Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
kube-knark — Open Source runtime tool which help to detect malware code execution and run time mis-configuration change on a kubernetes cluster | Kitploit
Tools/GitHubGitHub/chen-keinan/kube-knark
Container SecurityCloud SecurityIntrusion DetectionMisconfiguration
GitHubchen-keinan/kube-knark

kube-knark

Open Source runtime tool which help to detect malware code execution and run time mis-configuration change on a kubernetes cluster

View Repository
36444 years agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Go Report Card License Build Status test coverage badge Gitter
kube-krank logo

Kube-Knark Project

Trace your kubernetes runtime !!

Kube-Knark is an open-source tracer that uses pcap & ebpf technology to perform runtime tracing on a deployed Kubernetes cluster. It is tracing the Kubernetes API execution and master node configuration files permission changes. The trace matching events are leveraged via go plugin webhooks

kube-knark trace the following :

  • The full Kubernetes API specification execution calls especially mutation
  • kubernetes master node configuration files permission changes CIS Kubernetes Benchmark specification

kube-knark tracing data are reported :

  • Console dashboard
  • Go Plugin hooks

kube-Knark console:
kube-krank-console logo

  • Requirements
  • Installation
  • Quick Start
  • User Plugin Usage
  • Supported Specs
  • Contribution

Requirements

  • Go 1.13+
  • Linux Kernel 4.15+
  • Clang 10+
  • LLVM
  • Kernel Headers
  • Pcap

Installation

root@kitploit:~
git clone https://github.com/chen-keinan/kube-knark
cd kube-knark
make build

Quick Start

Execute kube-knark without plugins

root@kitploit:~
 ./kube-knark

User Plugin Usage (via go plugins)

The Kube-knark expose 2 hooks for user plugins Example :

  • OnK8sAPICallHook - this hook accepts k8s api call event with all details (http request /response ,matching API spec)
  • OnK8sFileConfigChangeHook - this hook accepts master file configuration change event with command details (chown or chmod ,args and matching file change spec)
Compile user plugin
root@kitploit:~
go build -buildmode=plugin -o=~/<plugin folder>/<plugin>.so ~/<plugin folder>/<plugin>.go
Copy plugin to folder (.kube-knark folder is created on the 1st startup)
root@kitploit:~
cp ~/<plugin folder>/<plugin>.so ~/.kube-knark/plugins/compile/<plugin>.so

Supported Specs

The Kube-knark support 2 specs and can be easily extended:

  • The full k8s API spec Kubernetes API specification
  • master config file change spec Master Node Config

both specs can be easily extended by amended the spec files under ~/.kube-knark/spec folder

Contribution

  • code contribution is welcome !! , contribution with tests and passing linter is more than welcome :)
  • /.dev folder include vagrantfile to be used for development : Dev Instruction
Download Tool