5 Kubernetes Tools To Secure The Container Stack

Kubernetes (K8s) is an extensible open source system for automating deployment, scaling, and management of containerised applications. It groups the containers which make up an application into logical units for easy management and discovery. It has several features such as automatic bin packing, service discovery and load balancing, storage orchestration, automated rollouts, and rollbacks, etc.

Along with the application deployment processes, Kubernetes impacts various runtime security functions such as authorisation, authentication, resource isolation, network segmentation, etc.  making the system more vulnerable to attacks, breaches, etc. In this article, we list down five Kubernetes tools to keep your deployment more secured.

(The list is in no particular order)

1| NeuVector

NeuVector is the container network security which delivers highly integrated, automated security for Kubernetes and OpenShift. It delivers a complete run-time security solution with container process/file system protection and vulnerability scanning combined with the only true layer 7 container firewall. It is the only next-generation container firewall with packet-level interrogation and enforcement which protects sensitive data with a complete container security platform. Some of the features of NeuVector are mentioned below:

• Prevents exploits and breakouts by detecting suspicious process, syscalls, etc.
• Prevent attacks with unique cloud-native automated segmentation and attack detection for DDoS, DNS, SQL injection, etc.
• Enables admission controls and CIS benchmarks for additional protections.
• Automatically discovers all containers and maps their behaviour.
• Supports and integrates with all the Kubernetes-based management platforms, such as Red Hat OpenShift, Docker EE, Rancher, Microsoft AKS, AWS EKS, etc.  

Click here to know more.

2| Twistlock

https://www.youtube.com/watch?v=KunpU9urBaA (Will embed this video)

Twistlock is the the leading full stack, full-lifecycle container security solution for securing container environments and applications which run in them by ensuring that you can easily deploy containers fearlessly at scale. Some of the features of Twistlock are mentioned below  

• It automatically scans images at the build, registry or running hosts with vulnerability information directly from 30+ upstream projects, commercial sources and proprietary research from Twistlock labs.
• It implements over 200 built-in checks for the Docker and Kubernetes CIS benchmarks as well as fully integrated into the build and deploy pipeline.
• Manages and prevent  vulnerabilities from development to production.
• Protects the running applications with layer 3 and layer 7 native firewalls, powerful runtime and access control.

Click here to learn more.

3| Kops

Kops or Kubernetes-ops is an open source solution for deploying Kubernetes clusters from the command line. It was designed to make installation of secure, highly available clusters easy and automatable on Amazon Web Service (AWS). It helps you to create, destroy, upgrade and maintain production grade, highly available Kubernetes clusters on a cloud provider. This open source solution currently focuses on full-cycle provisioning from networking and security on the instances which will make up your cluster.  

Click here to learn more.

4| Sysdig Falco

Sysdig is the first unified cloud-native visibility and security platform which accelerates your transition to containers in your ongoing operations in order to have a more effective way to deliver reliable and secured microservices. Sysdig Falco is an open source container security monitor designed to detect anomalies activities in your containers. It basically taps into your host’s system calls to generate an event stream of all system activity. Falcos provides rules for common antipatterns such as

• Spawning a shell in a container
• Configure files being written in /etc
• Binaries changing
• Package management running

Click here to know more.

5| Calico

Project Calico is an open source container networking provider and network policy engine. It enables networking and network policy in Kubernetes clusters across the cloud and uses a pure IP networking fabric to provide high performance networking and its battle-tested policy engine enforces high-level, intent-focused network policy.   

Calico can run on any Kubernetes cluster which meets the following criteria as mentioned below:

• The kubelet must be configured to use CNI network plugins (e.g –network-plugin=cni).
• The kube-proxy must be started in iptables proxy mode. This is the default as of Kubernetes v1.2.0.
• The kube-proxy must be started without the –masquerade-all flag, which conflicts with Calico policy.
• The Kubernetes NetworkPolicy API requires at least Kubernetes version v1.3.0.

Click here to know more.