mirror of
https://github.com/nubenetes/awesome-kubernetes.git
synced 2026-03-06 03:30:44 +00:00
21 KiB
21 KiB
Security and DevSecOps. Container Security
- Introduction
- Kubernetes Threat Modelling
- Kubernetes Config Security Threats
- Security Linting on Kubernetes
- Multi-Level Security (MLS) vs Multi-Category Security (MCS). Make Secure Pipelines with Podman and Containers
- Project Calico
- Security Patterns for Microservice Architectures
- Anchore Container Security Solutions for DevSecOps
- Twistlock and Threat Stack Container Security
- StackRox
- GitHub security
- Databases in DMZ and Intranet
- Removing Credentials From Git Repo
- Pentesting
- SQL Injection
- Credential Managers
- GitOps Secret Management
- Serverless Security Best Practices
- Docker Images & Container Security
- Pod Security Policies
- Kubernetes Network Policies
- Static Analysis SAST
- Kubernetes Security Tools
- Helm Charts Security
- Password Recovery
- Books
- CVEs
Introduction
- fiercesw.com: DevOps vs DevSecOps
- devopszone.info: DevSecOps Explained
- linkedin: Dear Google, my data has left your building!
- snyk.io: The State of Open Source Security 2020
- managedsentinel.com: Executive View — Current and Future Cybersecurity Architecture On One Page
- Exploring the (lack of) security in a typical Docker and Kubernetes installation
- kalilinuxtutorials.com: Deploying & Securing Kubernetes Clusters
- loves.cloud: Creating a fully automated DevSecOps CI/CD Pipeline
- redhat.com: Balancing Linux security with usability Your system should be secure, but open enough to serve its function. Here are some tips on how to strike that balance.
- thenewstack.io: Culture, Vulnerabilities and Budget: Why Devs and AppSec Disagree
- computing.co.uk: CloudBees gets busy with security, visibility and control as DevOps evolves CEO Sacha Labourey: 'DevOps is a pretty good proxy for what needs to happen in any organisation'
- paloaltonetworks.com: Is Your Organization Protected Against IAM Misconfiguration Risks?
- devops.com: How to Successfully Integrate Security and DevOps
- helpnetsecurity.com: How to make DevSecOps stick with developers
- blog.christophetd.fr: Shifting Cloud Security Left — Scanning Infrastructure as Code for Security Issues
- devclass.com: Docker: It’s not dead yet, but there’s a tendency to walk away, security report finds
- roxsrossve.medium.com: El camino hacia DevSecOps
- securityboulevard.com: DevOps vs. DevSecOps – Here’s How They Fit Together
- opensource.com: How to adopt DevSecOps successfully Integrating security throughout the software development lifecycle is important, but it's not always easy.
- devops.com: DevSecOps Trends to Know For 2021
- devops.com: From Agile to DevOps to DevSecOps: The Next Evolution
- permission.site How much stuff one can do from a web browser these days—scary stuff. Stay safe. Disable JS and most of stuff won't work at all.
- ais.com: Leaping into DevSecOps from DevOps
- infoq.com: The Defense Department's Journey with DevSecOps
- amazon.com: Building end-to-end AWS DevSecOps CI/CD pipeline with open source SCA, SAST and DAST tools
- infoq.com: 9 Trends That Are Influencing the Adoption of Devops and Devsecops in 2021
- addteq.com: The REAL Difference between DevOps and DevSecOps
Kubernetes Threat Modelling
Kubernetes Config Security Threats
- cncf.io: Identifying Kubernetes Config Security Threats: Pods Running as Root
- mirantis.com: Introduction to Istio Ingress: The easy way to manage incoming Kubernetes app traffic Leaving your cluster exposed can be risky. That's why you need Istio Ingress, which only exposes the part that handles incoming traffic & allows routing rules based on routes, headers, IP addresses and more.
- thenewstack.io: How Kubernetes vulnerabilities have shifted since the first attacks
Security Linting on Kubernetes
- kubeLinter 🌟 KubeLinter is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best practices.
- thenewstack.io: StackRox KubeLinter Brings Security Linting to Kubernetes
Multi-Level Security (MLS) vs Multi-Category Security (MCS). Make Secure Pipelines with Podman and Containers
- Why you should be using Multi-Category Security (MCS) for your Linux containers
- Using Podman and Containers to make a more secure pipeline
Project Calico
- Project Calico Secure networking for the cloud native era
- thenewstack.io: Project Calico: Kubernetes Security as SaaS
Security Patterns for Microservice Architectures
Anchore Container Security Solutions for DevSecOps
- Anchore Container image inspection and policy-based compliance
Twistlock and Threat Stack Container Security
- Twistlock
- Threat Stack
- dzone: A Twistlock and Threat Stack Comparison Compare two of the most popular tools available for container security, and how their different approaches breed different solutions.
StackRox
Secure Container Based CI/CD Workflows
Securing Kubernetes With Anchore
GitHub security
Databases in DMZ and Intranet
Removing Credentials From Git Repo
Pentesting
- forbes.com: DevOps Drives Pentesting Delivered As A Service
- emagined.com: How to conduct a penetration test
- securityboulevard.com: Kubernetes Pentest Methodology Part 3
SQL Injection
Credential Managers
keycloak
- keycloak.org Open Source Identity and Access Management For Modern Applications and Services
- Securing Kubernetes Apps with Keycloak and Gatekeeper
- Authorizing multi-language microservices with Louketo Proxy
- developers.redhat.com: A deep dive into Keycloak
- blog.getambassador.io: Step-by-Step Centralized Authentication for Kubernetes with Keycloak and the Ambassador Edge Stack
- blog.sighup.io: How to run Keycloak in HA on Kubernetes How to setup Keycloak, the Open Source Identity and Access Management, in HA on Kubernetes.
- developers.redhat.com: Authentication and authorization using the Keycloak REST API
- faun.pub: Integrate Keycloak with HashiCorp Vault A How-To guide using Terraform
Git Credential Manager Core
- Git Credential Manager Core GCM Core is a free, open-source, cross-platform credential manager for Git.
- Git Credential Manager Core: Building a universal authentication experience
GitOps Secret Management
HashiCorp Vault
- vaultproject.io Manage Secrets and Protect Sensitive Data. Secure, store and tightly control access to tokens, passwords, certificates, encryption keys for protecting secrets and other sensitive data using a UI, CLI, or HTTP API.
- medium: Coding for Secrets Reliability with HashiCorp Vault
- hashicorp.com: Vault & Kubernetes: Better Together
- OpenShift Blogs:
- https://www.openshift.com/blog/managing-secrets-openshift-vault-integration
- https://www.openshift.com/blog/vault-integration-using-kubernetes-authentication-method
- https://www.openshift.com/blog/integrating-vault-with-legacy-applications
- https://www.openshift.com/blog/integrating-hashicorp-vault-in-openshift-4
- Vault Learning Resources: Vault 1.5 features and more
- medium: Securing K8s Ingress Traffic with HashiCorp Vault PKIaaS and JetStack Cert-Manager
- hashicorp.com: Automate Secret Injection into CI/CD Workflows with the GitHub Action for Vault
- hashicorp.com: Use AWS Lambda Extensions to Securely Retrieve Secrets From HashiCorp Vault Developers no longer have to make their Lambda functions Vault-aware.
- github.com/kelseyhightower: Serverless Vault with Cloud Run This tutorial walks you through deploying Hashicorp's Vault on Cloud Run, Google Cloud's container based Serverless compute platform.
- confluent.io: How to Manage Secrets for Confluent with Kubernetes and HashiCorp Vault
- digitalvarys.com: Simple Introduction to HashiCorp Vault
- hashicorp.com: HCP Vault is now generally available on AWS 🌟
- hashicorp.com: Serverless Secrets with HashiCorp Vault Learn how to securely store and retrieve credentials across providers for applications running within AWS Lambda, Azure Functions, and Google Cloud Functions.
CyberArk and Ansible
- ansible.com: Simplifying secrets management with CyberArk and Red Hat Ansible Automation Platform
- ansible.com: Automating Security with CyberArk and Red Hat Ansible Automation Platform
CyberArk Conjur
SOPS for Kubernetes
Alternatives
- GitOps secret management with bitnami-labs Sealed Secret and GoDaddy Kubernetes External Secrets 🌟
- aws.amazon.com: Managing secrets deployment in Kubernetes using Sealed Secrets 🌟
- dzone: Managing Secrets Deployment in GitOps Workflow 🌟 The importance of keeping your secrets safe.
Serverless Security Best Practices
Docker Images & Container Security
- thehackernews.com: Docker Images Containing Cryptojacking Malware Distributed via Docker Hub
- sysdig.com: 12 Container image scanning best practices to adopt in production
- infracloud.io: The Ten Commandments of Container Security
- medium: KubeSecOps Pipeline(Container security) in a cloudnative ecosystem
- sysdig.com: Sysdig 2021 container security and usage report: Shifting left is not enough 🌟
- itnext.io: Hardening Docker and Kubernetes with seccomp 🌟
- redhat.com: Improving Linux container security with seccomp 🌟 Try this method of using an OCI runtime hook for tracing syscalls before you build a container.
- openshift.com: Signing and Verifying Container Images 🌟
- redhat.com: Introducing Red Hat Vulnerability Scanner Certification
- docs.microsoft.com: Introduction to Azure Defender for container registries Defender for Container Registries Continuous Image Scan for vulnerabilities is now available for General Availability (GA)
Pod Security Policies
- octetz.com: Setting Up Pod Security Policies By default, Kubernetes allows anything capable of creating a Pod to run a fairly privileged container that can compromise a system. Pod Security Policies protect clusters from privileged pods by ensuring the requester is authorised.
- infracloud.io: Kubernetes Pod Security Policies with Open Policy Agent In this blog post, you will learn about the Pod Security Policy admission controller. Then you will see how Open Policy Agent can implement Pod Security Policies.
Kubernetes Network Policies
- medium.com: K8s Network Policies Demystified and Simplified 🌟
- blog.nody.cc: Verify your Kubernetes Cluster Network Policies: From Faith to Proof
Static Analysis SAST
Kubernetes Security Tools
- europeclouds.com: Implementing Aqua Security to Secure Kubernetes
- Pomerium is an identity-aware proxy that enables secure access to internal applications. Pomerium brings consistent authz/authn, tooling, and auditing across cloud and on-premise deployments. No VPN or cloud provider account is required
Helm Charts Security
- medium: Who’s at the Helm? Or, how to deploy 25+ CVEs to prod in one command!