Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kubescape – tool for testing if Kubernetes is deployed securely

github.com

Post reply on HN
Print view View original

11–20 of 104 posts

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#11

Post by gravypod »

jkaftzan wrote: post #4
gravypod wrote: post #3

I love that since Kube is a standard API we can implement preflight checks like this that work for "any" kube cluster automatically.

cool! happy to hear that. if you have any ideas or comments about Kubescape, we would love to hear them

If you could check for container signing and providence on all materials and make sure that only a single registry is being used (ex only `internal.company.com:443`) and make sure it's not possible to schedule pods with unsigned/untrusted containers that would be awesome.

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#12

Post by eris_agx »

gravypod wrote: post #11
jkaftzan wrote: post #4

Earlier quoted context omitted.

cool! happy to hear that. if you have any ideas or comments about Kubescape, we would love to hear them

If you could check for container signing and providence on all materials and make sure that only a single registry is being used (ex only `internal.company.com:443`) and make sure it's not possible to schedule pods with unsigned/untrusted containers that would be awesome.

For materials you can use syft https://github.com/anchore/syft

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#14

Post by jkaftzan »

gravypod wrote: post #11
jkaftzan wrote: post #4

Earlier quoted context omitted.

cool! happy to hear that. if you have any ideas or comments about Kubescape, we would love to hear them

If you could check for container signing and providence on all materials and make sure that only a single registry is being used (ex only `internal.company.com:443`) and make sure it's not possible to schedule pods with unsigned/untrusted containers that would be awesome.

interesting, I'll send that to our dev team. BTW - you can suggest these things on Kubescape page @ Github and see status etc.

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#16

Post by lukevp »

anotherhue wrote: post #13

I politely suggest that a security focused tool should not further the curl|bash pattern.

There is debate on whether this is really a security concern.

[0] https://www.arp242.net/curl-to-sh.html [1] https://sandstorm.io/news/2015-09-24-is-curl-bash-insecure-p...

Re: Kubescape – tool for testing if Kubernetes is deployed securely

#19

Post by anotherhue »

geofft wrote: post #15
anotherhue wrote: post #13

I politely suggest that a security focused tool should not further the curl|bash pattern.

What alternative pattern would you suggest?

binary packages, maybe through github releases. debian packages, potentially upstreamed into the package repos (though that's some effort).

It's quite presumptive to presume to know how a target system is to be configured.

no matter which alternative, curl|bash is security risk enough to never use: https://www.idontplaydarts.com/2016/04/detecting-curl-pipe-b...

gpg can help (below from zerotier): curl -s 'https://raw.githubusercontent.com/zerotier/ZeroTierOne/maste...' | gpg --import && \ if z=$(curl -s 'https://install.zerotier.com/' | gpg); then echo "$z" | sudo bash; fi

Post reply on HN