Différences

Ci-dessous, les différences entre deux révisions de la page.

--- tech:notes_kubernetes_k8s_-_securite [2025/10/04 16:00] – Jean-Baptiste
+++ tech:notes_kubernetes_k8s_-_securite [2025/11/06 11:33] (Version actuelle) – Jean-Baptiste
@@ Ligne 5: / Ligne 5: @@
 Voir :
+  * [[Scan de vulnérabilité pour les images de conteneurs]]
   * https://kubernetes.io/docs/tasks/configure-pod-container/security-context/
   * https://blog.octo.com/securite-pods-isolation-runtimeclass
@@ Ligne 10: / Ligne 11: @@
   * https://medium.com/@ninapepite/outils-de-s%C3%A9curit%C3%A9-gratuit-pour-kubernetes-introduction-%C3%A0-m9sweeper-edf9b3800e19
   * Kube-bench
+  * https://www.checkpoint.com/fr/cyber-hub/cloud-security/what-is-kubernetes/kubernetes-runtime-security/
+  * https://www.wiz.io/academy/kubernetes-security-best-practices
+  * https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
+  * https://blog.stephane-robert.info/docs/conteneurs/orchestrateurs/outils/popeye/
+Containers !
+  * https://docs.docker.com/enterprise/security/hardened-desktop/enhanced-container-isolation/
+  * https://docs.docker.com/engine/security/#docker-daemon-attack-surface
@@ Ligne 100: / Ligne 110: @@
+## Outils analyse sécu
+Voir :
+  * m9sweeper
+### Kube bench
+Step 1: Download the official job manifest
+Clone the kube-bench repo or grab job.yaml from the GitHub releases page.
+~~~bash
+git clone https://github.com/aquasecurity/kube-bench.git
+cd kube-bench
+# ou
+kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml
+~~~
+Step 2: Apply the job to your cluster
+~~~bash
+kubectl apply -f job.yaml
+~~~
+Step 3: Watch the pod until it shows as Completed
+~~~bash
+kubectl get pods -w
+~~~
+Step 4: Review the results
+~~~bash
+#kubectl logs -l job-name=kube-bench
+kubectl logs pod/kube-bench-6zgst
+~~~
+~~~bash
+podman run --pid=host -v /etc:/etc:ro -v /var:/var:ro -v $(which kubectl):/usr/local/mount-from-host/bin/kubectl -v ~/.kube:/.kube -e KUBECONFIG=/.kube/config -t docker.io/aquasec/kube-bench:latest run
+~~~
+### kubescape
+Voir :
+  * https://blog.stephane-robert.info/docs/securiser/conteneurs/kubescape/
+Install
+~~~bash
+kubectl krew update
+kubectl krew install kubescape
+~~~
+Scan
+~~~bash
+kubectl kubescape scan
+kubescape scan  --format html --output results.html
+~~~
+Voir Trivy [[Scan de vulnérabilité pour les images de conteneurs]]