered Insight (tani pjes\u00eb e Qualys Inc) \u00ebsht\u00eb nd\u00ebrtuar mbi konceptin e \"siguris\u00eb s\u00eb integruar\". Pasi skanon origjinalin p\u00ebr vulnerabilitete duke p\u00ebrdorur metoda t\u00eb analiz\u00ebs statistikore dhe duke kryer verifikime sipas CVE, Layered Insight e z\u00ebvend\u00ebson at\u00eb me nj\u00eb imazh t\u00eb instrumentuar q\u00eb p\u00ebrfshin nj\u00eb agjent n\u00eb form\u00ebn e nj\u00eb binar.<\/p>\n<p>Ky agjent p\u00ebrmban teste sigurie n\u00eb runtime p\u00ebr t\u00eb analizuar trafikun rrjetor t\u00eb kontejnerit, flukset I\/O dhe aktivitetin e aplikacionit. P\u00ebrve\u00e7 k\u00ebsaj, ai mund t\u00eb kryej\u00eb verifikime t\u00eb tjera sigurie, t\u00eb caktuara nga administratori i infrastruktur\u00ebs ose ekipet DevOps.<\/p>\n<h3>NeuVector<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/neuvector.com\/\">neuvector.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/db9558498c4c5cd876083d7a5bb41ab4.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nNeuVector kryen nj\u00eb verifikim t\u00eb siguris\u00eb s\u00eb kontejner\u00ebve dhe ofron mbrojtje n\u00eb koh\u00eb reale p\u00ebrmes analiz\u00ebs s\u00eb aktivitetit n\u00eb rrjet dhe sjelljes s\u00eb aplikacionit, duke krijuar nj\u00eb profil t\u00eb ve\u00e7ant\u00eb sigurie p\u00ebr secil\u00ebn kontejner. Ai gjithashtu mund t\u00eb bllokoj\u00eb vet\u00eb k\u00ebrc\u00ebnimet, duke izoluara aktivitetet e dyshimta p\u00ebrmes ndryshimit t\u00eb rregullave t\u00eb firewall-it lokal.<\/p>\n<p>Integrimi rrjetor i NeuVector, i njohur si Security Mesh, \u00ebsht\u00eb n\u00eb gjendje t\u00eb kryej\u00eb analiz\u00eb t\u00eb thell\u00eb t\u00eb paketave dhe filtrimin n\u00eb nivelin e 7-t\u00eb p\u00ebr t\u00eb gjitha lidhjet rrjetore n\u00eb service mesh.<\/p>\n<h3>StackRox<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.stackrox.com\/\">www.stackrox.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/9b8d013860518fab67e84344eaa1de91.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPlatforma p\u00ebr sigurin\u00eb e kontejner\u00ebve StackRox p\u00ebrpiqet t\u00eb mbuloj\u00eb t\u00eb gjith\u00eb ciklin e jet\u00ebs s\u00eb aplikacioneve Kubernetes n\u00eb klaster. Si\u00e7 \u00ebsht\u00eb rasti me platforma t\u00eb tjera komerciale n\u00eb k\u00ebt\u00eb list\u00eb, StackRox gjeneron nj\u00eb profil runtime mbi baz\u00ebn e sjelljes s\u00eb v\u00ebzhguar t\u00eb kontejnerit dhe automatikisht jep alarmin p\u00ebr \u00e7do devijim.<\/p>\n<p>P\u00ebr m\u00eb tep\u00ebr, StackRox analizon konfigurimet e Kubernetes, duke p\u00ebrdorur CIS Kubernetes dhe kode t\u00eb tjera p\u00ebr t\u00eb vler\u00ebsuar p\u00ebrputhshm\u00ebrin\u00eb e kontejner\u00ebve.<\/p>\n<h3>Sysdig Secure<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/\">sysdig.com\/products\/secure<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/a36518809970479fe435e505c231eff8.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nSysdig Secure mbron aplikacionet gjat\u00eb t\u00eb gjith\u00eb ciklit t\u00eb jet\u00ebs s\u00eb kontejner\u00ebve dhe Kubernetes. Ai <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/image-scanning\/\">skanon imazhet<\/a><\/noindex> e kontejner\u00ebve, ofron <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/runtime-security\/\">mbrojtje n\u00eb runtime<\/a><\/noindex> n\u00eb baza t\u00eb t\u00eb dh\u00ebnave t\u00eb m\u00ebsimit t\u00eb makineris\u00eb, kryen ekspertiz\u00eb kriminale p\u00ebr t\u00eb identifikuar vulnerabilitetet, bllokon k\u00ebrc\u00ebnimet, monitoron <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/products\/secure\/container-compliance\/\">p\u00ebrputhshm\u00ebrin\u00eb me standardet e vendosura<\/a><\/noindex> dhe kryen auditimin e aktivitetit n\u00eb mikrosh\u00ebrbime.<\/p>\n<p>Sysdig Secure integrohet me mjetet CI\/CD, si Jenkins, dhe kontrollon imazhet e ngarkuara nga regjistrat Docker, duke parandaluar shfaqjen e imazheve t\u00eb rrezikshme n\u00eb production. Ai gjithashtu ofron nj\u00eb siguri t\u00eb plot\u00eb n\u00eb runtime, duke p\u00ebrfshir\u00eb:<\/p>\n<ul>\n<li> profilizimin n\u00eb runtime n\u00eb baza t\u00eb m\u00ebsimit dhe zbulimin e anomali;<\/li>\n<li> politikat e runtime, t\u00eb bazuara n\u00eb ngjarjet sistemike, API K8s-audit, projekte t\u00eb p\u00ebrbashk\u00ebta t\u00eb komunitetit (FIM \u2014 monitorimi i integritetit t\u00eb skedar\u00ebve; kriptoshk\u00ebmbimi) dhe framework-u <noindex><a rel=\"nofollow\" href=\"https:\/\/sysdig.com\/blog\/mitre-attck-framework-for-container-runtime-security-with-sysdig-falco\/\">MITRE ATT&amp;CK<\/a><\/noindex>;<\/li>\n<li> reagimi dhe zgjidhja e incidenteve.<\/li>\n<\/ul>\n<p><\/p>\n<h3>Tenable Container Security<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.tenable.com\/products\/tenable-io\/container-security\">www.tenable.com\/products\/tenable-io\/container-security<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/2b3799ee94628c04104f6cead8be8749.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nPara se t\u00eb shfaqeshin konteiner\u00ebt, Tenable ishte gjer\u00ebsisht e njohur n\u00eb industri si kompania q\u00eb zhvilloi Nessus \u2014 nj\u00eb mjet popullor p\u00ebr gjetjen e dob\u00ebsi dhe auditin e siguris\u00eb.<\/p>\n<p>Tenable Container Security kombinon eksperienc\u00ebn e kompanis\u00eb n\u00eb fush\u00ebn e siguris\u00eb kompjuterike p\u00ebr t\u00eb integruar pipeline-t CI\/CD me bazat e dob\u00ebsive, paketat e specializuara p\u00ebr zbulimin e malware dhe rekomandimet p\u00ebr adresimin e k\u00ebrc\u00ebnimeve t\u00eb siguris\u00eb.<\/p>\n<h3>Twistlock (Palo Alto Networks)<\/h3>\n<p><\/p>\n<ul>\n<li> Faqja: <noindex><a rel=\"nofollow\" href=\"https:\/\/www.twistlock.com\/\">www.twistlock.com<\/a><\/noindex><\/li>\n<li> Licenca: komerciale<\/li>\n<\/ul>\n<p>\n<img decoding=\"async\" alt=\"33+ mjete p\u00ebr sigurin\u00eb e Kubernetes\" src=\"\/wp-content\/uploads\/2019\/09\/98213c84bafaeca1e0d6bca3e1a80d23.png\" style=\"display:block;margin: 0 auto;\" \/><br \/>\n<br \/>\nTwistlock e promovon veten si nj\u00eb platform\u00eb t\u00eb orientuar ndaj sh\u00ebrbimeve cloud dhe konteiner\u00ebve. Twistlock mb\u00ebshtet ofrues t\u00eb ndrysh\u00ebm t\u00eb cloud-it (AWS, Azure, GCP), orkestrator\u00ebt e konteiner\u00ebve (Kubernetes, Mesosphere, OpenShift, Docker), mjediset pa server dhe framework-et mesh dhe mjetet CI\/CD.<\/p>\n<p>P\u00ebrve\u00e7 metodave t\u00eb zakonshme t\u00eb sigurimit t\u00eb nivelit korporativ, si integrimi n\u00eb pipeline-t CI\/CD ose skanimi i imazheve, Twistlock p\u00ebrdor m\u00ebsimin e makinerive p\u00ebr t\u00eb gjeneruar modele t\u00eb sjelljes dhe rregulla rrjeti q\u00eb marrin parasysh karakteristikat e konteiner\u00ebve.<\/p>\n<p>Disa koh\u00eb m\u00eb par\u00eb, Twistlock u ble nga kompania Palo Alto Networks, e cila zot\u00ebron projektet Evident.io dhe RedLock. Nuk dihet ende se si k\u00ebto tri platforma do t\u00eb integrohen n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/www.paloaltonetworks.com\/cloud-security\">PRISMA<\/a><\/noindex> nga Palo Alto.<\/p>\n<h2>Ndihmoni n\u00eb krijimin e nj\u00eb katalogu m\u00eb t\u00eb mir\u00eb t\u00eb mjeteve p\u00ebr sigurimin e Kubernetes!<\/h2>\n<p>\nNe jemi t\u00eb p\u00ebrkushtuar ta b\u00ebjm\u00eb k\u00ebt\u00eb katalog sa m\u00eb t\u00eb plot\u00eb, dhe p\u00ebr k\u00ebt\u00eb na nevojitet ndihma juaj! Na kontaktoni (<noindex><a rel=\"nofollow\" href=\"https:\/\/twitter.com\/sysdig\">@sysdig<\/a><\/noindex>), n\u00ebse keni n\u00eb mendje ndonj\u00eb mjet t\u00eb shk\u00eblqyer q\u00eb meriton t\u00eb p\u00ebrfshihet n\u00eb k\u00ebt\u00eb list\u00eb, ose keni gjetur ndonj\u00eb gabim\/ informacion t\u00eb vjet\u00ebruar.<\/p>\n<p>Gjithashtu mund t\u00eb abonoheni n\u00eb <noindex><a rel=\"nofollow\" href=\"https:\/\/go.sysdig.com\/container-newsletter-signup.html\">buletinin ton\u00eb mujor<\/a><\/noindex> me lajmet e ekosistemit cloud-native dhe tregimet p\u00ebr projekte interesante nga bota e siguris\u00eb Kubernetes.<\/p>\n<h2>P.S. nga p\u00ebrkthyesi<\/h2>\n<p>\nLexoni gjithashtu n\u00eb blogun ton\u00eb:<\/p>\n<ul>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/443190\/\">Hyrje n\u00eb politikat rrjetore Kubernetes p\u00ebr specialist\u00ebt e siguris\u00eb<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/440504\/\">9 praktikat m\u00eb t\u00eb mira p\u00ebr sigurimin e Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/436300\/\">OPA dhe SPIFFE \u2014 dy projekte t\u00eb reja n\u00eb CNCF p\u00ebr sigurin\u00eb e aplikacioneve n\u00eb cloud<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/417905\/\">11 m\u00ebnyra p\u00ebr t\u00eb (nuk) r\u00ebn\u00eb pre e hakerimit n\u00eb Kubernetes<\/a><\/noindex>\u00bb;<\/li>\n<li> \u00ab<noindex><a rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/353808\/\">Sh\u00ebn. p\u00ebrk.: Tema e siguris\u00eb n\u00eb Docker, ndoshta \u00ebsht\u00eb nj\u00eb nga temat e p\u00ebrjetshme n\u00eb bot\u00ebn moderne t\u00eb IT. Prandaj, pa shpjegime t\u00eb tepruara, paraqesim p\u00ebrkthimin e nj\u00eb tjet\u00ebr p\u00ebrmbledhjeje t\u00eb rekomandimeve p\u00ebrkat\u00ebse.<\/a><\/noindex>\u00bb.<\/li>\n<\/ul>\n<p>Burimi: <a content=\"nofollow\" rel=\"nofollow\" href=\"https:\/\/habr.com\/ru\/company\/flant\/blog\/465141\/\">habr.com<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"<p>\u041f\u0440\u0438\u043c. \u043f\u0435\u0440\u0435\u0432.: \u0415\u0441\u043b\u0438 \u0432\u044b \u0437\u0430\u0434\u0430\u0451\u0442\u0435\u0441\u044c \u0432\u043e\u043f\u0440\u043e\u0441\u0430\u043c\u0438 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 \u0432 \u0438\u043d\u0444\u0440\u0430\u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u0435, \u043e\u0441\u043d\u043e\u0432\u0430\u043d\u043d\u043e\u0439 \u043d\u0430 Kubernetes, \u044d\u0442\u043e\u0442 \u0437\u0430\u043c\u0435\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u043e\u0431\u0437\u043e\u0440 \u043e\u0442 \u043a\u043e\u043c\u043f\u0430\u043d\u0438\u0438 Sysdig \u0441\u0442\u0430\u043d\u0435\u0442 \u043e\u0442\u043b\u0438\u0447\u043d\u043e\u0439 \u043e\u0442\u043f\u0440\u0430\u0432\u043d\u043e\u0439 \u0442\u043e\u0447\u043a\u043e\u0439 \u0434\u043b\u044f \u0431\u0435\u0433\u043b\u043e\u0433\u043e \u0437\u043d\u0430\u043a\u043e\u043c\u0441\u0442\u0432\u0430 \u0441 \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u044b\u043c\u0438 \u043d\u0430 \u0441\u0435\u0433\u043e\u0434\u043d\u044f\u0448\u043d\u0438\u0439 \u0434\u0435\u043d\u044c \u0440\u0435\u0448\u0435\u043d\u0438\u044f\u043c\u0438. \u0412 \u043d\u0435\u0433\u043e \u0432\u043a\u043b\u044e\u0447\u0435\u043d\u044b \u0438 \u043a\u043e\u043c\u043f\u043b\u0435\u043a\u0441\u043d\u044b\u0435 \u0441\u0438\u0441\u0442\u0435\u043c\u044b \u043e\u0442 \u0438\u0437\u0432\u0435\u0441\u0442\u043d\u044b\u0445 \u0438\u0433\u0440\u043e\u043a\u043e\u0432 \u0440\u044b\u043d\u043a\u0430, \u0438 \u0437\u043d\u0430\u0447\u0438\u0442\u0435\u043b\u044c\u043d\u043e \u0431\u043e\u043b\u0435\u0435 \u0441\u043a\u0440\u043e\u043c\u043d\u044b\u0435 \u0443\u0442\u0438\u043b\u0438\u0442\u044b, \u0437\u0430\u043a\u0440\u044b\u0432\u0430\u044e\u0449\u0438\u0435 \u0442\u0443 \u0438\u043b\u0438 \u0438\u043d\u0443\u044e \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u0443. \u0410 \u0432 \u043a\u043e\u043c\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u044f\u0445 \u043c\u044b [&hellip;]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":28890,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[688],"tags":[],"class_list":["post-38497","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-administrirovanie"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.2.1 - aioseo.com -->\n\t<meta name=\"description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"Yuri Gagarin\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes\" \/>\n\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.2.1\" \/>\n\t\t<meta property=\"og:locale\" content=\"sq_AL\" \/>\n\t\t<meta property=\"og:site_name\" content=\"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"\ud83e\udd4733+ \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Kubernetes | ProHoster\" \/>\n\t\t<meta property=\"og:description\" content=\"\u041f\u0440\u0438\u043c.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"350\" \/>\n\t\t<meta property=\"og:image:height\" content=\"350\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2019-10-31T19:24:06+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2019-10-31T19:24:06+00:00\" \/>\n\t\t<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/prohoster\" \/>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"\ud83e\udd4733+ mjete p\u00ebr sigurin\u00eb e Kubernetes | ProHoster","description":"Sh\u00ebn.","canonical_url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sq_AL","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd4733+ \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430 \u0434\u043b\u044f \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438 Kubernetes | ProHoster","og:description":"\u041f\u0440\u0438\u043c.","og:url":"https:\/\/prohoster.info\/sq\/blog\/administrirovanie\/33-instrumenta-dlya-bezopasnosti-kubernetes","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2019-10-31T19:24:06+00:00","article:modified_time":"2019-10-31T19:24:06+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"38497","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":"2026-01-23 22:17:19","breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-03-01 01:08:31","updated":"2026-01-23 22:17:19","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/38497","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/comments?post=38497"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/posts\/38497\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media\/28890"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/media?parent=38497"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/categories?post=38497"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sq\/wp-json\/wp\/v2\/tags?post=38497"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}