CIS Benchmarking for Kubernetes Cluster

[sttor]

OWASP KubeLight will help auditors and security folks to get PDF reports for CIS Benchmark scan results. KubeLight will automatically audit the entire K8s Cluster and Nodes to find out if controls are in place or not.

How it will work?

1. A Job or Custom JobDaemonset will run across the entire Kubernetes nodes that will run the Python script on Nodes to gather inputs
2. OWASP KubeLight Bench feature will contain various packs for CIS versions and platforms.
3. The output from all the Nodes will get consolidated in Redis.
4. The embedded API server will serve the Report.
5. Historical Report Storage for the last 5 Scans.
6. A Job in point 1 will need proper volume mounts and Permissions to List Nodes and Run the pod in its own namespace.

[pwned-17]

@sttor Working sounds great , but have questions regarding the redis server .

• Where will the redis server be placed ?
• Is it going to be centralised?

[sttor]

1. Redis will be hosted in the KubeLight namespace in the cluster where scanning is happening, it will be a single instance of a redis, not a Redis cluster. We will add this option in the final helm chart.
2. No, every K8s cluster will have it's own data only, not interaction with other cluster

[DhananjaySinghParmar]

Nice to have feature like KubeLight Bench to get CIS hardening report and achieve compliance.

[sttor]

Instead of creating it from scratch and reinventing a wheel, I feel better using Kube-bench as integration with few tweaks and better visualization @pwned-17

[pwned-17]

@sttor Integrating kube bench with kubelight for benchmarking , seems like a good idea but I see that kubench is written in go and would require us to rewrite their code anyways I guess. ( correct me if I'm wrong )

[sttor]

@pwned-17 By Integration, I meant to say - KubeLight will only consume Kube-bench output into its dashboard.