diff --git a/README.md b/README.md index 6bcc3cb6..8d6328cb 100644 --- a/README.md +++ b/README.md @@ -87,13 +87,13 @@ Set-ExecutionPolicy RemoteSigned -scope CurrentUser ### Examples -* Scan a running Kubernetes cluster with [`nsa`](https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/) framework and submit results to [ARMO portal](https://portal.armo.cloud/) +* Scan a running Kubernetes cluster with [`nsa`](https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/) framework and submit results to the [Kubescape SaaS version](https://portal.armo.cloud/) ``` kubescape scan framework nsa --submit ``` -* Scan a running Kubernetes cluster with [`MITRE ATT&CK®`](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/) framework and submit results to [ARMO portal](https://portal.armo.cloud/) +* Scan a running Kubernetes cluster with [`MITRE ATT&CK®`](https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/) framework and submit results to the [Kubescape SaaS version](https://portal.armo.cloud/) ``` kubescape scan framework mitre --submit ``` @@ -130,6 +130,10 @@ kubescape scan framework nsa --exclude-namespaces kube-system,kube-public --form kubescape scan framework nsa --exceptions examples/exceptions.json ``` +### CronJob Scan Periodically + +For setting up a cronJob please follow the [instructions](examples/cronJob-support/README.md) + ### Helm Support * Render the helm chart using [`helm template`](https://helm.sh/docs/helm/helm_template/) and pass to stdout diff --git a/examples/cronJob-support/README.md b/examples/cronJob-support/README.md new file mode 100644 index 00000000..064be710 --- /dev/null +++ b/examples/cronJob-support/README.md @@ -0,0 +1,85 @@ +# Periodically Kubescape Scanning + +You can scan your cluster periodically by adding a `CronJob` that will repeatedly trigger kubescape + +* Setup [scanning & submitting](#scanning-and-submitting) +* Setup [scanning without submitting](#scanning-without-submitting) + +## Scanning And Submitting + +If you wish to periodically scan and submit the result to the [Kubescape SaaS version](https://portal.armo.cloud/) where you can benefit the features the SaaS version provides, please follow this instructions -> + +1. Apply kubescape namespace + ``` + kubectl apply ks-namespace.yaml + ``` + +2. Apply serviceAccount and roles + ``` + kubectl apply ks-serviceAccount.yaml + ``` + +3. Setup and apply configMap + + Before you apply the configMap you need to set the account ID and cluster name in the `ks-configMap.yaml` file. + + * Set cluster name: + Run `kubectl config current-context` and set the result in the `data.clusterName` field + * Set account ID: + 1. Navigate to the [Kubescape SaaS version](https://portal.armo.cloud/) and login/sign up for free + 2. Click the `Add Cluster` button on the top right of the page +
+ add-cluster + 3. Copy the value of `--account` and set it in the `data.customerGUID` field +
+ account + + Make sure the configMap looks as following; + ``` + kind: ConfigMap + apiVersion: v1 + metadata: + name: kubescape + labels: + app: kubescape + namespace: kubescape + data: + config.json: | + { + "customerGUID": "XXXXXXXX-XXXX-XXXX-XXXXXXXXXXXX", + "clusterName": "my-awesome-cluster-name" + } + ``` + + Finally, apply the configMap + ``` + kubectl apply ks-configMap.yaml + ``` + +4. Apply CronJob + + Before you apply the cronJob, make sure the scanning frequency suites your needs + ``` + kubectl apply ks-cronJob-submit.yaml + ``` + +## Scanning Without Submitting + +If you wish to periodically scan but not submit the scan results, follow this instructions -> + +1. Apply kubescape namespace + ``` + kubectl apply ks-namespace.yaml + ``` + +2. Apply serviceAccount and roles + ``` + kubectl apply ks-serviceAccount.yaml + ``` + +3. Apply CronJob + + Before you apply the cronJob, make sure the scanning frequency suites your needs + ``` + kubectl apply ks-cronJob-non-submit.yaml + ``` \ No newline at end of file diff --git a/examples/cronJob-support/ks-configMap.yaml b/examples/cronJob-support/ks-configMap.yaml new file mode 100644 index 00000000..59aaf979 --- /dev/null +++ b/examples/cronJob-support/ks-configMap.yaml @@ -0,0 +1,14 @@ +# ------------------- Kubescape User/Customer ID ------------------- # +kind: ConfigMap +apiVersion: v1 +metadata: + name: kubescape + labels: + app: kubescape + namespace: kubescape +data: + config.json: | + { + "customerGUID": "", + "clusterName": "" + } \ No newline at end of file diff --git a/examples/cronJob-support/ks-cronJob-non-submit.yaml b/examples/cronJob-support/ks-cronJob-non-submit.yaml new file mode 100644 index 00000000..ec7f1ab1 --- /dev/null +++ b/examples/cronJob-support/ks-cronJob-non-submit.yaml @@ -0,0 +1,32 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: kubescape + labels: + app: kubescape + namespace: kubescape +spec: + # ┌────────────────── timezone (optional) + # | ┌───────────── minute (0 - 59) + # | │ ┌───────────── hour (0 - 23) + # | │ │ ┌───────────── day of the month (1 - 31) + # | │ │ │ ┌───────────── month (1 - 12) + # | │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday; + # | │ │ │ │ │ 7 is also Sunday on some systems) + # | │ │ │ │ │ + # | │ │ │ │ │ + # CRON_TZ=UTC * * * * * + schedule: "0 0 1 * *" + jobTemplate: + spec: + template: + spec: + containers: + - name: kubescape + image: quay.io/armosec/kubescape:latest + imagePullPolicy: IfNotPresent + command: ["/bin/sh","-c"] + args: + - kubescape scan framework nsa + restartPolicy: OnFailure + serviceAccountName: kubescape-discovery diff --git a/examples/cronJob-support/ks-cronJob-submit.yaml b/examples/cronJob-support/ks-cronJob-submit.yaml new file mode 100644 index 00000000..3969d653 --- /dev/null +++ b/examples/cronJob-support/ks-cronJob-submit.yaml @@ -0,0 +1,40 @@ +apiVersion: batch/v1 +kind: CronJob +metadata: + name: kubescape + labels: + app: kubescape + namespace: kubescape +spec: + # ┌────────────────── timezone (optional) + # | ┌───────────── minute (0 - 59) + # | │ ┌───────────── hour (0 - 23) + # | │ │ ┌───────────── day of the month (1 - 31) + # | │ │ │ ┌───────────── month (1 - 12) + # | │ │ │ │ ┌───────────── day of the week (0 - 6) (Sunday to Saturday; + # | │ │ │ │ │ 7 is also Sunday on some systems) + # | │ │ │ │ │ + # | │ │ │ │ │ + # CRON_TZ=UTC * * * * * + schedule: "0 0 1 * *" + jobTemplate: + spec: + template: + spec: + containers: + - name: kubescape + image: quay.io/armosec/kubescape:latest + imagePullPolicy: IfNotPresent + command: ["/bin/sh","-c"] + args: + - kubescape scan framework nsa --submit + volumeMounts: + - name: kubescape-config-volume + mountPath: /root/.kubescape/config.json + subPath: config.json + restartPolicy: OnFailure + serviceAccountName: kubescape-discovery + volumes: + - name: kubescape-config-volume + configMap: + name: kubescape diff --git a/examples/cronJob-support/ks-namespace.yaml b/examples/cronJob-support/ks-namespace.yaml new file mode 100644 index 00000000..54de4704 --- /dev/null +++ b/examples/cronJob-support/ks-namespace.yaml @@ -0,0 +1,7 @@ +# ------------------- Kubescape User/Customer ID ------------------- # +kind: Namespace +apiVersion: v1 +metadata: + name: kubescape + labels: + app: kubescape diff --git a/examples/cronJob-support/ks-serviceAccount.yaml b/examples/cronJob-support/ks-serviceAccount.yaml new file mode 100644 index 00000000..ace8a33a --- /dev/null +++ b/examples/cronJob-support/ks-serviceAccount.yaml @@ -0,0 +1,61 @@ +--- +# ------------------- Kubescape Service Account ------------------- # +apiVersion: v1 +kind: ServiceAccount +metadata: + labels: + app: kubescape + name: kubescape-discovery + namespace: kubescape + +--- +# ------------------- Kubescape Role & Role Binding ------------------- # +kind: Role +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: kubescape-discovery-role + namespace: kubescape +rules: +- apiGroups: ["*"] + resources: ["*"] + verbs: ["get", "list", "describe"] + +--- +apiVersion: rbac.authorization.k8s.io/v1 +kind: RoleBinding +metadata: + name: kubescape-discovery-binding + namespace: kubescape +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: Role + name: kubescape-discovery-role +subjects: +- kind: ServiceAccount + name: kubescape-discovery + +--- +# ------------------- Kubescape Cluster Role & Cluster Role Binding ------------------- # +kind: ClusterRole +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: kubescape-discovery-clusterroles + # "namespace" omitted since ClusterRoles are not namespaced +rules: +- apiGroups: ["*"] + resources: ["*"] + verbs: ["get", "list", "describe"] + +--- +kind: ClusterRoleBinding +apiVersion: rbac.authorization.k8s.io/v1 +metadata: + name: kubescape-discovery-role-binding +roleRef: + apiGroup: rbac.authorization.k8s.io + kind: ClusterRole + name: kubescape-discovery-clusterroles +subjects: +- kind: ServiceAccount + name: kubescape-discovery + namespace: kubescape \ No newline at end of file diff --git a/examples/cronJob-support/screenshots/account.png b/examples/cronJob-support/screenshots/account.png new file mode 100644 index 00000000..edeebf87 Binary files /dev/null and b/examples/cronJob-support/screenshots/account.png differ diff --git a/examples/cronJob-support/screenshots/add-cluster.png b/examples/cronJob-support/screenshots/add-cluster.png new file mode 100644 index 00000000..05eb64a6 Binary files /dev/null and b/examples/cronJob-support/screenshots/add-cluster.png differ diff --git a/examples/cronjob/ks-cronjob.yaml b/examples/cronjob/ks-cronjob.yaml index b00b2aff..4dfc503f 100644 --- a/examples/cronjob/ks-cronjob.yaml +++ b/examples/cronjob/ks-cronjob.yaml @@ -1,3 +1,10 @@ +# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! +# +# This file is DEPRECATE, please navigate to the official docs -> +# https://github.com/armosec/kubescape/tree/master/examples/cronJob-support/README.md +# +# !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! + --- # ------------------- Kubescape Service Account ------------------- # apiVersion: v1