Kubescape: a Kind Insurance Inspector for Your Kubernetes Investments
Tags: devsecops, kubernetes, opensource, cve
Published: 2022-06-13 17:06:09

##0. Introduction
Container security is a critical aspect of running and administering a cloud environment. This article will focus on open source security tools for Kubernetes and containers, as we feel that some free tools are just as good as their commercial counterparts. 

One of a major challenges among DevOps tasks is usually in charge of container creation and maintenance. They employ continuous integration and continuous delivery pipelines, often known as CI/CD pipelines, to stay up with the fast speed of business you're used to, as well as the competition and client demand. However, if security isn't part of the equation, you might soon expose yourself to danger. Because regular DevOps people aren't always best trained in security, the correct container tools and security solutions are critical.

The Red Hat State of Kubernetes Security Report [exposes many of the issues](https://www.redhat.com/en/resources/state-kubernetes-security-report) that exist in the present Kubernetes ecosystem. The following are some of the report's most notable data points:
- Security worries around Kubernetes have hampered or delayed production implementation for 55 percent of business IT companies.
![94 percent of companies](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/chsgtbdc2vhaoeznr8ha.png)
- In the last 12 months, **94 percent** of survey respondents indicated that they had **at least one** security incident in their Kubernetes system.
- The biggest issue of 59 percent of businesses about adopting container techniques is how to secure them and maintain a good security posture.

More than only vulnerability detection is done by container security tools. They make sure that everything in your container is running according to your instructions. The process of securing containers must run in the background, not just guarding the container host, its network traffic, and its management stack, but also maintaining the build pipeline, your application security, and the container's fundamental layers.

Here is a review of one powerful open-source container tool that can help you do just that. 

##I. What makes kubescape special  
![kubescape](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/z2uu64uxxyt90b028jnb.png)

First to say, kubescape is the first open source by ARMO (5.8k⭐) tool for running NSA and CISA Kubernetes hardening tests. 

To assist companies in making their Kubernetes environments more difficult to compromise, the National Security Agency (NSA) and the Cybersecurity and Infrastructure Security Agency (CISA) have published [comprehensive recommendations](https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/) in 60 pages for strengthening the security of an organization's Kubernetes system. 

This 66-page cybersecurity [technical paper ](https://media.defense.gov/2021/Aug/03/2002820425/-1/-1/0/CTR_Kubernetes_Hardening_Guidance_1.1_20220315.PDF) focuses on the common origins of a compromised Kubernetes environment and provides practical advice for administrators on how to operate Kubernetes securely.

To learn more, visit [kubescape](https://github.com/armosec/kubescape) GitHub page.

Kubescape is based on [Open Policy Agent engine](https://github.com/open-policy-agent/opa) and ARMO’s posture controls. 

Kubescape retrieves the Kubernetes objects from the API server and scan them by running a [set of snippets](https://github.com/armosec/regolibrary/tree/master/rules) developed by ARMO.

🎓 If you're interesting what OPA is, please read [this article](https://www.magalix.com/blog/integrating-open-policy-agent-opa-with-kubernetes-a-deep-dive-tutorial) by Magalix.

Kubescape establishes how well your Kubernetes configurations meet the best practice recommendations from the NSA and CISA guidance. 

The output results are printed in a console friendly manner by default, but they can be also retrieved in JUnit XML,  JSON, PDF or even in Prometheus' metrics format for further processing. 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zp2r0bhck4a8egub3d8x.png)
Also, when working with ARMO portal, you may export the resulting report to a CSV file.

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l44i0yxy9e5i10lfy15h.png)

##II. What can you test your orchestrator for

Kubescape is running the following tests according to what is defined Kubernetes Hardening Guidance by NSA and CISA. Among of them are:

- Non-root containers
- Immutable container file system 
- Building secure container images
- Privileged containers 
- `hostPID`, `hostIPC` privileges
- `hostNetwork` access
- `allowedHostPaths` field
- Protecting pod service account tokens
- Pods in `kube-system` and `kube-public`
- Resource policies
- Control plane hardening 
- Encrypted secrets 
- Anonymous Requests

The number of tests is constantly increasing, the company maintains updated [CVE database](https://hub.armo.cloud/docs).

The connectivity of roles and privileges between different portions of a Kubernetes cluster is visualized using a strong Role-Based Access Control (RBAC) module. All of these features are already available in Kubescape. Kubescape explains why controls fail and suggests configuration changes to improve security posture for developers and DevOps teams.

![kubescape vulnerability scanning snapshot](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ifbukpysi9gv10lzfccw.png)

The company offers pricing plans which vary depending on a number of your worker nodes. You pay for access to ARMO's CVE database and to their web portal. 

##III. Appearances, passwords, misty signs

You may install `kubescape` [with or without pre-registering your cluster](https://hub.armo.cloud/docs/installation-of-armo-in-cluster) on the portal (in the first case, a secret key is provided). A [helm chart](https://github.com/armosec/armo-helm) is available for convenient installation.

![kubescape start scan](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/k5zp4xeg816r4r5ssmfb.png)

Kubescape can function without being connected to a cluster. You may validate the security of resource manifests saved as local YAML files (it looks like `kubescape scan *.yaml`) before applying them to your cluster. 

Add an extra parameter to define the YAML manifests you wish to scan.

{% embed https://youtu.be/Ox6DaR7_4ZI %}

There's an option of integration [with popular cloud providers](https://hub.armo.cloud/docs/kubescape-integration-with-cloud-providers) (some [limitations](https://hub.armo.cloud/docs/limitations) should be kept in mind), and also of [CI integration](https://hub.armo.cloud/docs/github-1). 

For example, in your GHA CI you may create a trigger job which is capable to stop the whole flow if your YAMLs are failing the security checks. To achieve that, you can invoke the tool with `-t` flag and an appropriate value. Valid values are integers between `0` - `100`. A value of `100` will never fail.  

```yaml
jobs:
    nsa-security-check:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2 
      - name: Scan YAML files
        run: kubescape scan framework nsa -t 20 deployments/*.yaml
```
🎓 See one of the best flows [here](https://raw.githubusercontent.com/kranurag7/kubescape-argo/main/.github/workflows/docker-publish.yml). Thanks to Kumar Anurag.

Your `kubescape` enabled job will return failure if more than 20 percent of objects are failing security tests.

##IV. Limitations
All this, of course, is wonderful, but it should be noted separately that Kubescape does check involved docker images, but it doesn’t check for vulnerabilities inside the docker containers you run in your cluster. 

You’ll need another tool such as `docker scan`, `grype` or `trivy` to do that. Running a container scanning engine alongside Kubescape gives you the most complete picture of your environment’s security posture.

##V. Argumentum ad populum 

Viktor Farcic, widely known in narrow DevOps circles, did not remain indifferent to the solution from ARMO.

{% embed https://youtu.be/ZATGiDIDBQk %}

Well, so are we! It should be noted that the author of the article, at least, did not find competitors for the described tool. Maybe, except Bridgecrew's `checkov`, but they use completely [different approaches](https://docs.bridgecrew.io/docs/open-source-vulnerability-scanning). So, definitely, this is a topic for another article, not this one.

By the end of April 2022, ARMO [has raised $30 million](https://www.calcalistech.com/ctechnews/article/syzoki8b5) in Series A funding. At Otomato, we wish them continued success in maintaining community interest and selling plans! 💰

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qxm859slwprexkfmd1q9.gif)

_Picture: ITPro UK / Shutterstock / Dilbert_