Kuberneter¶
From version 1.6, KICS calls the Kubernetes API to scan resources deployed in the runtime K8s cluster. The runtime information of the resources is obtained by providing the K8s credentials as environment variables and a kuberneter path to KICS, via -p
flag. The scan happens immediately after this information is obtained. In the end, results are shown as for any other KICS scan.
Configure K8s Credentials¶
For KICS to get the runtime information of your resources, you need to provide your K8s Credentials as environment variables.
Using Config File¶
MacOS and Linux:
Windows:
Powershell:
Using Service Account Token¶
Note that your Service Account Token should have list permissions for the chosen resources. Additionally to that, note that K8S_CA_DATA
and K8S_SA_TOKEN_DATA
should be base64 encoded.
MacOS and Linux:
export K8S_HOST="<K8S_HOST>"
export K8S_CA_FILE="<K8S_CA_FILE>" or export K8S_CA_DATA="K8S_CA_DATA"
export K8S_SA_TOKEN_FILE="K8S_SA_TOKEN_FILE>" or export K8S_SA_TOKEN_DATA="K8S_SA_TOKEN_DATA"
Windows:
SET K8S_HOST=<K8S_HOST>
SET K8S_CA_FILE=<K8S_CA_FILE> or SET K8S_CA_DATA=<K8S_CA_DATA>
SET K8S_SA_TOKEN_FILE=<K8S_SA_TOKEN_FILE> or SET K8S_SA_TOKEN_DATA=<K8S_SA_TOKEN_DATA>
Powershell:
$Env:K8S_HOST="<K8S_HOST>"
$Env:K8S_CA_FILE="<K8S_CA_FILE>" or $Env:K8S_CA_DATA="<K8S_CA_DATA>"
$Env:K8S_CA_FILE="<K8S_SA_TOKEN_FILE>" or $Env:K8S_CA_DATA="<K8S_SA_TOKEN_DATA>"
Using Certificate¶
Note that your "certificate user" should have list permissions for the chosen resources. Additionally to that, note that K8S_CA_DATA
, K8S_CERT_DATA
, and K8S_KEY_DATA
should be base64 encoded.
MacOS and Linux:
export K8S_HOST="<K8S_HOST>"
export K8S_CA_FILE="<K8S_CA_FILE>" or export K8S_CA_DATA="K8S_CA_DATA"
export K8S_CERT_FILE="<K8S_CERT_FILE>" or export K8S_CERT_DATA="K8S_CERT_DATA"
export K8S_KEY_FILE="<K8S_KEY_FILE>" or export K8S_KEY_DATA="K8S_KEY_DATA"
Windows:
SET K8S_HOST=<K8S_HOST>
SET K8S_CA_FILE=<K8S_CA_FILE> or SET K8S_CA_DATA=<K8S_CA_DATA>
SET K8S_CERT_FILE=<K8S_CERT_FILE> or SET K8S_CERT_DATA=<K8S_CERT_DATA>
SET K8S_KEY_FILE=<K8S_KEY_FILE> or SET K8S_KEY_DATA=<K8S_KEY_DATA>
Powershell:
$Env:K8S_HOST="<K8S_HOST>"
$Env:K8S_CA_FILE="<K8S_CA_FILE>" or $Env:K8S_CA_DATA="<K8S_CA_DATA>"
$Env:K8S_CERT_FILE="<K8S_CERT_FILE>" or $Env:K8S_CERT_DATA="<K8S_CERT_DATA>"
$Env:K8S_KEY_FILE="<K8S_KEY_FILE>" or $Env:K8S_KEY_DATA="<K8S_KEY_DATA>"
KICS Kuberneter Path Syntax¶
To import all the namespaces, apiVersions, or kinds, please use: *
. For example, kuberneter::*:*:*
.
To specify the namespaces, apiVersions, or kinds, please use: separator +
. For example,kuberneter::*:apps/v1+v1:ServiceAccount
.
The API Versions and their respective kinds (both case sensitive) are listed below:
API Versions | Kinds |
---|---|
apps/v1 | DaemonSet Deployment ReplicaSet StatefulSet |
core/v1 | LimitRange Pod PersistentVolume PersistentVolumeClaim ReplicationController ResourceQuota Secret ServiceAccount Service |
batch/v1 | CronJob Job |
networking.k8s.io/v1 | IngressClass Ingress NetworkPolicy |
policy/v1 | PodDisruptionBudget |
rbac.authorization.k8s.io/v1 | ClusterRoleBinding ClusterRole RoleBinding Role |
apps/v1beta1 | Deployment StatefulSet |
apps/v1beta2 | DaemonSet Deployment ReplicaSet S tatefulSet |
batch/v1beta1 | CronJob |
networking.k8s.io/v1beta1 | IngressClass Ingress |
policy/v1beta1 | PodDisruptionBudget PodSecurityPolicy |
rbac.authorization.k8s.io/v1alpha1 | ClusterRoleBinding ClusterRole RoleBinding Role |
rbac.authorization.k8s.io/v1beta1 | ClusterRoleBinding ClusterRole RoleBinding Role |
Running KICS to scan runtime K8s cluster¶
When running KICS using a kuberneter path, the resources are imported using the credentials set as environment variables in Kubernetes format to the current working directory in a new folder named kics-extract-kuberneter
following the above-described structure.
KICS will then run a scan on these local files.
If the flag -o, --output-path
is passed, the folder kics-extract-kuberneter
will be generated in the reports directory instead.
Imported Resources tree structure:¶
Run KICS to scan runtime K8s cluster with Docker¶
To run KICS Kuberneter with Docker, you can simply pass the K8s Credentials that were set as environment variables to the docker run command and use the kuberneter path syntax
Examples:
Using Config File¶
docker run -v <credentials_path>:/credentials -v ${PWD}:/path/ -e K8S_CONFIG_FILE=/credentials/<config-file-name> checkmarx/kics:latest scan -p "kuberneter::*:*:*" -v --no-progress -o /path/results
Using Service Account Token¶
docker run -v ${PWD}:/path/ -e K8S_HOST -e K8S_CA_DATA -e K8S_SA_TOKEN_DATA kuberneter scan -p "kuberneter::*:*:*" -v --no-progress -o /path/results
Using Certificate¶
docker run -v ${PWD}:/path/ -e K8S_HOST -e K8S_CA_DATA -e K8S_SA_TOKEN_DATA kuberneter scan -p "kuberneter::*:*:*" -v --no-progress -o /path/results