alcideio / skan

Scan Kubernetes resource files , and helm charts for security configurations issues and best practices.

sKan is powered by the Alcide Advisor scan engine and Open Policy Agent (OPA)

sKan

sKan is a tailor made Kubernetes configuration files and resources scanner that enables developers and devops team members to check whether their work is compliant with security & ops best practices.

Install sKan

sKan supports Linux, Mac & Windows and the latest release is available here.

Or use

$ curl https://raw.githubusercontent.com/alcideio/skan/master/skan-download.sh | bash

sKan Kubernetes file

$ skan manifest --report-passed -f kaudit_for_eks.yaml

[skan-this] Analyzing resources from '1' files/directories.
[skan-this] Loaded '9' objects
[skan-this] Ops Conformance | Workload Readiness & Liveness
[skan-this] Ops Conformance | Workload Capacity Planning
[skan-this] Workload Software Supply Chain | Image Registry Whitelist
[skan-this] Ingress Controllers & Services | Ingress Security & Hardening Configuration
[skan-this] Ingress Controllers & Services | Ingress Controller (nginx) 
[skan-this] Ingress Controllers & Services | Service Resource Checks
[skan-this] Pod Security | Workload Hardening
[skan-this] API Server Access Privileges | Privileged Kubernetes API Server Access
[skan-this] Secret Hunting | Find Secrets in ConfigMaps
[skan-this] Secret Hunting | Find Secrets in Pod Environment Variables
[skan-this] Admission Controllers | Validating Admission Controllers
[skan-this] Admission Controllers | Mutating Admission Controllers
[skan-this] Generating report (html) and saving as 'skan-result.html'
[skan-this] Summary:
[skan-this] Critical .... 0
[skan-this] High ........ 4
[skan-this] Medium ...... 2
[skan-this] Low ......... 0
[skan-this] Pass ........ 21

$ open skan-result.html

sKan Helm Chart

$ helm template kaudit deploy/charts/kaudit --set k8sAuditEnvironment=eks | skan manifest -f -

sKan Kustomized Resources

kubectl kustomize helloWorld | skan manifest -f -

Command Line Example

Validate Kubernetes resource(s) handed as YAML.

YAML file with multiple resources are supported.
By default a HTML report is generated. To generate YAML based outformat use --output flag

skan manifest -f mydeployment.yaml

Usage:
  skan manifest [flags]

Aliases:
  manifest, file, Files, m, manifests, validate

Examples:

# Validate a YAML file. Multiple YAML files separated with '---' is supported
skan manifest -f mydeployment.yaml -f myotherdeployment.yaml

# Validate all the resources found under the namespace 'myns' of a cluster with 'kubectl get'
kubectl get all -n myns -o yaml | skan manifest --report-passed -f -

# Validate resource kustomization
kubectl kustomize helloWorld | skan manifest -f -

# Validate Helm Chart
helm template kaudit deploy/charts/kaudit --set k8sAuditEnvironment=eks | skan manifest -f -


Flags:
  -d, --debug               Debug trace level
  -f, --filename strings    One or more file names (or directories) that contain the configuration to sKan
  -h, --help                help for manifest
  -o, --output string       output format. Supported formats are html, yaml and json (default "html")
      --outputfile string   OutputFormat file (default "skan-result.html")
  -p, --report-passed       Report passed checks

Contributing

Bugs

If you think you have found a bug please follow the instructions below.

• Please spend a small amount of time giving due diligence to the issue tracker. Your issue might be a duplicate.
• Open a new issue if a duplicate doesn't already exist.

Features

If you have an idea to enhance rbac-tool follow the steps below.

• Open a new issue.
• Remember users might be searching for your issue in the future, so please give it a meaningful title to helps others.
• Clearly define the use case, using concrete examples.
• Feel free to include any technical design for your feature.

skan's Issues

Skan search for 'deployment' readiness and liveness probes

Describe the bug
Skan scan search for 'deployment' readiness and liveness probes while they exist only at pod level

To Reproduce
Steps to reproduce the behavior:
scan any template containing pod readiness and liveness probes

Expected behavior
check for pod readiness and liveness probes only

Desktop (please complete the following information):

• OS: linux
• Version 0.8.0

On-Prem support

HTML output requires a connection to the internet, so it shows a blank page while running on-prem.
Is there an option to direct the external assets' requests to an internal path somehow?

Add docker image with shell to support CI systems that require shell (gitlab ci)

As far as I can tell, no shell is available on the official docker image alcide/skan does not have a shell that can be used as an entrypoint

This makes using the official image with GitLab CI jobs impossible

The official kaniko image also doesn't have a shell, so the :debug tag is required for GitLab CI jobs since it has a shell. Could you offer something similar?

Multiple output files

Is there a way to have multiple output files? For instance, html file for display and json for automation?

TypeError: "t.Resource.Namespace is undefined"

Describe the bug
I get TypeError: "t.Resource.Namespace is undefined" in 0.1.1/dist/main.js:35
and a blank view in brower when running

helm template mychart pathtochart | skan manifest -f -

Can see that it have findings, soo seems to understand the chart.

[ENHANCEMENT] ARM64

Hello.

I'm wondering if there is an option to build also for arm64 CPU arch?

Regards
Tom