From f57305280f09b17ec5b8eaa736c8251aec40c634 Mon Sep 17 00:00:00 2001 From: Oshrat Nir Date: Mon, 2 Dec 2024 16:27:46 +0200 Subject: [PATCH 1/2] Update of README Signed-off-by: Oshrat Nir --- README.md | 27 +++++++++++++++------------ 1 file changed, 15 insertions(+), 12 deletions(-) diff --git a/README.md b/README.md index d3824eda..14c0713c 100644 --- a/README.md +++ b/README.md @@ -14,11 +14,11 @@ Kubescape logo -_An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters_ +_Comprehensive Kubernetes Security from Development to Runtime_ -Kubescape is an open-source Kubernetes security platform. It includes risk analysis, security compliance, and misconfiguration scanning. Targeted at the DevSecOps practitioner or platform engineer, it offers an easy-to-use CLI interface, flexible output formats, and automated scanning capabilities. It saves Kubernetes users and admins precious time, effort, and resources. +Kubescape is an open-source Kubernetes security platform that provides comprehensive security coverage, from left to right across the entire development and deployment lifecycle. It offers hardening, posture management, and runtime security capabilities to ensure robust protection for Kubernetes environments. It saves Kubernetes users and admins precious time, effort, and resources. -Kubescape scans clusters, YAML files, and Helm charts. It detects misconfigurations according to multiple frameworks (including [NSA-CISA](https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo/?utm_source=github&utm_medium=repository), [MITRE ATT&CK®](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/) and the [CIS Benchmark](https://www.armosec.io/blog/cis-kubernetes-benchmark-framework-scanning-tools-comparison/?utm_source=github&utm_medium=repository)). +Kubescape scans clusters, YAML files, and Helm charts. It detects misconfigurations according to multiple frameworks (including [NSA-CISA](https://www.armosec.io/blog/kubernetes-hardening-guidance-summary-by-armo/?utm_source=github&utm_medium=repository), [MITRE ATT&CK®](https://www.armosec.io/glossary/mitre-attck-framework/?utm_source=github&utm_medium=repository) and the [CIS Benchmark](https://www.armosec.io/blog/cis-kubernetes-benchmark-framework-scanning-tools-comparison/?utm_source=github&utm_medium=repository)). Kubescape was created by [ARMO](https://www.armosec.io/?utm_source=github&utm_medium=repository) and is a [Cloud Native Computing Foundation (CNCF) sandbox project](https://www.cncf.io/sandbox-projects/). @@ -52,6 +52,9 @@ _Did you know you can use Kubescape in all these places?_ ## Under the hood Kubescape uses [Open Policy Agent](https://github.com/open-policy-agent/opa) to verify Kubernetes objects against [a library of posture controls](https://github.com/kubescape/regolibrary). +For image scanning, it uses [Grype](https://github.com/anchore/grype). +For image patching, it uses [Copacetic](https://github.com/project-copacetic/copacetic). +For eBPF, it uses [Inspektor Gadget](https://github.com/inspektor-gadget) By default, the results are printed in a console-friendly manner, but they can be: @@ -63,19 +66,19 @@ It retrieves Kubernetes objects from the API server and runs a set of [Rego snip ## Community -Kubescape is an open source project, we welcome your feedback and ideas for improvement. We are part of the Kubernetes community and are building more tests and controls as the ecosystem develops. +Kubescape is an open source project. We welcome your feedback and ideas for improvement. We are part of the CNCF community and are evolving Kubescape in sync with the security needs of Kubernetes users. To learn more about where Kubescape is heading, please check out our [ROADMAP](https://github.com/kubescape/project-governance/blob/main/ROADMAP.md). -We hold [community meetings](https://zoom.us/j/95174063585) on Zoom, on the first Tuesday of every month, at 14:00 GMT. ([See that in your local time zone](https://time.is/compare/1400_in_GMT)). +If you feel inspired to contribute to Kubescape, check out our [CONTRIBUTING](https://github.com/kubescape/project-governance/blob/main/CONTRIBUTING.md) file to learn how. You can find the issues we are working on (triage to development) on the [Kubescaping board](https://github.com/orgs/kubescape/projects/4/views/1) + +* Feel free to pick a task from the [board](https://github.com/orgs/kubescape/projects/4) or suggest a feature of your own. +* Open an issue on the board. We aim to respond to all issues within 48 hours. +* [Join the CNCF Slack](https://slack.cncf.io/) and then our [users](https://cloud-native.slack.com/archives/C04EY3ZF9GE) or [developers](https://cloud-native.slack.com/archives/C04GY6H082K) channel. The Kubescape project follows the [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md). -## Contributions +For more information about the Kubescape community, please visit [COMMUNITY](https://github.com/kubescape/project-governance/blob/main/COMMUNITY.md). -Thanks to all our contributors! Check out our [CONTRIBUTING](CONTRIBUTING.md) file to learn how to join them. - -* Feel free to pick a task from the [issues](https://github.com/kubescape/kubescape/issues?q=is%3Aissue+is%3Aopen+label%3A%22open+for+contribution%22), [roadmap](docs/roadmap.md) or suggest a feature of your own. -* [Open an issue](https://github.com/kubescape/kubescape/issues/new/choose): we aim to respond to all issues within 48 hours. -* [Join the CNCF Slack](https://slack.cncf.io/) and then our [users](https://cloud-native.slack.com/archives/C04EY3ZF9GE) or [developers](https://cloud-native.slack.com/archives/C04GY6H082K) channel. +We would like to take this opportunity to thank all our contibutors to date.
@@ -85,7 +88,7 @@ Thanks to all our contributors! Check out our [CONTRIBUTING](CONTRIBUTING.md) f ## License -Copyright 2021-2023, the Kubescape Authors. All rights reserved. Kubescape is released under the Apache 2.0 license. See the [LICENSE](LICENSE) file for details. +Copyright 2021-2024, the Kubescape Authors. All rights reserved. Kubescape is released under the Apache 2.0 license. See the [LICENSE](LICENSE) file for details. Kubescape is a [Cloud Native Computing Foundation (CNCF) sandbox project](https://www.cncf.io/sandbox-projects/) and was contributed by [ARMO](https://www.armosec.io/?utm_source=github&utm_medium=repository). From 97f24920e8db26ed46be3c562efe643cac0f5a44 Mon Sep 17 00:00:00 2001 From: Oshrat Nir Date: Mon, 2 Dec 2024 16:44:58 +0200 Subject: [PATCH 2/2] conflict resolution Signed-off-by: Oshrat Nir --- README.md | 46 +++++++++++++++++++++++++++++++++++----------- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index 14c0713c..c0816d0a 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,13 @@ [![Gitpod Ready-to-Code](https://img.shields.io/badge/Gitpod-Ready--to--Code-blue?logo=gitpod)](https://gitpod.io/#https://github.com/kubescape/kubescape) [![GitHub](https://img.shields.io/github/license/kubescape/kubescape)](https://github.com/kubescape/kubescape/blob/master/LICENSE) [![CNCF](https://shields.io/badge/CNCF-Sandbox%20project-blue?logo=linux-foundation&style=flat)](https://landscape.cncf.io/card-mode?project=sandbox&selected=kubescape) +[![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/kubescape)](https://artifacthub.io/packages/search?repo=kubescape) +[![FOSSA Status](https://app.fossa.com/api/projects/git%2Bgithub.com%2Fkubescape%2Fkubescape.svg?type=shield&issueType=license)](https://app.fossa.com/projects/git%2Bgithub.com%2Fkubescape%2Fkubescape?ref=badge_shield&issueType=license) +[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/6944/badge)](https://www.bestpractices.dev/projects/6944) +[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/kubescape/kubescape/badge)](https://securityscorecards.dev/viewer/?uri=github.com/kubescape/kubescape) +[![Stars](https://img.shields.io/github/stars/kubescape/kubescape?style=social)](https://github.com/kubescape/kubescape/stargazers) [![Twitter Follow](https://img.shields.io/twitter/follow/kubescape?style=social)](https://twitter.com/kubescape) +[![Slack](https://img.shields.io/badge/slack-kubescape-blueviolet?logo=slack)](https://cloud-native.slack.com/archives/C04EY3ZF9GE) # Kubescape @@ -22,11 +28,14 @@ Kubescape scans clusters, YAML files, and Helm charts. It detects misconfigurati Kubescape was created by [ARMO](https://www.armosec.io/?utm_source=github&utm_medium=repository) and is a [Cloud Native Computing Foundation (CNCF) sandbox project](https://www.cncf.io/sandbox-projects/). -## Demo - - _Please [star ⭐](https://github.com/kubescape/kubescape/stargazers) the repo if you want us to continue developing and improving Kubescape! 😀_ +## Demo + +Kubescape has a command line tool that you can use to quickly get a report on the security posture of a Kubernetes cluster: + + + ## Getting started Experimenting with Kubescape is as easy as: @@ -35,13 +44,13 @@ Experimenting with Kubescape is as easy as: curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash ``` +This script will automatically download the latest Kubescape CLI release and scan the Kubernetes cluster in your current kubectl context. + Learn more about: -* [Installing Kubescape](docs/installation.md) -* [Running your first scan](docs/getting-started.md#run-your-first-scan) -* [Usage](docs/getting-started.md#examples) -* [Architecture](docs/architecture.md) -* [Building Kubescape from source](https://github.com/kubescape/kubescape/wiki/Building) +* [Installing the Kubescape CLI](https://kubescape.io/docs/install-cli/) +* [Running your first scan](https://kubescape.io/docs/scanning/) +* [Accepting risk with exceptions](https://kubescape.io/docs/accepting-risk/) _Did you know you can use Kubescape in all these places?_ @@ -49,6 +58,14 @@ _Did you know you can use Kubescape in all these places?_ Places you can use Kubescape: in your IDE, CI, CD, or against a running cluster. +### Continuous security monitoring with the Kubescape Operator + +As well as a CLI, Kubescape provides an in-cluster mode, which is installed via a Helm chart. Kubescape in-cluster provides extensive features such as continuous scanning, image vulnerability scanning, runtime analysis, network policy generation, and more. [Learn more about the Kubescape operator](https://kubescape.io/docs/operator/). + +### Using Kubescape as a GitHub Action + +Kubescape can be used as a GitHub Action. This is a great way to integrate Kubescape into your CI/CD pipeline. You can find the Kubescape GitHub Action in the [GitHub Action marketplace](https://github.com/marketplace/actions/kubescape). + ## Under the hood Kubescape uses [Open Policy Agent](https://github.com/open-policy-agent/opa) to verify Kubernetes objects against [a library of posture controls](https://github.com/kubescape/regolibrary). @@ -56,13 +73,15 @@ For image scanning, it uses [Grype](https://github.com/anchore/grype). For image patching, it uses [Copacetic](https://github.com/project-copacetic/copacetic). For eBPF, it uses [Inspektor Gadget](https://github.com/inspektor-gadget) -By default, the results are printed in a console-friendly manner, but they can be: +By default, CLI scan results are printed in a console-friendly manner, but they can be: -* exported to JSON or junit XML +* exported to JSON, junit XML or SARIF * rendered to HTML or PDF * submitted to a [cloud service](docs/providers.md) -It retrieves Kubernetes objects from the API server and runs a set of [Rego snippets](https://www.openpolicyagent.org/docs/latest/policy-language/) developed by [ARMO](https://www.armosec.io?utm_source=github&utm_medium=repository). +### In-cluster architecture + +![Architecture diagram](docs/img/architecture-diagram.png) ## Community @@ -86,8 +105,13 @@ We would like to take this opportunity to thank all our contibutors to date. +## Changelog + +Kubescape changes are tracked on the [release](https://github.com/kubescape/kubescape/releases) page. + ## License +Copyright 2021-2024, the Kubescape Authors. All rights reserved. Kubescape is released under the Apache 2.0 license. See the [LICENSE](LICENSE) file for details. Copyright 2021-2024, the Kubescape Authors. All rights reserved. Kubescape is released under the Apache 2.0 license. See the [LICENSE](LICENSE) file for details. Kubescape is a [Cloud Native Computing Foundation (CNCF) sandbox project](https://www.cncf.io/sandbox-projects/) and was contributed by [ARMO](https://www.armosec.io/?utm_source=github&utm_medium=repository).