vuln_misconfig_scanning_k8s

Home

Kubernetes Vulnerability and Misconfiguration Scanning

This guide introduces tools and methods for scanning your Kubernetes clusters for security vulnerabilities and common misconfigurations. We will cover Starboard by Aqua Security and Kube-Scan by Octarine (now part of VMware).

1. Starboard (Aqua Security)

Starboard is an open-source Kubernetes-native security toolkit that provides vulnerability scanning, configuration auditing, and compliance checks.Project Repository: https://github.com/aquasecurity/starboard

1.1 Installation (Binary Release)

1. Download and Extract Starboard:(Note: The version v0.2.5 in the command below is old. Please check the Starboard GitHub Releases page for the latest version and update the URL accordingly.)

   mkdir -p $HOME/starboard # Ensure directory exists
   cd $HOME/starboard
   wget https://github.com/aquasecurity/starboard/releases/download/v0.2.5/starboard_linux_x86_64.tar.gz
   tar -zxvf starboard_linux_x86_64.tar.gz
   # This typically extracts the 'starboard' binary into the current directory.

   (Corrected tar zxfv to tar -zxvf for consistency and added -p to mkdir.)

2. Verify and Install (Optional but Recommended):

   ./starboard version # Verify it is working
   # For system-wide access, move it to a directory in your PATH:
   # sudo mv ./starboard /usr/local/bin/starboard

1.2 Installation (via Krew kubectl plugin)

Krew is a plugin manager for kubectl. This is often a more convenient way to install and manage Starboard.

1. Install Krew: Follow the official Krew installation instructions. The command usually looks like this:

   (
     set -x; cd "$(mktemp -d)" &&
     OS="$(uname | tr '[:upper:]' '[:lower:]')" &&
     ARCH="$(uname -m | sed -e 's/x86_64/amd64/' -e 's/\(arm\)\(64\)\?.*/\1\2/' -e 's/aarch64$/arm64/')" &&
     KREW="krew-${OS}_${ARCH}" &&
     curl -fsSLO "https://github.com/kubernetes-sigs/krew/releases/latest/download/${KREW}.tar.gz" &&
     tar zxvf "${KREW}.tar.gz" &&
     ./"${KREW}" install krew
   )

   (Updated Krew install script to a more modern version that auto-detects OS/ARCH.)

2. Add Krew to your PATH: Make sure ${KREW_ROOT:-$HOME/.krew}/bin is in your $PATH. Add this to your shell profile (e.g., ~/.bashrc or ~/.zshrc):

   export PATH="${KREW_ROOT:-$HOME/.krew}/bin:$PATH"
   # Source your profile or open a new terminal for this to take effect.

3. Install Starboard plugin using Krew:

   kubectl krew update # Update krew's local index of plugins
   kubectl krew install starboard

   Verify:

   kubectl starboard version # Or help

1.3 Initializing Starboard in Your Cluster

Starboard requires some Custom Resource Definitions (CRDs) and other resources to be set up in your cluster.

# Using the kubectl plugin version:
kubectl starboard init
# Or if you installed the binary and it's in your PATH:
# starboard init

Check that Starboard's CRDs are registered:

kubectl api-resources --api-group aquasecurity.github.io

1.4 Scanning for Vulnerabilities

Once initialized, Starboard can scan your workloads. Ensure you have a deployment or other workload to scan.

(Example: Assumes a deployment named echoserver-1-deployment exists in the app-routable-demo namespace. Replace with your actual workload details.)

1. Find vulnerabilities for a specific deployment:

   kubectl starboard find vulnerabilities deployment/echoserver-1-deployment --namespace app-routable-demo

2. Get the vulnerability report in YAML format:

   kubectl starboard get vulnerabilities deployment/echoserver-1-deployment \
     --namespace app-routable-demo \
     --output yaml

1.5 Starboard Octant Plugin (Optional)

Starboard also has an Octant plugin for visualizing security information. For installation, refer to the Starboard Octant Plugin documentation.

2. Kube-Scan (Octarine/VMware)

Kube-Scan is another tool that provides risk scoring for Kubernetes workloads based on CIS benchmarks and other checks.Project Repository: https://github.com/octarinesec/kube-scan

(Note: The Kube-Scan project might be less actively maintained compared to Starboard. Always check the repository for the latest status.)

2.1 Installation and Access

1. Deploy Kube-Scan to your cluster:

   kubectl apply -f https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan.yaml

2. Access the Kube-Scan UI using Port Forwarding:

   # This forwards your local port 9999 to the kube-scan-ui service's port 80 (default HTTP port)
   kubectl port-forward --namespace kube-scan svc/kube-scan-ui 9999:80

3. Open in Browser: Open your web browser and navigate to http://localhost:9999.(Changed studentX-1.training.dockerhack.me to localhost as port-forward typically makes it available there.)

Home