Well, you just completed the course.
Wahoo!
Before I let you go,
let's go through some additional resources to take your
kube‑hunter skills to the next level.
I recommend looking through the kube‑hunter README. In particular,
there's instructions for launching kube‑hunter as a Pod.
As we mentioned at the beginning of this course,
running kube‑hunter as a Pod can simulate what would
occur if a Pod was compromised.
I recommend you try this option within the demo environment.
Kube‑hunter modules is where the actual tests are written.
If you want to dive into Python and see how kube‑hunter audits a
cluster, I highly recommend browsing the code. As we mentioned
earlier, I have a course here on Pluralsight, Container
Infrastructure Analysis with Trivy.
In this course, we dive more heavily into Trivy and how to use
GitHub Actions to automatically scan Docker images.
This course also leverages GitHub Actions to automatically search for
container image tampering in the Docker registry. More information on Pod
security policies can be seen at this link.
This includes how the syntax works and all the options that are available.
Kube‑bench is another Aqua Security, or you can say Aqua
Security, whatever your preference, project.
Kube‑bench checks whether a Kubernetes deployment is
following the CIS Kubernetes Benchmark.
In other words,
it's checking for security best practices. You should instantiate the
demo environment and then run kube‑bench on it.
I'm curious what you will find.
Well, that's a wrap.
I hope this course was useful and allowed you to see the power of
kube‑hunter within your blue team workflow.
As always, I'd love to stay in contact. If you'd like to contact me personally,
please go to my website, zachroofsec.com, and feel free to follow me on Twitter.
I look forward to interacting with you.