NSA and CISA Kubernetes Security Guidance – A Critical Review

research.nccgroup.com

44 pointskiyanwang4 comments

Thanks for sharing, we created an open source that takes any cluster and checks it against these guidelines, check it out, hope you find it useful: https://github.com/armosec/kubescape

This looks great. Thanks for sharing. I hope at some point this becomes a gate for RMF process.

So, you would like use to Curl | Bash a TLA security guidance script, really?

No package and hash database?

It's trivial to detect when a script is being downloaded to disk or piped to a shell, btw.

I saw this same group post another thread about this recently.

Hi, you do not have to use the curl | bash options, completely understand the concern (I am also like that), but we wanted to make it easy for those who like it easy :-)

It is completely open source, you can take the executables and run it yourself, compile it, change it, however you feel like :-)

If you do try it, let us know how it is, happy to get feedback!

Reply on news.ycombinator.com