Audit

CIS

Tool	Description
docker-bench	Checks for common best-practices around deploying Docker containers in production Usage: docker run -it --net host --pid host --userns host --cap-add audit_control \ -e DOCKER_CONTENT_TRUST=$DOCKER_CONTENT_TRUST \ -v /var/lib:/var/lib \ -v /var/run/docker.sock:/var/run/docker.sock \ -v /usr/lib/systemd:/usr/lib/systemd \ -v /etc:/etc \ --label docker_bench_security \ docker/docker-bench-security
kube-bench	Checks whether Kubernetes is deployed according to security best practices kube-bench-exporter can export reports to remote targets like S3
kubescape	Test if your Kubernetes cluster is deployed securely as defined in NSA's Kubernetes Hardening Guidance
localtoast	A scanner for running security-related configuration checks such as CIS benchmarks in an easily configurable manner
gke-policy-automation	Tool and policy library for reviewing Google Kubernetes Engine clusters against best practices Auditing GKE Clusters across the entire organization: How to establish GKE cluster governance for Google Cloud organization using the GKE Policy Automation, an open-source tool created by the Google Professional Services team

General

Tool	Description
kubesec	Quantify risk for Kubernetes resources Usage: krew install kubesec-scan kubectl kubesec-scan pod hello-node-7f5b6bd6b8-26cm9
kube-hunter	Hunt for security weaknesses in Kubernetes clusters (even remote) Usage: From docker: docker run -it --rm --network host aquasec/kube-hunter From kubectl: kubectl run --rm -it kube-hunter --image=aquasec/kube-hunter --restart=Never --overrides="{ \"apiVersion\": \"v1\", \"spec\": { \"hostNetwork\": true } }"
kubeaudit	Audit clusters against common security controls Run from kubectl (as plugin): kubectl audit all
mkit	Managed Kubernetes Inspection Tool that validates several common security-related configuration settings of managed Kubernetes clusters It runs entirely from a local Docker container and queries your cloud provider's APIs and the Kubernetes API to determine if certain misconfigurations are found
starboard	Integrates security tools into a Kubernetes environment, so that users can find and view the risks that relate to different resources in a Kubernetes-native way kubectl-compatible command-line tool and an Octant plug-in
gke-auditor	A tool to detect a set of common Google Kubernetes Engine misconfigurations
stackrox	Performs a risk analysis of the container environment, delivers visibility and runtime alerts, and provides recommendations to proactively improve security by hardening the environment
trivy	Trivy now can scan kubernetes clusters It reports vulnerabilities and misconfigurations when scanning a full cluster, namespace or a resource
cloudfox	Helps gaining situational awareness in unfamiliar cloud environments and finding exploitable attack paths Introducing: CloudFox
hardeneks	Runs checks to see if an EKS cluster follows EKS Best Practices
managed-kubernetes-auditing-toolkit	All-in-one auditing toolkit for identifying common security issues in managed Kubernetes environments (EKS)
marvin	Marvin is a CLI tool that scans a k8s cluster by performing CEL expressions to report potential issues, misconfigurations and vulnerabilities
KubeHound	A Kubernetes attack graph tool allowing automated calculation of attack paths between assets in a cluster
Manual	List Control Plane API config (if not managed): kubectl -n kube-system exec kube-apiserver-control-plane -it -- kube-apiserver -h List images in use across all nodes: kubectl get nodes -ojsonpath='{range .items[*].status.images[*]}{.names[0]}{"\n"}{end}' | sort | uniq

Networking

Tool	Description
mizu	API traffic viewer for Kubernetes enabling you to view all API communication between microservices Think TCPDump and Wireshark re-invented for Kubernetes
nsenter	Tool for debugging container networking If you know the pause PID, you can effectively use any tools installed on the host (not the container) against the pod’s network namespace Usage: $ nsenter -t <pause-pid> -n tcpdump -i eth0
netshoot	A Docker + Kubernetes network trouble-shooting swiss-army container
netassert	Network security testing for DevSecOps workflows
PacketStreamer	Distributed tcpdump for cloud native environments Introducing PacketStreamer: distributed packet capture for cloud-native platforms

RBAC

Tool	Description
kubectl	List all resources and sub resources that can be constrained with RBAC kubectl get --raw /openapi/v2 | jq '.paths | keys[]'
rbac-tool	A collection of Kubernetes RBAC tools to sugar coat Kubernetes RBAC complexity (viz/analysis/lookup/who-can/policy-rules/auditgen/gen)
kubectl-can-i	To find out if you can perform a verb on a resource Also use Kubernetes' Impersonation API to see if another account is able to access a resource Usage: Find out if you can perform a verb on a resource: $ kubectl auth can-i get pods Confirm that you've been given cluster-admin permissions: $ kubectl auth can-i "*" "*" List all the actions you can perform in a namespace: $ kubectl auth can-i --list --namespace=secure Impersonation: take the Service Account named "unprivileged-service-account" (scoped to the "secure" namespace) and see if it has access to get pods: $ kubectl auth can-i get pod --as system:serviceaccount:secure:unprivileged-service-account
kubectl-who-can	Show who has permissions to <verb> <resources> in kubernetes Usage: See who has access to a secret ("cluster-admin-creds" in the "secure" namespace): $ kubectl who-can get secret cluster-admin-creds -n secure
Rakkess	Show an access matrix for k8s server resources Ideal for looking at a ServiceAccount object and trying to determine what it has access to Usage: Dump what your account has access to: $ kubectl access-matrix Look at what a particular Service Account can access: $ kubectl access_matrix --as system:serviceaccount:secure:unprivileged-service-account -n secure
rback	RBAC in Kubernetes visualizer Queries all RBAC related information and generates a graph representation of service accounts, (cluster) roles, and the respective access rules Usage: $ kubectl get sa,roles,rolebindings,clusterroles,clusterrolebindings --all-namespaces -o json | rback > result.dot $ dot -Tpng results.dot > /tmp/rback.png && open /tmp/rback.png
rbac-view	Visualize Kubernetes RBAC rules Usage: $ kubectl rbac-view # serving RBAC View and http://localhost:8800
kubiscan	Scan for risky permissions and users in RBAC Can detect accounts which will expose the whole cluster if their identification (JWT token, certificate, etc.) is compromised by an attacker Usage: Run from MASTER node: docker run -it --rm -e CONF_PATH=~/.kube/config -v /:/tmp cyberark/kubiscan [CMD] Search for pods with privileged accounts: kubiscan -rp Show all risky subjects (users, service accounts, groups): kubiscan -rs Show all the rules a service account has: kubiscan -aars "SANAME" -ns "default" -k "ServiceAccount" List service account RoleBindings: kubiscan -aarbs "SANAME" -ns "default" -k "ServiceAccount"
rbac-lookup	Find Kubernetes roles and cluster roles bound to any user, service account, or group name Usage: rbac-lookup rob --output wide
kubectl-rolesum	Summarize RBAC roles for the specified subject (ServiceAccount, User and Group) Usage: kubectl rolesum -k Group developer
kubernetes-rbac-audit	Scans the Kubernetes RBAC for risky roles Usage: python ExtensiveRoleCheck.py --clusterRole clusterroles.json --role Roles.json --rolebindings rolebindings.json --cluseterolebindings clusterrolebindings.json
krane	RBAC static Analysis & visualisation tool Usage: krane report -k <context>
sa-hunter	Correlates serviceaccounts, pods and nodes to the permissions granted to them via rolebindings and clusterrolesbindings