# Kubernetes Verharding

{{#include ../../../banners/hacktricks-training.md}}

## Gereedskap om 'n cluster te analiseer

### [Steampipe - Kubernetes Compliance](https://github.com/turbot/steampipe-mod-kubernetes-compliance)

Dit sal **verskeie nalevingskontroles op die Kubernetes-cluster** uitvoer. Dit sluit ondersteuning in vir CIS, National Security Agency (NSA) en die Cybersecurity and Infrastructure Security Agency (CISA) se tegniese kuberveiligheidsverslag vir Kubernetes-verharding.
```bash
# Install Steampipe
brew install turbot/tap/powerpipe
brew install turbot/tap/steampipe
steampipe plugin install kubernetes

# Start the service
steampipe service start

# Install the module
mkdir dashboards
cd dashboards
powerpipe mod init
powerpipe mod install github.com/turbot/steampipe-mod-kubernetes-compliance

# Run the module
powerpipe server
```
### [**Kubescape**](https://github.com/armosec/kubescape)

[**Kubescape**](https://github.com/armosec/kubescape) is 'n K8s open-source hulpmiddel wat 'n multi-cloud K8s een-paneel-oorsig bied, insluitend risiko-analise, sekuriteitsnakoming, 'n RBAC-visualiseerder en skandering van image-kwesbaarhede. Kubescape scant K8s clusters, YAML-lêers, en HELM charts, en ontdek misconfigurations volgens verskeie raamwerke (soos die [NSA-CISA](https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo) , [MITRE ATT\&CK®](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/)), sagteware-kwesbaarhede, en RBAC (role-based-access-control) oortredings in vroeë stadiums van die CI/CD-pyplyn, bereken risikotelling onmiddellik en toon risiko-trends oor tyd.
```bash
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash
kubescape scan --verbose
```
### [**Popeye**](https://github.com/derailed/popeye)

[**Popeye**](https://github.com/derailed/popeye) is 'n hulpmiddel wat lewende Kubernetes-klusters skandeer en **rapporteer potensiële probleme met gedeployde hulpbronne en konfigurasies**. Dit suiwer jou cluster gebaseer op wat gedeploy is en nie op wat op die skyf lê nie. Deur jou cluster te skandeer, ontdek dit miskonfigurasies en help dit jou om te verseker dat beste praktyke ingestel is, en sodoende toekomstige hoofpyn te voorkom. Dit streef daarna om die kognitiewe \_oor_las te verminder wat mens ervaar wanneer jy 'n Kubernetes-cluster in die veld bedryf. Verder, as jou cluster 'n metric-server gebruik, rapporteer dit potensiële oor-/ondertoewysings van hulpbronne en probeer dit jou waarsku indien jou cluster geen kapasiteit meer het nie.

### [**Kube-bench**](https://github.com/aquasecurity/kube-bench)

The tool [**kube-bench**](https://github.com/aquasecurity/kube-bench) is a tool that checks whether Kubernetes is deployed securely by running the checks documented in the [**CIS Kubernetes Benchmark**](https://www.cisecurity.org/benchmark/kubernetes/).\
Jy kan kies om:

- kube-bench binne 'n container uit te voer (deel PID namespace met die host)
- 'n container uit te voer wat kube-bench op die host installeer, en dan kube-bench direk op die host uit te voer
- die nuutste binaries vanaf die [Releases page](https://github.com/aquasecurity/kube-bench/releases) te installeer,
- dit vanaf bron te compileer.

### [**Kubeaudit**](https://github.com/Shopify/kubeaudit)

**[DEPRECATED]** Die hulpmiddel [**kubeaudit**](https://github.com/Shopify/kubeaudit) is 'n command line tool en 'n Go-pakket om **Kubernetes-klusters te ouditeer** vir verskeie sekuriteitskwessies.

Kubeaudit kan opspoor of dit binne 'n container in 'n cluster aan die loop is. Indien so, sal dit probeer om alle Kubernetes-hulpbronne in daardie cluster te ouditeer:
```
kubeaudit all
```
Hierdie tool het ook die argument `autofix` om **outomaties gedetekteerde kwessies reg te stel.**

### [**Kube-hunter**](https://github.com/aquasecurity/kube-hunter)

**[DEPRECATED]** Die tool [**kube-hunter**](https://github.com/aquasecurity/kube-hunter) jaag na sekuriteitskwessies in Kubernetes clusters. Die tool is ontwikkel om bewusmaking en sigbaarheid vir sekuriteitskwessies in Kubernetes-omgewings te verhoog.
```bash
kube-hunter --remote some.node.com
```
### [Trivy](https://github.com/aquasecurity/trivy)

[Trivy] het skandeerders wat na sekuriteitsprobleme soek, en teikens waar dit daardie probleme kan vind:

- Container Image
- Filesystem
- Git Repository (remote)
- Virtual Machine Image
- Kubernetes


### [**Kubei**](https://github.com/Erezf-p/kubei)

**[Lyk asof dit nie meer onderhou word nie]**

[**Kubei**] is 'n kwesbaarheidsskandering- en CIS Docker-benchmark hulpmiddel wat gebruikers in staat stel om 'n akkurate en onmiddellike risikoassessering van hul Kubernetes-klusters te kry. Kubei skandeer alle images wat in 'n Kubernetes-kluster gebruik word, insluitend images van application pods en system pods.

### [**KubiScan**](https://github.com/cyberark/KubiScan)

[**KubiScan**] is 'n instrument om Kubernetes-klusters te skandeer vir riskante permissies in Kubernetes se Role-based access control (RBAC) autorisatiemodel.

### [Managed Kubernetes Auditing Toolkit](https://github.com/DataDog/managed-kubernetes-auditing-toolkit)

[**Mkat**] is 'n instrument gebou om ander tipes hoogrisiko-kontroles te toets in vergelyking met die ander instrumente. Dit het hoofsaaklik 3 verskillende modusse:

- **`find-role-relationships`**: Wat sal vind watter AWS rolle in watter pods loop
- **`find-secrets`**: Wat probeer geheime identifiseer in K8s hulpbronne soos Pods, ConfigMaps, en Secrets.
- **`test-imds-access`**: Wat sal probeer pods laat loop en toegang probeer kry tot metadata v1 en v2. WAARSKUWING: Dit sal 'n pod in die kluster laat loop; wees baie versigtig want dalk wil jy dit nie doen nie!

## **Audit IaC-kode**

### [**KICS**](https://github.com/Checkmarx/kics)

[**KICS**] vind **sekuriteitskwesbaarhede**, nakomingskwessies, en infrastruktuur-wankonfigurasies in die volgende **Infrastructure as Code solutions**: Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Microsoft ARM, and OpenAPI 3.0 specifications

### [**Checkov**](https://github.com/bridgecrewio/checkov)

[**Checkov**] is 'n statiese kode-analise-instrument vir infrastructure-as-code.

Dit scan cloud infrastruktuur geprovisioneer met behulp van [Terraform](https://terraform.io), Terraform plan, [Cloudformation](https://aws.amazon.com/cloudformation/), [AWS SAM](https://aws.amazon.com/serverless/sam/), [Kubernetes](https://kubernetes.io), [Dockerfile](https://www.docker.com), [Serverless](https://www.serverless.com) of [ARM Templates](https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/overview) en identifiseer sekuriteits- en nakomings-wankonfigurasies deur graf-gebaseerde skandering.

### [**Kube-score**](https://github.com/zegl/kube-score)

[**kube-score**] is 'n instrument wat statiese kode-analise uitvoer op jou Kubernetes-objekdefinisies.

To install:

| Distribution                                        | Command / Link                                                                          |
| --------------------------------------------------- | --------------------------------------------------------------------------------------- |
| Pre-built binaries for macOS, Linux, and Windows    | [GitHub releases](https://github.com/zegl/kube-score/releases)                          |
| Docker                                              | `docker pull zegl/kube-score` ([Docker Hub)](https://hub.docker.com/r/zegl/kube-score/) |
| Homebrew (macOS and Linux)                          | `brew install kube-score`                                                               |
| [Krew](https://krew.sigs.k8s.io/) (macOS and Linux) | `kubectl krew install score`                                                            |

## Tools to analyze YAML files & Helm Charts

### [**Kube-linter**](https://github.com/stackrox/kube-linter)
```bash
# Install Kube-linter
brew install kube-linter

# Run Kube-linter
## lint ./path/to/yaml/or/chart
```
### [Checkov](https://github.com/bridgecrewio/checkov)
```bash
# Install Checkov
pip install checkov

# Run Checkov
checkov -d ./path/to/yaml/or/chart
```
### [kube‑score](https://github.com/zegl/kube-score)
```bash
# Install kube-score
brew install kube-score

# Run kube-score
kube-score score ./path/to/yaml
# or
helm template chart /path/to/chart | kube-score score -
# or if the chart needs some values
helm template chart /path/to/chart \
--set 'config.urls[0]=https://dummy.backend.internal' \
| kube-score score -
```
### [Kubesec](https://github.com/controlplaneio/kubesec)
```bash
# Install Kubesec
## Download from https://github.com/controlplaneio/kubesec/releases

# Run Kubesec in a yaml
kubesec scan ./path/to/yaml
# or
helm template chart /path/to/chart | kubesec scan -
# or if the chart needs some values
helm template chart /path/to/chart \
--set 'config.urls[0]=https://dummy.backend.internal' \
| kubesec scan -
```
## Skandeer afhanklikheidsprobleme

### Skandeer beelde
```bash
#!/bin/bash
export images=$(kubectl get pods --all-namespaces -o jsonpath="{range .items[]}{.spec.containers[].image}{'\n'}{end}" | sort | uniq)
echo "All images found: $images"
echo ""
echo ""
for image in $images; do
# Run trivy scan and save JSON output
trivy image --format json --output /tmp/result.json --severity HIGH,CRITICAL "$image" >/dev/null 2>&1
# Extract binary targets that have vulnerabilities
binaries=$(jq -r '.Results[] | select(.Vulnerabilities != null) | .Target' /tmp/result.json)
if [ -n "$binaries" ]; then
echo "- **Image:** $image"
while IFS= read -r binary; do
echo "  - **Binary:** $binary"
jq -r --arg target "$binary" '
.Results[] | select(.Target == $target) | .Vulnerabilities[] |
"    - **\(.Title)** (\(.Severity)): Affecting `\(.PkgName)` fixed in version `\(.FixedVersion)` (current version is `\(.InstalledVersion)`)."
' /tmp/result.json
done <<< "$binaries"
echo ""
echo ""
echo ""
fi
done
```
### Skandeer Helm charts
```bash
#!/bin/bash
# scan-helm-charts.sh
# This script lists all Helm releases, renders their manifests,
# and then scans each manifest with Trivy for configuration issues.

# Check that jq is installed
if ! command -v jq &>/dev/null; then
echo "jq is required but not installed. Please install jq and rerun."
exit 1
fi

# List all helm releases and extract namespace and release name
echo "Listing Helm releases..."
helm list --all-namespaces -o json | jq -r '.[] | "\(.namespace) \(.name)"' > helm_releases.txt

# Check if any releases were found
if [ ! -s helm_releases.txt ]; then
echo "No Helm releases found."
exit 0
fi

# Loop through each Helm release and scan its rendered manifest
while IFS=" " read -r namespace release; do
echo "---------------------------------------------"
echo "Scanning Helm release '$release' in namespace '$namespace'..."
# Render the Helm chart manifest
manifest_file="${release}-manifest.yaml"
helm get manifest "$release" -n "$namespace" > "$manifest_file"
if [ $? -ne 0 ]; then
echo "Failed to get manifest for $release in $namespace. Skipping."
continue
fi
# Scan the manifest with Trivy (configuration scan)
echo "Running Trivy config scan on $manifest_file..."
trivy config --severity MEDIUM,HIGH,CRITICAL "$manifest_file"
echo "Completed scan for $release."
done < helm_releases.txt

echo "---------------------------------------------"
echo "Helm chart scanning complete."
```
## Wenke

### Kubernetes PodSecurityContext en SecurityContext

Jy kan die **sekuriteitskonteks van die Pods** (met _PodSecurityContext_) en van die **containers** wat uitgevoer gaan word (met _SecurityContext_) konfigureer. Vir meer inligting lees:

{{#ref}}
kubernetes-securitycontext-s.md
{{#endref}}

### Kubernetes API-verharding

Dit is baie belangrik om die toegang tot die Kubernetes Api Server te beskerm, aangesien 'n kwaadwillige akteur met genoeg voorregte dit kan misbruik en die omgewing op verskeie maniere kan beskadig.\
Dit is belangrik om sowel die **toegang** (**whitelist** oorspronge wat toegang tot die API Server kry en weier enige ander verbinding) as die [**authentication**](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/) (volg die beginsel van **minste** **voorregte**) te beveilig. En beslis **moet nooit** **anonieme** **versoeke** **toegelaat** word.

**Algemene versoekproses:**\
Gebruiker of K8s ServiceAccount –> Verifikasie –> Autorisasie –> Toelatingsbeheer.

**Wenke**:

- Sluit poorte.
- Vermy anonieme toegang.
- NodeRestriction; Geen toegang van spesifieke nodes tot die API.
- [https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction)
- Verhoed basies dat kubelets etikette met die voorvoegsel node-restriction.kubernetes.io/ byvoeg/verwyder/werk by. Hierdie etiketvoorvoegsel is voorbehou vir administrateurs om hul Node-objekte te etiketteer vir workload-isolasie, en kubelets sal nie toegelaat word om etikette met daardie voorvoegsel te wysig nie.
- En ook, laat kubelets toe om hierdie etikette en etiketvoorvoegsels by te voeg/verwyder/te wysig.
- Gebruik etikette om veilige workload-isolasie te verseker.
- Voorkom dat spesifieke pods API-toegang kry.
- Vermy dat die ApiServer aan die internet blootgestel word.
- Voorkom ongemagtigde toegang met RBAC.
- Beveilig die ApiServer-poort met 'n firewall en IP-witlys.

### SecurityContext-verharding

Standaard word die root-gebruiker gebruik wanneer 'n Pod begin word as geen ander gebruiker gespesifiseer is nie. Jy kan jou toepassing in 'n meer veilige konteks laat loop deur 'n sjabloon soos die volgende te gebruik:
```yaml
apiVersion: v1
kind: Pod
metadata:
name: security-context-demo
spec:
securityContext:
runAsUser: 1000
runAsGroup: 3000
fsGroup: 2000
volumes:
- name: sec-ctx-vol
emptyDir: {}
containers:
- name: sec-ctx-demo
image: busybox
command: [ "sh", "-c", "sleep 1h" ]
securityContext:
runAsNonRoot: true
volumeMounts:
- name: sec-ctx-vol
mountPath: /data/demo
securityContext:
allowPrivilegeEscalation: true
```
- [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
- [https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)

### Algemene verharding

Jy moet jou Kubernetes-omgewing so gereeld as nodig opdateer om te verseker dat:

- Afhanklikhede op datum.
- Fout- en sekuriteitsopdaterings.

[**Release cycles**](https://kubernetes.io/docs/setup/release/version-skew-policy/): Elke 3 maande is daar 'n nuwe minor vrystelling -- 1.20.3 = 1(Major).20(Minor).3(patch)

**Die beste manier om 'n Kubernetes Cluster op te dateer is (van** [**here**](https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/)**):**

- Opgradeer die Master Node-komponente volgens hierdie volgorde:
- etcd (alle instansies).
- kube-apiserver (alle control plane hosts).
- kube-controller-manager.
- kube-scheduler.
- cloud controller manager, indien jy een gebruik.
- Opgradeer die Worker Node-komponente soos kube-proxy, kubelet.

## Kubernetes monitering & sekuriteit:

- Kyverno Policy Engine
- Cilium Tetragon - eBPF-gebaseerde sekuriteitswaarneming en runtime-afdwinging
- Network Security Policies
- Falco - runtime-sekuriteitsmonitering en opsporing

{{#include ../../../banners/hacktricks-training.md}}
