Integrate Kubernetes policy-as-code solutions into Security Hub

[ad_1]

Utilizing Kubernetes policy-as-code (PaC) options, directors and safety professionals can implement group insurance policies to Kubernetes assets. There are a number of publicly obtainable PAC options which might be obtainable for Kubernetes, equivalent to Gatekeeper, Polaris, and Kyverno.

PaC options normally implement two options:

Use Kubernetes admission controllers to validate or modify objects earlier than they’re created to assist implement configuration finest practices on your clusters.
Present a approach so that you can scan your assets created earlier than insurance policies had been deployed or towards new insurance policies being evaluated.

This publish presents an answer to ship coverage violations from PaC options utilizing Kubernetes coverage report format (for instance, utilizing Kyverno) or from Gatekeeper’s constraints standing on to AWS Safety Hub. With this resolution, you may visualize Kubernetes safety misconfigurations throughout your Amazon Elastic Kubernetes Service (Amazon EKS) clusters and your organizations in AWS Organizations. This may additionally provide help to implement commonplace safety use circumstances—equivalent to unified safety reporting, escalation by means of a ticketing system, or automated remediation—on prime of Safety Hub to assist enhance your general Kubernetes safety posture and scale back guide efforts.

Resolution overview

The answer makes use of the strategy described in A Container-Free Option to Configure Kubernetes Utilizing AWS Lambda to deploy an AWS Lambda perform that periodically synchronizes the safety standing of a Kubernetes cluster from a Kubernetes or Gatekeeper coverage report with Safety Hub. Determine 1 exhibits the structure diagram for the answer.

Determine 1: Diagram of resolution

This resolution works utilizing the next assets and configurations:

A scheduled occasion which invokes a Lambda perform on a 10-minute interval.
The Lambda perform iterates by means of every operating EKS cluster that you just wish to combine and authenticate through the use of a Kubernetes Python consumer and an AWS Identification and Entry Administration (IAM) function of the Lambda perform.
For every operating cluster, the Lambda perform retrieves the chosen Kubernetes coverage experiences (or the Gatekeeper constraint standing, relying on the coverage chosen) and sends energetic violations, if current, to Safety Hub. With Gatekeeper, if extra violations exist than these reported within the constraint, a further INFORMATIONAL discovering is generated in Safety Hub to let safety groups know of the lacking findings.

Non-obligatory: EKS cluster directors can elevate the restrict of reported coverage violations through the use of the –constraint-violations-limit flag of their Gatekeeper audit operation.

For every operating cluster, the Lambda perform archives archive beforehand raised and resolved findings in Safety Hub.

You’ll be able to obtain the answer from this GitHub repository.

Walkthrough

Within the walkthrough, I present you easy methods to deploy a Kubernetes policy-as-code resolution and ahead the findings to Safety Hub. We’ll configure Kyverno and a Kubernetes demo surroundings with findings in an present EKS cluster to Safety Hub.

The code offered contains an instance constraint and noncompliant useful resource to check towards.

Conditions

An EKS cluster is required to arrange this resolution inside your AWS environments. The cluster must be configured with both aws-auth ConfigMap or entry entries. Non-obligatory: You should utilize eksctl to create a cluster.

The next assets have to be put in in your laptop:

Step 1: Arrange the surroundings

Step one is to put in Kyverno on an present Kubernetes cluster. Then deploy examples of a Kyverno coverage and noncompliant assets.

Deploy Kyverno instance and coverage

Deploy Kyverno in your Kubernetes cluster based on its set up guide utilizing the Kubernetes CLI.

kubectl create -f https://github.com/kyverno/kyverno/releases/obtain/v1.10.0/set up.yaml

Arrange a coverage that requires namespaces to make use of the label thisshouldntexist.

kubectl create -f – << EOF
apiVersion: kyverno.io/v1
type: ClusterPolicy
metadata:
title: require-ns-labels
spec:
validationFailureAction: Audit
background: true
guidelines:
– title: check-for-labels-on-namespace
match:
any:
– assets:
sorts:
– Namespace
validate:
message: “The label thisshouldntexist is required.”
sample:
metadata:
labels:
thisshouldntexist: “?*”
EOF

Deploy a noncompliant useful resource to check this resolution

Create a noncompliant namespace.

kubectl create namespace non-compliant

Test the Kubernetes coverage report standing utilizing the next command:

kubectl get clusterpolicyreport -o yaml

It’s best to see output just like the next:

apiVersion: v1
objects:
– apiVersion: wgpolicyk8s.io/v1alpha2
type: ClusterPolicyReport
metadata:
creationTimestamp: “2024-02-20T14:00:37Z”
era: 1
labels:
app.kubernetes.io/managed-by: kyverno
cpol.kyverno.io/require-ns-labels: “3734083”
title: cpol-require-ns-labels
resourceVersion: “3734261”
uid: 3cfcf1da-bd28-453f-b2f5-512c26065986
outcomes:
…
– message: ‘validation error: The label thisshouldntexist is required. rule check-for-labels-on-namespace
failed at path /metadata/labels/thisshouldntexist/’
coverage: require-ns-labels
assets:
– apiVersion: v1
type: Namespace
title: non-compliant
uid: d62eb1ad-8a0b-476b-848d-ff6542c57840
consequence: fail
rule: check-for-labels-on-namespace
scored: true
supply: kyverno
timestamp:
nanos: 0
seconds: 1708437615

Step 2: Resolution code deployment and configuration

The following step is to clone and deploy the answer that integrates with Safety Hub.

To deploy the answer

Clone the GitHub repository through the use of your most popular command line terminal:

git clone https://github.com/aws-samples/securityhub-k8s-policy-integration.git

Open the parameters.json file and configure the next values:

Coverage – Title of the product that you just wish to allow, on this case policyreport, which is supported by instruments equivalent to Kyverno.
ClusterNames – Record of EKS clusters. When AccessEntryEnabled is enabled, this resolution deploys an entry entry for the combination to entry your EKS clusters.
SubnetIds – (Non-obligatory) A comma-separated checklist of your subnets. In the event you’ve configured the API endpoints of your EKS clusters as non-public solely, then you could configure this parameter. In case your EKS clusters have public endpoints enabled, you may take away this parameter.
SecurityGroupId – (Non-obligatory) A safety group ID that enables connectivity to the EKS clusters. This parameter is simply required when you’re operating non-public API endpoints; in any other case, you may take away it. This safety group must be allowed ingress from the safety group of the EKS management aircraft.
AccessEntryEnabled – (Non-obligatory) In the event you’re utilizing EKS entry entries, the answer routinely deploys the entry entries with read-only-group permissions deployed within the subsequent step. This parameter is True by default.

Save the modifications and shut the parameters file.
Arrange your AWS_REGION (for instance, export AWS_REGION=eu-west-1) and be sure that your credentials are configured for the delegated administrator account.
Enter the next command to deploy:

It’s best to see the next output:

Ready for changeset to be created..
Ready for stack create/replace to finish
Efficiently created/up to date stack – aws-securityhub-k8s-policy-integration

Step 3: Arrange EKS cluster entry

It’s worthwhile to create the Kubernetes Group read-only-group to permit read-only permissions to the IAM function of the Lambda perform. In the event you aren’t utilizing entry entries, additionally, you will want to switch the aws-auth ConfigMap of the Kubernetes clusters.

To configure entry to EKS clusters

For every cluster that’s operating in your account, run the kube-setup.sh script to create the Kubernetes read-only cluster function and cluster function binding.
(Non-obligatory) Configure aws-auth ConfigMap utilizing eksctl when you aren’t utilizing entry entries.

Step 4: Confirm AWS service integration

The following step is to confirm that the Lambda integration to Safety Hub is operating.

To confirm the combination is operating

Open the Lambda console, and navigate to the aws-securityhub-k8s-policy-integration-<area> perform.
Begin a take a look at to import your cluster’s noncompliant findings to Safety Hub.
Within the Safety Hub console, assessment the lately created findings from Kyverno.

Figure 2: Sample Kyverno findings in Security Hub

Determine 2: Pattern Kyverno findings in Safety Hub

Step 5: Clear up

The ultimate step is to wash up the assets that you just created for this walkthrough.

To destroy the stack

Use the command line terminal in your laptop computer to run the next command:

Conclusion

On this publish, you realized easy methods to combine Kubernetes coverage report findings with Safety Hub and examined this setup through the use of the Kyverno coverage engine. If you wish to take a look at the combination of this resolution with Gatekeeper, you’ll find various instructions for step 1 of this publish within the GitHub repository’s README file.

Utilizing this integration, you may achieve visibility into your Kubernetes safety posture throughout EKS clusters and be part of it with a centralized view, along with different safety findings equivalent to these from AWS Config, Amazon Inspector, and extra throughout your group. You too can do that resolution with different instruments, equivalent to kube-bench or Gatekeeper. You’ll be able to lengthen this setup to inform safety groups of important misconfigurations or implement automated remediation actions through the use of AWS Safety Hub.

For extra data on easy methods to use PaC options to safe Kubernetes workloads within the AWS cloud, see Amazon Elastic Kubernetes Service (Amazon EKS) workshop, Amazon EKS finest practices, Utilizing Gatekeeper as a drop-in Pod Safety Coverage substitute in Amazon EKS and Coverage-based countermeasures for Kubernetes.

You probably have suggestions about this publish, submit feedback within the Feedback part beneath. You probably have questions on this publish, contact AWS Assist.

Joaquin Manuel Rinaudo

Joaquin is a Principal Safety Architect with AWS Skilled Companies. He’s obsessed with constructing options that assist builders enhance their software program high quality. Previous to AWS, he labored throughout a number of domains within the safety trade, from cell safety to cloud and compliance associated matters. In his free time, Joaquin enjoys spending time with household and studying science fiction novels.

[ad_2]

Source link