Secure Kubernetes With Kubescape

Kubernetes is powerful — but complex. It’s easy to leave a cluster vulnerable to attack. The first line of defense are automated security checks.

Kubernetes keeps growing. According to a recent survey, its adoption among developers increased by a staggering 67% in 2021. Enterprises are migrating to Kubernetes to enjoy the flexibility and scalability of cloud-native applications.

There’s no doubt of Kubernetes’ value to enterprises, but it comes at a cost: due to its complexity, it’s remarkably easy to leave a cluster vulnerable to attacks. Enterprises know this; in its state of Kubernetes security report, Red Hat stated that 59% of respondents considered container security a threat.

Installing automated security checks in continuous integration and delivery (CI/CD), the only place where all code must pass before entering production, is the best way to start defending against threats, and Kubescape can help you do just that.

In this article, we'll learn how to run Kubescape in our CI/CD pipelines to detect threats before they are deployed.

Enter Kubescape

Kubescape is an open-source security checking tool for Kubernetes. Developed by ARMO, this tool can scan Kubernetes clusters, inspect containers, and detect unsafe deployments.

Even after years of experience running Kubernetes, enterprises are still learning the ins and out of securing a cluster. In 2019, a cryptocurrency miner somehow got into JW Player's cluster and began mining using their resources. Developers found that a container with elevated permissions was the cause. In this case, the elevated container permissions would have been detected prior to deployment had the JW Player's team used Kubescape in their deployment process. 

Kubescape implements more than 70 controls based on NSA, CISA, and Microsoft’s security guidelines. These controls are grouped into four categories, called frameworks:

· NSA: follows the NSA Kubernetes Hardening Guidelines. This is a top-down framework that focuses on application security.

· MITRE: follows Microsoft’s MITRE Framework. MITRE is primarily concerned with protecting Kubernetes infrastructure.

· ArmoBest: the ARMO Framework is maintained by the same folks behind Kubescape. The framework attempts to cover the blind spots between the MITRE and NSA frameworks.

· DevOpsBest: a minimal framework covering the most essential points for infrastructure and application security.

By default, Kubescape will run all checks and print out a risk level for each framework.

Sanity Controls to Secure Kubernetes

We can approach Kubernetes security from two perspectives. On the most fundamental level, there is a cluster that must be properly hardened against attacks — this is especially important for self-managed and on-premises installations. On the application level, we must check that deployments follow best practices and do not leave openings to be exploited.

Secure Kubernetes With Kubescape

The first set of controls we’ll see involve securing deployment manifests, which Kubernetes uses to describe the desired state of a set of resources. By analyzing this manifest, Kubescape can detect problems such as:

   · Unsecured SSH services running inside a container.

   · Sudo-commands in the container start command.

   · Running containers as root or with excessive capabilities

   · Running pods without a parent ReplicaSet.

   · Pods taking all the available CPU and memory.

You can see all the controls and available frameworks in the ArmoSec docs. Each control is associated with a risk level ranging from low to critical. At the end of the scanning process, Kubescape calculates a risk score from 0% (very secure) to 100% (not secure).

Scanning Kubernetes Manifests

Let’s see Kubescape in action. For this part of the tutorial, any valid Kubernetes manifest will do. As an example, I’ll use the deployment manifest from this repository:

   · semaphore-demo-nodejs-k8s

The basic command for scanning a Kubernetes manifest file is shown below:

Relevant Blogs:

Securing Your Containers - Top 3 Challenges 

Kubernetes-Native Inner Loop Development With Quarkus 

Dockerizing a MERN Stack Web Application 

Docker Best Practices