Kentra

A Kubernetes offensive security framework for orchestrating penetration testing, red teaming operations, and large-scale reproducible security scans both inside and outside your cluster

Overview • Installation • Features • Quick Start • Todo • Contributing

Overview

Kentra provides a declarative way to define and execute security operations as native Kubernetes resources. Instead of manually managing security testing tools and scripts, you define your security tests as YAML manifests and let Kentra's Kubernetes Operator handle orchestration, scheduling, logging, and resource management.

Demo

To explore all Kentra features, please spin up the project and have fun :)

Kentra URL: https://demo.kentrasecurity.sh

This is a view-only demo.

Dashboard

Kentra can be deployed with the dashboard to aggregate command outputs and easily run commands

Installation

Helm Chart

Kentra's global helm chart is available. Refer to the values.yaml for configuration options.

helm install kentra-platform \
  oci://ghcr.io/kentrasecurity/helm/kentra-platform \
  --version 0.4.0 \
  --namespace kentra-system \
  --create-namespace \
  -f values.yaml

To uninstall it

helm uninstall kentra-platform -n kentra-system

Kustomize

This will use Kustomize to install Kentra via kustomization.yaml. The default namespace is kentra-system

kubectl apply -k config/default

To uninstall it

kubectl delete -k config/default

Verify the Deployment

# Check if the manager pod is running
kubectl get pods -n kentra-system

# Check CRDs are installed
kubectl get crds | grep kentra.sh

# View controller logs
kubectl logs -n kentra-system deployment/kentra-controller-manager -f

Quick Start

See QUICKSTART.md for examples and configurations

Configure Tool Specifications

Kentra uses the ConfigMap tool-specs.yaml to define tool specifications. When modified, apply it again with

kubectl apply -f config/default/kentra-tool-specs.yaml

To specify a new tool, use the following fields

Field	Type	Description	Example
type	string	The operation type the tool performs, used for greppable purposes	"enumeration", "exploitation", "scanning"
category	string	The category or domain of the tool, used for logic separation	"network", "web", "vulnerability"
image	string	Docker image URI for the tool container	"instrumentisto/nmap:latest"
commandTemplate	string	Command execution template with placeholders	"nmap {{.Args}} -p {{.Target.port}} {{.Target.endpoint}}"
endpointSeparator	string (Optional)	Delimiter for multiple endpoints/targets (if supported by the tool)	" " (space), "," (comma)
portSeparator	string (Optional)	Delimiter for multiple ports (if supported by the tool)	","
capabilities	object (Optional)	Linux capabilities required for the container	See all capabilities example

Configure Logging

For centralized logging with Fluent Bit and Loki view LOGGING.md

Architecture

To see the full architecture, view ARCHITECTURE.md

Development & Building from Source

To see development and compilation process view the development documentation

Disclaimers: User Responsibility & Legal Notice

Caution

You are required to secure clear, written permission from the system owner before using Kentra on any target. Kentra Security and its contributors disclaim all responsibility for any harm, damages, losses, or legal repercussions arising from the use of this project. This includes, but is not limited to, unauthorized access, data breaches, system disruption, or criminal charges. By using this tool, you acknowledge that you are solely accountable for your actions and any resulting consequences..

Contributing

Kentra can be extended to use your custom tools. Follow EXTEND_KENTRA.md for additional information.

Contributions are welcome! If you want to add your tools or modify the project follow this guideline:

0. Fork the project and make your changes
1. Follow the existing code style and patterns
2. Include appropriate tests
3. Update documentation as needed
4. Pass all existing tests and linters
5. Open a Pull Request
6. Merged :)