Kubernetes Static Analysis Smackdown - TerraScan, Checkov, Kube-Linter & KubeSec | Way of the Future

#kubernetes #k8S #yaml #appsecengineer Kubernetes #YAML Manifests are the backbone of deploying on Kubernetes. However, you can introduce several security vulnerabilities that can lead to your Kubernetes Cluster getting compromised, through Security Misconfigurations.

YAML Manifest Linters or Static Analysis tools help us identify security issues with our Kubernetes Manifests. If we identify issues early in our #CI/#CD Pipeline with tools, we can fix issues early, before they even become issues.

In this segment of AppSecEngineer's "Way of the Future", Abhay Bhargav compares 4 Kubernetes Static Analysis or Linting tools from a Security Perspective.

These Tools are:

• Terrascan from Accurics
• Kube-Linter from StackRox
• Checkov from BridgeCrew
• KubeSec from ControlPlane.io

All of these tools are Open-Source and are meant to do analysis of Kubernetes Manifests for security vulnerabilities

▬ Contents of this video ▬▬▬▬▬▬▬▬▬▬

0:00 - Intro 0:42 - Video Montage 1:12 - The Need to Audit YAML Manifests 2:22 - The Four tools we'll be looking at and their similarities 4:00 - Starting our Smackdown 5:20 - Terrascan Kubernetes Lint 11:52 - Kube-Linter Analysis 15:56 - Checkov Analysis 20:06 - KubeSec Analysis 23:07 - Closing Montage

For the best hands-on Kubernetes #SecurityTraining, checkout https://appsecengineer.com/kubernetes-security-courses/

Learn more about Terrascan at https://www.accurics.com/products/terrascan/ Learn more about Kuber Linters at https://www.stackrox.com/post/2021/02/what-is-kubelinter/ Learn more about Checkov at https://bridgecrew.io/blog/announcing-checkov-prevent-cloud-misconfigurations-during-build-time/ Learn more about KubeSec at https://control-plane.io/cnsec/ ... https://www.youtube.com/watch?v=iicBZSzej_Y