当前位置：首页 > 软件库 > 云计算 > 云原生 >

kube-bench

授权协议 Apache-2.0 License

开发语言 Google Go

所属分类云计算、云原生

软件类型开源软件

地区不详

投递者松献

操作系统跨平台

开源组织无

适用人群未知

软件概览

kube-bench is a tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark.

Tests are configured with YAML files, making this tool easy to update as test specifications evolve.

Quick start

There are multiple ways to run kube-bench.You can run kube-bench inside a pod, but it will need access to the host's PID namespace in order to check the running processes, as well as access to some directories on the host where config files and other files are stored.

The supplied job.yaml file can be applied to run the tests as a job. For example:

$ kubectl apply -f job.yaml
job.batch/kube-bench created

$ kubectl get pods
NAME                      READY   STATUS              RESTARTS   AGE
kube-bench-j76s9   0/1     ContainerCreating   0          3s

# Wait for a few seconds for the job to complete
$ kubectl get pods
NAME                      READY   STATUS      RESTARTS   AGE
kube-bench-j76s9   0/1     Completed   0          11s

# The results are held in the pod's logs
kubectl logs kube-bench-j76s9
[INFO] 1 Master Node Security Configuration
[INFO] 1.1 API Server
...

For more information and different ways to run kube-bench see documentation

Please Note

kube-bench implements the CIS Kubernetes Benchmark as closely as possible. Please raise issues here if kube-bench is not correctly implementing the test as described in the Benchmark. To report issues in the Benchmark itself (for example, tests that you believe are inappropriate), please join the CIS community.
There is not a one-to-one mapping between releases of Kubernetes and releases of the CIS benchmark. See CIS Kubernetes Benchmark support to see which releases of Kubernetes are covered by different releases of the benchmark.

By default, kube-bench will determine the test set to run based on the Kubernetes version running on the machine.

see the following documentation on Running kube-bench for more details.

Contributing

Kindly read Contributing before contributing.We welcome PRs and issue reports.

Roadmap

Going forward we plan to release updates to kube-bench to add support for new releases of the CIS Benchmark. Note that these are not released as frequently as Kubernetes releases.

使用案例

K8s-集群的设置-使用kube-bench检测系统安全

CIS基准 Internet 安全中心是一个非盈利性实体，其任务是“确定、开发、验证、升级和维持针对网络防御的最佳做法解决方案”。它借鉴了来自世界各地政府、企业和学术界网络安全及 IT 专业人员的专业知识。为了制定标准和最佳做法（包括 CIS 基准、控制措施和强化映像），他们遵循一致的决策制定模型。官网 https://www.cisecurity.org/benchmark/kuber
kube-proxy 部署

kube-proxy还是由我们统一颁发一个证书。 1. 创建配置文件 cat > /opt/kubernetes/cfg/kube-proxy.conf << EOF KUBE_PROXY_OPTS="--logtostderr=false \\ --v=2 \\ --log-dir=/opt/kubernetes/logs \\ --config=/opt/kubernetes/cfg/kube
kubernete

说明这篇文章是 Kubernetes权威指南：从Docker到Kubernetes实践全接触（第2版）一书的学习笔记。 Kubernetes权威指南：从Docker到Kubernetes实践全接触（第2版），这本书已经出到第四版了。背景通宵看完。总共两本书。 1.专门kubernate 2.浙江大学，兼讲容器和容器云kubernate 因为kubernate太火了，连极客时间都在谈论。是
kube-scheduler

配置文件 Scheduler就是负责安排Pod到具体的Node [root@k8s-master30-172-23-210-30 ~]# cat /usr/lib/systemd/system/kube-scheduler.service [Unit] Description=Kubernetes Scheduler Plugin Documentation=https://github.com
kubernetes probe

概述 readinessProbe主要探测服务是否就绪，如果你的应用的readinessProbe运行失败，那么就会从组成service的端点中删除，这样就不会有流量通过Kubernetes服务发现机制来发送给它 livenessProbe探测服务是否可，不可用时重启pod 参数 initialDelaySeconds：容器启动后，第一次执行探测需要等待多少秒 periodSeconds：执行探测
KubeOperator K8S

https://docs.kubeoperator.io/KubeOperator-v2.5/introduction/
Kubemetes

将应用docker化，配合ETCD、kubernetes等工具在容器的层面上实现高可用和负载均衡容器化部署　　　　容器化部署应用具有灵活、高效的使用资源，容器可以包含其所需的全部文件，如同在虚拟机上部署应用程序一样，可以拥有自己的配置文件和依赖库，还可以拥有自己的网络接口。因此，与在虚拟机上运行应用程序一样，容器化应用比直接安装的应用程序更容易迁移，而且因为应用程序所运行的每个容器均拥有独立
kubelet

[root@k8s-node31-172-23-210-31 ~]# cat /usr/lib/systemd/system/kubelet.service [Unit] Description=Kubernetes Kubelet Server Documentation=https://github.com/GoogleCloudPlatform/kubernetes After=docke
kube-flannel.yml

flannel作为k8s的集群中常用的网络组件，其yml文件的获取，建议去github中获取。具体的获取方式如下： --- apiVersion: policy/v1beta1 kind: PodSecurityPolicy metadata: name: psp.flannel.unprivileged annotations: seccomp.security.alpha.ku
kube

Kubernetes https://kubernetes.io/zh/docs/setup/learning-environment/minikube/ 使用 Minikube 安装 Kubernetes https://kubernetes.io/docs/tasks/tools/install-minikube/ 步骤安装virtualBox brew search virtualBo
kube版本号问题

kube版本号问题事件起因：我在使用docker安装k8s时，打算使用yum安装kubelet，但是因为版本号的缘故初始化不成功解决方法：首先，使用 yum search --showduplicates kubectl 发现最新的版本号，这里选取到1.13.1版本，将版本号复制下来使用downgrade进行降级 yum downgrade kubelet-1.13.1-0.x86_64
K8s + kubevirt

视频: https://www.bilibili.com/video/BV19K411T7Ty?p=17 基本概念: https://www.jianshu.com/p/6c3f48110240 ----学习: https://blog.csdn.net/clmaykr95629/article/details/100413807 https://blog.csdn.ne

kube-bench

Quick start

Please Note

Contributing

Roadmap

同类工具

相关阅读

相关文章

相关问答

相关文档