Version: Current

kubeaudit

Kubeaudit finds security misconfigurations in you Kubernetes Resources and gives tips on how to resolve these.

Kubeaudit comes with a large lists of "auditors" which test various aspects, like the SecurityContext of pods. You can find the complete list of auditors here.

To learn more about the kubeaudit itself visit kubeaudit GitHub.

Deployment

The kube-hunter ScanType can be deployed via helm:

helm upgrade --install kubeaudit secureCodeBox/kubeaudit

Chart Configuration

KeyTypeDefaultDescription
kubeauditScopestring"namespace"Automatically sets up rbac roles for kubeaudit to access the ressources it scans. Can be either "cluster" (ClusterRole) or "namespace" (Role)
parserImage.repositorystring"docker.io/securecodebox/parser-kubeaudit"Parser image repository
parserImage.tagstringdefaults to the charts versionParser image tag
scannerJob.envlist[]Optional environment variables mapped into each scanJob (see: https://kubernetes.io/docs/tasks/inject-data-application/define-environment-variable-container/)
scannerJob.extraContainerslist[]Optional additional Containers started with each scanJob (see: https://kubernetes.io/docs/concepts/workloads/pods/init-containers/)
scannerJob.extraVolumeMountslist[]Optional VolumeMounts mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
scannerJob.extraVolumeslist[]Optional Volumes mapped into each scanJob (see: https://kubernetes.io/docs/concepts/storage/volumes/)
scannerJob.resourcesobject{}CPU/memory resource requests/limits (see: https://kubernetes.io/docs/tasks/configure-pod-container/assign-memory-resource/, https://kubernetes.io/docs/tasks/configure-pod-container/assign-cpu-resource/)
scannerJob.securityContextobject{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}Optional securityContext set on scanner container (see: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/)
scannerJob.securityContext.allowPrivilegeEscalationboolfalseEnsure that users privileges cannot be escalated
scannerJob.securityContext.capabilities.drop[0]string"all"This drops all linux privileges from the container.
scannerJob.securityContext.privilegedboolfalseEnsures that the scanner container is not run in privileged mode
scannerJob.securityContext.readOnlyRootFilesystembooltruePrevents write access to the containers file system
scannerJob.securityContext.runAsNonRootbooltrueEnforces that the scanner image is run as a non root user
scannerJob.ttlSecondsAfterFinishedstringnilDefines how long the scanner job after finishing will be available (see: https://kubernetes.io/docs/concepts/workloads/controllers/ttlafterfinished/)

Examples

juice-shop

apiVersion: "execution.securecodebox.io/v1"
kind: Scan
metadata:
name: "kubeaudit-juiceshop"
spec:
scanType: "kubeaudit"
parameters:
- "-n"
- "juice-shop"