owasp/kubelight

OWASP Kubernetes security and compliance tool [WIP]

OWASP KubeLight - Kubernetes Security Scanner

Scan your Kubernetes Cluster for Security & Compliance

1. Scan K8s clusters to detect Misconfiguration.
2. Lightweight, Pure python, fast, multithreaded tool.
3. NoSQL Query Engine.
4. Realtime alerts on Slack
5. SBOM generation and Image Vulnerability Scan.
6. Compliance Reports for PCI-DSS, SOC2, NSA and CIS Benchmarks.

Note - We are releasing above points in version 0.0.5

TODOS

• Kubernetes Pentest.
• Container Runtime security support - Sydig Falco and Machine learning
• Intiuitive UI and Dashboards
• CI/CD support.

Links

• OWASP Kubernetes Scanner

kubelight's Issues

Benchmark Module for Kubelight

Description

Kubelight requires a new benchmark module that helps to run various benchmarks on cluster configuration.

To Do

• Create a List of possible benchmarking rules

Memory and CPU Requests/Limit Check to be user input

As of now, we only check if the memory or CPU limit is set or not, better would be

1. To take user input to validate the memory and CPU limits.
2. Translate "M" and "m" for CPU and G, Gi, Mi, and M for RAM. Better to use 1000 conversion units for both.

Read Me improvement

1. Adding CI badges
2. Adding Sqube Badge - CodeQuality and Security
3. Adding Sponsor badge after permission.
4. Add Documentation link docs.kubelight.com

Kubernetes & Container Security

Exempting rules from default namespaces

Exempt to run rules in default namespaces
ex - default, kube-system.

Decorator for exception handling in Checker

1. Add exception handling to all the methods of Container Checker
2. Add exception handling so that flow will not be disrupted because of one issue.
3. Global exception is not recommended, still over the remove it, add comment for the same.

Getting specific containers that fail the checker rule.

If any container violates the checker rule, the culprit must be busted. So, better to create a ContainerCheck Flow that will help identify the culprit.

Steps

1. Creating a Container Check Class
2. Passing the Parent Workload via TinyDB Query Lambdas
3. Collect all the Parent Workloads violation and child containers in a Static Variable or Otherwise.
4. Ignore the TinyDB result and prioritize the ContainerCheck Class output