Project: KICS (Provisioning / Security & Compliance)
File: integrations_kuberneter.md

From version 1.6, KICS calls the Kubernetes API to scan resources deployed in the runtime K8scluster. The runtime information of the resources is obtained by providing the K8s credentials as environment variables and a kuberneter path to KICS, via `-p` flag. The scan happens immediately after this information is obtained. In the end, results are shown as for any other KICS scan. For KICS to get the runtime information of your resources, you need to provide your K8s Credentials as environment variables. MacOS and Linux: ```sh export K8SCONFIGFILE="<K8SCONFIGFILE>" ``` Windows: ```sh SET K8SCONFIGFILE=<K8SCONFIGFILE> ``` Powershell: ```sh $Env:K8SCONFIGFILE="<K8SCONFIGFILE>" ``` Note that your Service Account Token should have list permissions for the chosen resources. Additionally to that, note that `K8SCADATA` and `K8SSATOKEN_DATA` should be base64 encoded. MacOS and Linux: ```sh export K8SHOST="<K8SHOST>" export K8SCAFILE="<K8SCAFILE>" or export K8SCADATA="K8SCADATA" export K8SSATOKENFILE="K8SSATOKENFILE>" or export K8SSATOKENDATA="K8SSATOKENDATA" ``` Windows: ```sh SET K8SHOST=<K8SHOST> SET K8SCAFILE=<K8SCAFILE> or SET K8SCADATA=<K8SCADATA> SET K8SSATOKENFILE=<K8SSATOKENFILE> or SET K8SSATOKENDATA=<K8SSATOKENDATA> ``` Powershell: ```sh $Env:K8SHOST="<K8SHOST>" $Env:K8SCAFILE="<K8SCAFILE>" or $Env:K8SCADATA="<K8SCADATA>" $Env:K8SCAFILE="<K8SSATOKENFILE>" or $Env:K8SCADATA="<K8SSATOKENDATA>" ``` Note that your "certificate user" should have list permissions for the chosen resources. Additionally to that, note that `K8SCADATA`, `K8SCERTDATA`, and `K8SKEYDATA` should be base64 encoded. MacOS and Linux: ```sh export K8SHOST="<K8SHOST>" export K8SCAFILE="<K8SCAFILE>" or export K8SCADATA="K8SCADATA" export K8SCERTFILE="<K8SCERTFILE>" or export K8SCERTDATA="K8SCERTDATA" export K8SKEYFILE="<K8SKEYFILE>" or export K8SKEYDATA="K8SKEYDATA" ``` Windows: ```sh SET K8SHOST=<K8SHOST> SET K8SCAFILE=<K8SCAFILE> or SET K8SCADATA=<K8SCADATA> SET K8SCERTFILE=<K8SCERTFILE> or SET K8SCERTDATA=<K8SCERTDATA> SET K8SKEYFILE=<K8SKEYFILE> or SET K8SKEYDATA=<K8SKEYDATA> ``` Powershell: ```sh $Env:K8SHOST="<K8SHOST>" $Env:K8SCAFILE="<K8SCAFILE>" or $Env:K8SCADATA="<K8SCADATA>" $Env:K8SCERTFILE="<K8SCERTFILE>" or $Env:K8SCERTDATA="<K8SCERTDATA>" $Env:K8SKEYFILE="<K8SKEYFILE>" or $Env:K8SKEYDATA="<K8SKEYDATA>" ``` ```sh kuberneter::{namespaces}:{apiVersions}:{kinds} ``` To import all the namespaces, apiVersions, or kinds, please use: ``. For example, `kuberneter::::`. To specify the namespaces, apiVersions, or kinds, please use: separator `+`. For example,` kuberneter::*:apps/v1+v1:ServiceAccount`. The API Versions and their respective kinds (both case sensitive) are listed below: | API Versions | Kinds | ||-| | apps/v1 | DaemonSet <br/>Deployment <br/>ReplicaSet <br/>StatefulSet | | core/v1 | LimitRange <br/>Pod <br/>PersistentVolume <br/>PersistentVolumeClaim <br/>ReplicationController <br/>ResourceQuota <br/>Secret ServiceAccount Service | | batch/v1 | CronJob <br/>Job | | networking.k8s.io/v1 | IngressClass <br/>Ingress <br/>NetworkPolicy | | policy/v1 | PodDisruptionBudget | | rbac.authorization.k8s.io/v1 | ClusterRoleBinding <br/>ClusterRole <br/>RoleBinding <br/>Role | | apps/v1beta1 | Deployment <br/>StatefulSet | | apps/v1beta2 | DaemonSet <br/>Deployment <br/>ReplicaSet S<br/>tatefulSet | | batch/v1beta1 | CronJob | | networking.k8s.io/v1beta1 | IngressClass <br/>Ingress | | policy/v1beta1 | PodDisruptionBudget <br/>PodSecurityPolicy | | rbac.authorization.k8s.io/v1alpha1 | ClusterRoleBinding <br/>ClusterRole <br/>RoleBinding <br/>Role | | rbac.authorization.k8s.io/v1beta1 | ClusterRoleBinding <br/>ClusterRole <br/>RoleBinding <br/>Role | When running KICS using a kuberneter path, the resources are imported using the credentials set as environment variables in Kubernetes format to the current working directory in a new folder named `kics-extract-kuberneter` following the above-described structure. KICS will then run a scan on these local files. If the flag `-o, --output-path` is passed, the folder `kics-extract-kuberneter` will be generated in the reports directory instead. ``` kics-extract-kuberneter/ {apiGroup}/ {apiVersion}/ {kind}.yaml ``` To run KICS Kuberneter with Docker, you can simply pass the K8s Credentials that were set as environment variables to the docker run command and use the kuberneter path syntax Examples: ```sh docker run -v <credentialspath>:/credentials -v ${PWD}:/path/ -e K8SCONFIG_FILE=/credentials/<config-file-name> checkmarx/kics:latest scan -p "kuberneter::::*" -v --no-progress -o /path/results ``` ```sh docker run -v ${PWD}:/path/ -e K8SHOST -e K8SCADATA -e K8SSATOKENDATA kuberneter scan -p "kuberneter::::*" -v --no-progress -o /path/results ``` ```sh docker run -v ${PWD}:/path/ -e K8SHOST -e K8SCADATA -e K8SSATOKENDATA kuberneter scan -p "kuberneter::::*" -v --no-progress -o /path/results ``` ```sh docker run -v ${PWD}:/path/ -e K8SHOST -e K8SCADATA -e K8SCERTDATA -e K8SKEY_DATA checkmarx/kics:latest scan -p "kuberneter::::*" -v --no-progress -o /path/results ```