Hi.
My name is Zach Roof,
and welcome to this cybersecurity course featuring kube‑hunter.
I wanted to thank Aqua Security for sponsoring the development of kube‑hunter.
Kube‑hunter is an open source tool that hunts for Kubernetes security issues.
Before we dive deeper into this course,
let's take a second to look at some prerequisites.
To fully understand what's going on in this course,
you're going to need some very basic Docker knowledge.
As an aside,
I'll do my best to fill in the gaps and add in basic Docker
and Kubernetes knowledge as we go along.
However, if you're still feeling lost, I'm going to recommend a few courses.
On the Docker side, Getting Started with Docker is a gem,
and it's here on Pluralsight.
Also, you're going to need very basic Kubernetes knowledge.
I highly recommend the Getting Started with
Kubernetes course here on Pluralsight.
Once again, I'm going to do my best to fill in the gaps as we go along,
but if you're still struggling I highly recommend these courses.
Also, all the links on this slide, and in this course in general,
can be seen within the kube‑hunter tutorial repose README.
Okay, back to kube‑hunter.
The documentation is available at this link.
Here,
you'll be able to see installation instructions and
how to use kube‑hunter in general.
Now, what makes kube‑hunter unique?
Well,
in my view what makes it unique is the different
types of scans that can be executed.
To simulate an entirely remote attacker,
kube‑hunter can probe an entire CIDR block for Kubernetes clusters.
Kube‑hunter can also be executed on the Kubernetes instance itself,
similar to how you'd execute an agent on a server.
In this configuration,
kube‑hunter can automatically probe all network interfaces on the
host and hunt for Kubernetes vulnerabilities.
And last but not least, the cluster perspective.
You can launch kube‑hunter as a pod.
These different scan perspectives allow you to
simulate various levels of compromise.
For example,
running kube‑hunter as a pod can simulate what would
occur if a pod was compromised.
By extension,
the server perspective can simulate what would occur if a
process on a Kubernetes server was compromised.
And also, the remote perspective can simulate an internet bot that is,
say, scanning for vulnerabilities.
Obviously if this perspective finds a vulnerability it's pretty serious.
Another unique feature of kube‑hunter is seen
within the active and passive modes.
For this, let's quickly check out kube‑hunter's website.
Okay, we're at kube‑hunter.aquasec.com.
Let's scroll down a little bit.
Sweet.
We see the passive and active tests that kube‑hunter can perform.
When you think of passive tests, usually recon,
or reconnaissance, comes to mind.
For example,
the API service discovery test involves probing the Kubernetes
API to test if it is publicly accessible.
Now,
the passive tests are a lot different than the active
tests that you see on the right.
By contrast, when active mode is enabled,
kube‑hunter will execute active tests that will
attempt to exploit a vulnerability.
Usually an active test involves running a command within the Kubernetes cluster.
Let's see an example.
Okay, here we see the etcd remote access test.
Etcd houses sensitive configurations for the Kubernetes cluster.
This test will try to modify that database.
As you can see,
a unique advantage of kube‑hunter is the breadth of tests that are available.
Also, having the ability to categorize tests is very useful.
For example, if you are testing a cluster that is serving customers,
in other words a production cluster, you'd usually want to do passive tests.
By default, kube‑hunter runs in passive mode.
However, you can enable active tests with the active command line flag.
Okay, let's see how kube‑hunter relates to various cybersecurity frameworks.