chen-keinan/kube-beaconScanner runtime Open Source per cluster k8s ed esegue controlli di audit di sicurezza basati sulle specifiche del CIS Kubernetes Benchmark.
NUOVO!! il risultato dell'audit può ora essere utilizzato come webhook tramite plugin utente (usando plugin Go)
git clone https://github.com/chen-keinan/kube-beacon
cd kube-beacon
make build
Esegui kube-beacon senza alcun flag, esegui tutti i test
./kube-beacon
Esegui kube-beacon con flag, esegui test su richiesta
Usage: kube-Beacon [--version] [--help] <command> [<args>]
Available commands are:
-r , --report : run audit tests and generate failure report
-i , --include: execute only specific audit test, example -i=1.2.3,1.4.5
-e , --exclude: ignore specific audit tests, example -e=1.2.3,1.4.5
-n , --node: execute audit tests on specific node, example -n=master,-n=worker
-s , --spec: execute specific audit tests spec, example -s=gke, default=k8s
-v , --version: execute specific audit tests spec version, example -v=1.1.0,default=1.6.0
Esegui test e genera report dei test falliti
./kube-beacon -r
Esegui kube-beacon come pod in un cluster k8s
Aggiungi un cluster role binding con ruolo=cluster-admin
kubectl create clusterrolebinding default-admin --clusterrole cluster-admin --serviceaccount=default:default
cd jobs
kubectl apply -f k8s.yaml
kubectl apply -f gke.yaml
kubectl get pods --all-namespaces
NAMESPACE NAME READY STATUS RESTARTS AGE
default kube-beacon-sc8g9 0/1 Completed 0 111s
kube-system event-exporter-gke-8489df9489-skcvv 2/2 Running 0 7m24s
kube-system fluentd-gke-7d5sl 2/2 Running 0 7m6s
kube-system fluentd-gke-f6q5d 2/2 Running 0 6m59s
kubectl logs kube-beacon-sc8g9
kubectl delete clusterrolebinding default-admin
kubectl delete -f k8s.yaml
Kube-Beacon espone un hook per plugin utente Esempio:
go build -buildmode=plugin -o=~/<plugin folder>/bench_plugin.so /<plugin folder>/bench_plugin.go
cp /<plugin folder>/bench_plugin.so ~/.beacon/plugins/compile/bench_plugin.so
Nota: Plugin e binario devono essere compilati con lo stesso ambiente Linux