Security use case

Automatic Kubernetes Hardening

Deliver faster by eliminating misconfigurations and vulnerabilities from Kubernetes clusters

What is Kubernetes hardening?

Kubernetes hardening involves security measures taken to harden Kubernetes clusters. This practice secures the parts of the Kubernetes architecture (e.g. the control plane, worker nodes, or containerized services) that can have flaws and incorrect configurations. If not acted on, these loopholes can be exploited by threat actors with malicious intent.

Kubernetes hardening options

There are numerous frameworks that provide / outline recommendations about hardening. This can involve a lot of manual work, or using a collection of specialized tools. In any case, you do not get the coveted “big picture”. None of these options is ideal due to the toil associated with getting the job done.

Our cloud provider provides security scoring, but we needed to use more specific accepted frameworks, like the Kubernetes Hardening Guidance from the NSA. We found it and other industry- accepted frameworks easily available to use on ARMO Platform.

Alexandre Lussier DevOps, Akinox

The solution

ARMO Platform compliance and vulnerability scanning. You decide when and how. It scans at a click of a button, on a recurring basis or triggered by an event. You can use it at different points throughout the software development life cycle to get ahead of your vulnerabilities and fix them as early as possible.

The scan results in scoring based on the selected framework. You can run the scan multiple times, against all the available frameworks. Some of the top supported frameworks are: NSA-CISA, CIS and MITRE ATT&CK. You can even create the framework that works best for you!

Benefits of Kubernetes hardening with ARMO Platform

- Reduce the toil associated with Kubernetes hardening according to your chosen framework(s). You scan against the framework in question. The result is (a) risk score(s) to benchmark against.
- Easily find your vulnerabilities and fix the cause with features like misconfiguration scanning and assisted remediation.
- Quickly identify the roles with excess permissions with RBAC visualizer.
- keep your clusters safe with real-time drift analysis which continuously provides hardening recommendations.