gitea-mirror/hacktricks-cloud
1
0
Fork 0
mirror of https://github.com/HackTricks-wiki/hacktricks-cloud.git synced 2026-07-28 14:47:17 -07:00
Code Issues Packages Projects Releases Wiki Activity

Translated ['', 'src/pentesting-cloud/kubernetes-security/kubernetes-har

Browse Source
This commit is contained in:
Translator
2025-11-17 12:19:20 +00:00
parent e0ec2bc87d
commit db44f55b12
1 changed files with 116 additions and 70 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/pentesting-cloud/kubernetes-security/kubernetes-hardening/README.md
+116 -70
View File
@@ -1,12 +1,12 @@
# Kubernetes Hardening
# Kuimarisha Kubernetes
{{#include ../../../banners/hacktricks-training.md}}
## Tools to analyse a cluster
## Zana za kuchambua cluster
### [**Steampipe - Kubernetes Compliance](https://github.com/turbot/steampipe-mod-kubernetes-compliance)
### [Steampipe - Kubernetes Compliance](https://github.com/turbot/steampipe-mod-kubernetes-compliance)
Itafanya **ukaguzi kadhaa wa kufuata juu ya klasta ya Kubernetes**. Inajumuisha msaada kwa CIS, Shirika la Usalama wa Taifa (NSA) na Ripoti ya kiufundi ya Usalama wa Mtandao na Usalama wa Miundombinu (CISA) kwa ajili ya kuimarisha Kubernetes.
Inafanya **ukaguzi kadhaa wa ulinganifu kwenye cluster ya Kubernetes**. Inajumuisha msaada kwa CIS, National Security Agency (NSA) na Cybersecurity and Infrastructure Security Agency (CISA) ripoti ya kiufundi ya Cybersecurity kwa kuimarisha Kubernetes.
```bash
# Install Steampipe
brew install turbot/tap/powerpipe
@@ -27,130 +27,176 @@ powerpipe server
```
### [**Kubescape**](https://github.com/armosec/kubescape)
[**Kubescape**](https://github.com/armosec/kubescape) ni chombo cha K8s cha chanzo wazi kinachotoa muonekano mmoja wa K8s wa multi-cloud, ikiwa ni pamoja na uchambuzi wa hatari, utii wa usalama, mchoraji wa RBAC na skanning ya udhaifu wa picha. Kubescape inachanganua makundi ya K8s, faili za YAML, na chati za HELM, ikigundua makosa ya usanidi kulingana na mifumo mbalimbali (kama vile [NSA-CISA](https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo) , [MITRE ATT\&CK®](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/)), udhaifu wa programu, na ukiukaji wa RBAC (udhibiti wa ufikiaji kulingana na jukumu) katika hatua za awali za mchakato wa CI/CD, inakadiria alama ya hatari mara moja na kuonyesha mwenendo wa hatari kwa muda.
[**Kubescape**](https://github.com/armosec/kubescape) ni zana ya chanzo wazi ya K8s inayotoa single pane of glass kwa K8s katika multi-cloud, ikijumuisha uchambuzi wa hatari, uzingatiaji wa usalama, visualizer ya RBAC na ukaguzi wa udhaifu wa image. Kubescape hupima cluster za K8s, faili za YAML, na charts za HELM, ikigundua mipangilio isiyo sahihi kwa mujibu wa mifumo mbalimbali (kama the [NSA-CISA](https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo) , [MITRE ATT\&CK®](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/)), udhaifu wa software, na ukiukwaji wa RBAC (role-based-access-control) katika hatua za mwanzo za CI/CD pipeline, inahesabu risk score papo kwa papo na inaonyesha mwelekeo wa hatari kwa muda.
```bash
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash
kubescape scan --verbose
```
### [**Popeye**](https://github.com/derailed/popeye)
[**Popeye**](https://github.com/derailed/popeye) ni chombo kinachochunguza klasta za Kubernetes za moja kwa moja na **kuripoti matatizo yanayoweza kutokea na rasilimali na mipangilio iliyowekwa**. Inasafisha klasta yako kulingana na kile kilichowekwa na si kile kilichoko kwenye diski. Kwa kuchunguza klasta yako, inagundua makosa ya mipangilio na inakusaidia kuhakikisha kuwa mbinu bora zipo, hivyo kuzuia maumivu ya baadaye. Inalenga kupunguza mzigo wa kiakili \_over_load mtu anayeukabili anapofanya kazi na klasta ya Kubernetes katika mazingira halisi. Zaidi ya hayo, ikiwa klasta yako inatumia metric-server, inaripoti rasilimali zinazoweza kuwa juu/chini ya mgawanyiko na inajaribu kukujulisha ikiwa klasta yako itakosa uwezo.
[**Popeye**](https://github.com/derailed/popeye) ni utility ambayo inascan live Kubernetes cluster na **inaripoti matatizo yanayowezekana na resources na configurations zilizowekwa**. Inasafisha cluster yako kulingana na kilichowekwa na si kile kilicho kwenye diski. Kwa kuscan cluster yako, inagundua misconfigurations na inakusaidia kuhakikisha kwamba best practices ziko mahali, hivyo kuzuia shida za baadaye. Inalenga kupunguza cognitive \_over_load mtu anakutana nayo anapoendesha Kubernetes cluster katika mazingira ya wazi. Zaidi ya hayo, ikiwa cluster yako inatumia metric-server, inaripoti allocations za resources zinazoweza kuwa za ziada/ndogo na inajaribu kukutahadharisha ikiwa cluster yako itakosa capacity.
### [**Kube-bench**](https://github.com/aquasecurity/kube-bench)
Chombo [**kube-bench**](https://github.com/aquasecurity/kube-bench) ni chombo kinachokagua ikiwa Kubernetes imewekwa kwa usalama kwa kukimbia ukaguzi ulioandikwa katika [**CIS Kubernetes Benchmark**](https://www.cisecurity.org/benchmark/kubernetes/).\
The tool [**kube-bench**](https://github.com/aquasecurity/kube-bench) ni zana inayothibitisha kama Kubernetes imewekwa kwa usalama kwa kuendesha ukaguzi unaoelezwa katika [**CIS Kubernetes Benchmark**].\
Unaweza kuchagua:
- kukimbia kube-bench kutoka ndani ya kontena (kushiriki PID namespace na mwenyeji)
- kukimbia kontena linaloweka kube-bench kwenye mwenyeji, na kisha kukimbia kube-bench moja kwa moja kwenye mwenyeji
- kuweka binaries za hivi karibuni kutoka kwenye [Releases page](https://github.com/aquasecurity/kube-bench/releases),
- kuandika kutoka chanzo.
- kuendesha kube-bench kutoka ndani ya container (sharing PID namespace with the host)
- kuendesha container inayosakinisha kube-bench kwenye host, kisha kuendesha kube-bench moja kwa moja kwenye host
- install the latest binaries from the [Releases page](https://github.com/aquasecurity/kube-bench/releases),
- compile it from source.
### [**Kubeaudit**](https://github.com/Shopify/kubeaudit)
**[IMEKATWA]** Chombo [**kubeaudit**](https://github.com/Shopify/kubeaudit) ni chombo cha mistari ya amri na pakiti ya Go ili **kukagua klasta za Kubernetes** kwa wasiwasi mbalimbali wa usalama.
**[DEPRECATED]** The tool [**kubeaudit**](https://github.com/Shopify/kubeaudit) ni command line tool na Go package kwa **kukagua Kubernetes clusters** kwa masuala mbalimbali ya usalama.
Kubeaudit inaweza kugundua ikiwa inakimbia ndani ya kontena katika klasta. Ikiwa ndivyo, itajaribu kukagua rasilimali zote za Kubernetes katika klasta hiyo:
Kubeaudit inaweza kugundua ikiwa inakimbia ndani ya container katika cluster. Ikiwa hivyo, itajaribu kukagua all Kubernetes resources katika cluster hiyo:
```
kubeaudit all
```
Hii zana pia ina hoja `autofix` ili **kurekebisha kiotomatiki matatizo yaliyogundulika.**
Zana hii pia ina hoja `autofix` ili **kurekebisha matatizo yaliyotambuliwa moja kwa moja.**
### [**Kube-hunter**](https://github.com/aquasecurity/kube-hunter)
**[IMEKATISHWA]** Zana [**kube-hunter**](https://github.com/aquasecurity/kube-hunter) inatafuta udhaifu wa usalama katika makundi ya Kubernetes. Zana hii ilitengenezwa ili kuongeza ufahamu na mwonekano wa matatizo ya usalama katika mazingira ya Kubernetes.
**[HAITUMIKI]** Zana [**kube-hunter**](https://github.com/aquasecurity/kube-hunter) hufuatilia udhaifu wa usalama katika clusters za Kubernetes. Zana ilibuniwa ili kuongeza uelewa na uwazi wa masuala ya usalama katika mazingira ya Kubernetes.
```bash
kube-hunter --remote some.node.com
```
### [Trivy](https://github.com/aquasecurity/trivy)
[Trivy](https://github.com/aquasecurity/trivy) ina skana zinazotafuta masuala ya usalama, na malengo ambapo inaweza kupata masuala hayo:
[Trivy](https://github.com/aquasecurity/trivy) ina scanners zinazotafuta masuala ya usalama, na malengo ambapo inaweza kupata masuala hayo:
- Picha ya Kontena
- Mfumo wa Faili
- Hifadhi ya Git (mbali)
- Picha ya Mashine ya Kijamii
- Container Image
- Filesystem
- Git Repository (remote)
- Virtual Machine Image
- Kubernetes
### [**Kubei**](https://github.com/Erezf-p/kubei)
**[Inaonekana kama haijatunzwa]**
**[Inaonekana haitosimamiwa]**
[**Kubei**](https://github.com/Erezf-p/kubei) ni chombo cha skanning za udhaifu na zana ya kiwango cha CIS Docker inayowaruhusu watumiaji kupata tathmini sahihi na ya haraka ya hatari ya makundi yao ya kubernetes. Kubei inachanganua picha zote zinazotumiwa katika kundi la Kubernetes, ikiwa ni pamoja na picha za pods za programu na pods za mfumo.
[**Kubei**](https://github.com/Erezf-p/kubei) ni zana ya vulnerabilities scanning na CIS Docker benchmark ambayo inawawezesha watumiaji kupata tathmini sahihi na ya papo hapo ya hatari za kubernetes clusters zao. Kubei inascans all images ambazo zinatumiwa katika Kubernetes cluster, ikijumuisha images za application pods na system pods.
### [**KubiScan**](https://github.com/cyberark/KubiScan)
[**KubiScan**](https://github.com/cyberark/KubiScan) ni chombo cha kuchanganua kundi la Kubernetes kwa ruhusa hatari katika mfano wa udhibiti wa ufikiaji wa msingi wa jukumu la Kubernetes (RBAC).
[**KubiScan**](https://github.com/cyberark/KubiScan) ni zana ya kuchunguza Kubernetes cluster kwa ruhusa zenye hatari katika modeli ya uthibitishaji ya Role-based access control (RBAC) ya Kubernetes.
### [Managed Kubernetes Auditing Toolkit](https://github.com/DataDog/managed-kubernetes-auditing-toolkit)
[**Mkat**](https://github.com/DataDog/managed-kubernetes-auditing-toolkit) ni chombo kilichojengwa ili kujaribu aina nyingine za ukaguzi wa hatari kubwa ikilinganishwa na zana nyingine. Kimsingi ina hali 3 tofauti:
[**Mkat**](https://github.com/DataDog/managed-kubernetes-auditing-toolkit) ni zana iliyojengwa kutesta aina nyingine za ukaguzi zenye hatari kubwa ikilinganishwa na zana nyingine. Kimsingi ina modes 3 tofauti:
- **`find-role-relationships`**: Ambayo itagundua ni majukumu gani ya AWS yanayoendesha katika pods zipi
- **`find-secrets`**: Ambayo inajaribu kubaini siri katika rasilimali za K8s kama Pods, ConfigMaps, na Secrets.
- **`test-imds-access`**: Ambayo itajaribu kuendesha pods na kujaribu kufikia metadata v1 na v2. ONYO: Hii itaanzisha pod katika kundi, kuwa makini sana kwa sababu huenda hutaki kufanya hivi!
- **`find-role-relationships`**: Ambayo itagundua ni AWS roles zipi zinaendeshwa katika pods gani
- **`find-secrets`**: Inajitahidi kutambua secrets katika rasilimali za K8s kama Pods, ConfigMaps, na Secrets.
- **`test-imds-access`**: Itajaribu kuendesha pods na kujaribu kupata metadata v1 na v2. ONYO: Hii itaendesha pod kwenye cluster; kuwa mwangalifu sana kwa sababu huenda haukutaki kufanya hivyo!
## **Audit IaC Code**
## **Kagua IaC Code**
### [**KICS**](https://github.com/Checkmarx/kics)
[**KICS**](https://github.com/Checkmarx/kics) inapata **udhaifu wa usalama**, masuala ya kufuata, na makosa ya usanidi wa miundombinu katika **Suluhisho za Miundombinu kama Msimbo**: Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Microsoft ARM, na spesifikesheni za OpenAPI 3.0
[**KICS**](https://github.com/Checkmarx/kics) inapata security vulnerabilities, masuala ya compliance, na misconfiguration za miundombinu katika suluhisho zifuatazo za Infrastructure as Code: Terraform, Kubernetes, Docker, AWS CloudFormation, Ansible, Helm, Microsoft ARM, na OpenAPI 3.0 specifications
### [**Checkov**](https://github.com/bridgecrewio/checkov)
[**Checkov**](https://github.com/bridgecrewio/checkov) ni chombo cha uchambuzi wa msimbo wa statiki kwa miundombinu kama msimbo.
[**Checkov**](https://github.com/bridgecrewio/checkov) ni zana ya static code analysis kwa infrastructure-as-code.
Inachanganua miundombinu ya wingu iliyotolewa kwa kutumia [Terraform](https://terraform.io), mpango wa Terraform, [Cloudformation](https://aws.amazon.com/cloudformation/), [AWS SAM](https://aws.amazon.com/serverless/sam/), [Kubernetes](https://kubernetes.io), [Dockerfile](https://www.docker.com), [Serverless](https://www.serverless.com) au [ARM Templates](https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/overview) na kugundua makosa ya usalama na kufuata kwa kutumia uchambuzi wa msingi wa grafu.
Inascans cloud infrastructure iliyotolewa kwa kutumia [Terraform](https://terraform.io), Terraform plan, [Cloudformation](https://aws.amazon.com/cloudformation/), [AWS SAM](https://aws.amazon.com/serverless/sam/), [Kubernetes](https://kubernetes.io), [Dockerfile](https://www.docker.com), [Serverless](https://www.serverless.com) au [ARM Templates](https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/overview) na inagundua security na compliance misconfigurations kwa kutumia graph-based scanning.
### [**Kube-score**](https://github.com/zegl/kube-score)
[**kube-score**](https://github.com/zegl/kube-score) ni chombo kinachofanya uchambuzi wa msimbo wa statiki wa maelezo yako ya vitu vya Kubernetes.
[**kube-score**](https://github.com/zegl/kube-score) ni zana inayofanya static code analysis ya Kubernetes object definitions zako.
Ili kusakinisha:
To install:
| Usambazaji | Amri / Kiungo |
| --------------------------------------------------- | --------------------------------------------------------------------------------------- |
| Binaries zilizojengwa kwa macOS, Linux, na Windows | [GitHub releases](https://github.com/zegl/kube-score/releases) |
| Usambazaji | Amri / Kiungo |
| --------------------------------------------------- | ---------------------------------------------------------------------------------------- |
| Binary zilizotengenezwa tayari kwa macOS, Linux, na Windows | [GitHub releases](https://github.com/zegl/kube-score/releases) |
| Docker | `docker pull zegl/kube-score` ([Docker Hub)](https://hub.docker.com/r/zegl/kube-score/) |
| Homebrew (macOS na Linux) | `brew install kube-score` |
| [Krew](https://krew.sigs.k8s.io/) (macOS na Linux) | `kubectl krew install score` |
| Homebrew (macOS and Linux) | `brew install kube-score` |
| [Krew](https://krew.sigs.k8s.io/) (macOS and Linux) | `kubectl krew install score` |
## Zana za kuchambua faili za YAML & Helm Charts
### [**Kube-linter**](https://github.com/stackrox/kube-linter)
```bash
# Install Kube-linter
brew install kube-linter
# Run Kube-linter
## lint ./path/to/yaml/or/chart
```
### [Checkov](https://github.com/bridgecrewio/checkov)
```bash
# Install Checkov
pip install checkov
# Run Checkov
checkov -d ./path/to/yaml/or/chart
```
### [kube‑score](https://github.com/zegl/kube-score)
```bash
# Install kube-score
brew install kube-score
# Run kube-score
kube-score score ./path/to/yaml
# or
helm template chart /path/to/chart | kube-score score -
# or if the chart needs some values
helm template chart /path/to/chart \
--set 'config.urls[0]=https://dummy.backend.internal' \
| kube-score score -
```
### [Kubesec](https://github.com/controlplaneio/kubesec)
```bash
# Install Kubesec
## Download from https://github.com/controlplaneio/kubesec/releases
# Run Kubesec in a yaml
kubesec scan ./path/to/yaml
# or
helm template chart /path/to/chart | kubesec scan -
# or if the chart needs some values
helm template chart /path/to/chart \
--set 'config.urls[0]=https://dummy.backend.internal' \
| kubesec scan -
```
## Vidokezo
### Kubernetes PodSecurityContext na SecurityContext
Unaweza kuunda **muktadha wa usalama wa Pods** (kwa _PodSecurityContext_) na wa **kontena** ambazo zitakazoendeshwa (kwa _SecurityContext_). Kwa maelezo zaidi soma:
Unaweza kusanidi **security context ya Pods** (kwa _PodSecurityContext_) na ya **containers** zitakazotumika (kwa _SecurityContext_). Kwa taarifa zaidi soma:
{{#ref}}
kubernetes-securitycontext-s.md
{{#endref}}
### Kubernetes API Hardening
### Kukaza usalama wa Kubernetes API
Ni muhimu sana **kulinda ufikiaji wa Kubernetes Api Server** kwani mhusika mbaya mwenye mamlaka ya kutosha anaweza kuweza kuutumia vibaya na kuharibu mazingira kwa njia nyingi.\
Ni muhimu kulinda **ufikiaji** (**whitelist** asili za kufikia API Server na kukataa muunganisho mwingine wowote) na [**uthibitishaji**](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/) (kufuata kanuni ya **kidogo** **mamlaka**). Na hakika **kamwe** **usiruhusu** **maombi** **yasiyo na jina**.
Ni muhimu sana **kulinda ufikiaji wa Kubernetes Api Server** kwani mhalifu mwenye vibali vya kutosha anaweza kuweza kuitumia vibaya na kuharibu mazingira kwa njia nyingi.\
Ni muhimu kuhakikisha usalama wa both **access** (**whitelist** origins za kufikia API Server na kukataa muunganisho mwingine wowote) na [**authentication**](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet-authentication-authorization/) (ikifuata kanuni ya **least** **privilege**). Na bila shaka **kamwe** usiruhusu **anonymous** **requests**.
**Mchakato wa Maombi ya Kawaida:**\
Mtumiaji au K8s ServiceAccount –> Uthibitishaji –> Uidhinishaji –> Udhibiti wa Kukubali.
Mchakato wa kawaida wa Ombi:\
User au K8s ServiceAccount –> Authentication –> Authorization –> Admission Control.
**Vidokezo**:
Vidokezo:
- Funga bandari.
- Epuka ufikiaji wa Kijadi.
- NodeRestriction; Hakuna ufikiaji kutoka nodi maalum kwenda API.
- Epuka ufikiaji wa Anonymous.
- NodeRestriction; Hakuna ufikiaji kutoka nodes maalum kwa API.
- [https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction](https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/#noderestriction)
- Kimsingi inazuia kubelets kuongeza/kuondoa/kubadilisha lebo zenye prefix ya node-restriction.kubernetes.io/. Prefix hii ya lebo imehifadhiwa kwa wasimamizi kuweka lebo kwenye vitu vya Node kwa madhumuni ya kutenganisha kazi, na kubelets hazitaruhusiwa kubadilisha lebo zenye prefix hiyo.
- Na pia, inaruhusu kubelets kuongeza/kuondoa/kubadilisha lebo hizi na prefix za lebo.
- Hakikisha kwa lebo kutenganisha kazi salama.
- Epuka pods maalum kutoka kwa ufikiaji wa API.
- Epuka kufichua ApiServer kwa mtandao.
- Epuka ufikiaji usioidhinishwa RBAC.
- Bandari ya ApiServer na moto wa kuzuia na orodha ya IP za kuingia.
- Kwa msingi, inazuia kubelets kuingiza/kuondoa/kusasisha labels zenye kiambishi node-restriction.kubernetes.io/. Kiambishi hiki cha label kimehifadhiwa kwa administrators kwa ajili ya kuweka lebo kwenye Node objects kwa madhumuni ya kutenganisha workloads, na kubelets hazitaruhusiwa kubadilisha labels zenye kiambishi hicho.
- Na pia, inaruhusu kubelets kuongeza/kuondoa/kusasisha label hizi na viambishi vya lebo.
- Hakikisha utenganisho salama wa workloads kwa kutumia lebo.
- Zuia pods maalum kupata ufikiaji wa API.
- Epuka kuonyesha ApiServer kwenye intaneti.
- Epuka ufikiaji usioidhinishwa kwa RBAC.
- Weka bandari ya ApiServer nyuma ya firewall na fanya IP whitelisting.
### SecurityContext Hardening
### Kukaza SecurityContext
Kwa kawaida mtumiaji wa root atatumika wakati Pod inaanzishwa ikiwa mtumiaji mwingine hajabainishwa. Unaweza kuendesha programu yako ndani ya muktadha salama zaidi kwa kutumia kigezo kinachofanana na hiki:
Kwa default mtumiaji root atatumika wakati Pod inapoanzishwa ikiwa hakuna mtumiaji mwingine ameainishwa. Unaweza kuendesha application yako ndani ya context yenye usalama zaidi ukitumia template inayofanana na ile ifuatayo:
```yaml
apiVersion: v1
kind: Pod
@@ -179,30 +225,30 @@ allowPrivilegeEscalation: true
- [https://kubernetes.io/docs/tasks/configure-pod-container/security-context/](https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
- [https://kubernetes.io/docs/concepts/policy/pod-security-policy/](https://kubernetes.io/docs/concepts/policy/pod-security-policy/)
### Uimarishaji wa Jumla
### Kuimarisha kwa jumla
Unapaswa kusasisha mazingira yako ya Kubernetes mara kwa mara kadri inavyohitajika ili kuwa na:
- Mifumo ya utegemezi iliyo na toleo jipya.
- Marekebisho ya makosa na usalama.
- Tegemezi zikiwa za kisasa.
- Patch za hitilafu (bug) na usalama.
[**Mizunguko ya kutolewa**](https://kubernetes.io/docs/setup/release/version-skew-policy/): Kila miezi 3 kuna toleo jipya dogo -- 1.20.3 = 1(Mkubwa).20(Dogo).3(marekebisho)
[**Release cycles**](https://kubernetes.io/docs/setup/release/version-skew-policy/): Kila miezi 3 kuna toleo ndogo jipya -- 1.20.3 = 1(Major).20(Minor).3(patch)
**Njia bora ya kusasisha Kundi la Kubernetes ni (kutoka** [**hapa**](https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/)**):**
**Njia bora ya kusasisha Kubernetes Cluster ni (kutoka** [**here**](https://kubernetes.io/docs/tasks/administer-cluster/cluster-upgrade/)**):**
- Pandisha viungo vya Node ya Mwalimu ukifuatia mpangilio huu:
- etcd (mifano yote).
- kube-apiserver (mashine zote za udhibiti).
- Sasisha vipengele vya Master Node kwa kufuata mfuatano huu:
- etcd (instances zote).
- kube-apiserver (host zote za control plane).
- kube-controller-manager.
- kube-scheduler.
- meneja wa udhibiti wa wingu, ikiwa unatumia mmoja.
- Pandisha viungo vya Node za Wafanyakazi kama kube-proxy, kubelet.
- cloud controller manager, ikiwa unatumia moja.
- Sasisha vipengele vya Worker Node kama kube-proxy, kubelet.
## Ufuatiliaji & Usalama wa Kubernetes:
## Kubernetes ufuatiliaji na usalama:
- Kyverno Policy Engine
- Cilium Tetragon - Ufuatiliaji wa Usalama wa eBPF na Utekelezaji wa Wakati Halisi
- Sera za Usalama wa Mtandao
- Falco - Ufuatiliaji wa usalama wa wakati halisi & ugunduzi
- Cilium Tetragon - Observability ya usalama inayotegemea eBPF na utekelezaji wakati wa runtime
- Sera za Usalama za Mtandao
- Falco - Ufuatiliaji wa usalama wakati wa runtime na utambuzi
{{#include ../../../banners/hacktricks-training.md}}