Secure the supply chain of images

Dit deel is nog niet vertaald. Je ziet de Engelse tekst.

$ als gewone gebruiker# als root (of met sudo)

Vaardigheden in dit hoofdstuk

Minimale images, SBOM, scannen, ondertekenen en toegestane registries

Use minimal base images

Fewer packages = fewer vulnerabilities and fewer tools for an attacker.

$trivy image --severity HIGH,CRITICAL nginx:1.27 | tail -3
$trivy image --severity HIGH,CRITICAL cgr.dev/chainguard/nginx | tail -3
$docker images | grep -E 'nginx|distroless'

Prefer distroless, UBI micro, Alpine or Chainguard images, multi-stage builds and pinned digests (see Build small images).

8.2

Make and use an SBOM

A Software Bill of Materials lists every component of an image. With it, a new CVE is matched to your images in minutes.

$syft ghcr.io/s0sta/api:2.0 -o spdx-json > api.spdx.json
$trivy image --format cyclonedx -o api.cdx.json ghcr.io/s0sta/api:2.0
$trivy sbom api.cdx.json
$bom generate --image ghcr.io/s0sta/api:2.0 -o api.spdx

8.3

Scan images

Scan in CI (block bad builds) and in the cluster (find old images with new CVEs).

$trivy image --severity CRITICAL --exit-code 1 ghcr.io/s0sta/api:2.0
$trivy k8s --report summary cluster
$kubectl get pods -A -o jsonpath='{range .items[*]}{.spec.containers[*].image}{"\n"}{end}' | sort -u

Examentip

A task like "find pods with images that have CRITICAL vulnerabilities and delete them": list the images, scan each with trivy image -s CRITICAL, delete the matching pods.

8.4

Sign and verify images

Sign images in CI with cosign; let an admission policy accept only signed images.

$cosign sign --key cosign.key ghcr.io/s0sta/api@sha256:DIGEST
$cosign verify --key cosign.pub ghcr.io/s0sta/api@sha256:DIGEST

kyverno-verify.yaml

apiVersion: kyverno.io/v1
kind: ClusterPolicy
metadata: { name: verify-signature }
spec:
  validationFailureAction: Enforce
  rules:
    - name: check-signature
      match: { any: [{ resources: { kinds: [Pod] } }] }
      verifyImages:
        - imageReferences: ["ghcr.io/s0sta/*"]
          attestors:
            - entries:
                - keys:
                    publicKeys: |-
                      -----BEGIN PUBLIC KEY-----
                      ...
                      -----END PUBLIC KEY-----

8.5

Allow only trusted registries

Block images from unknown registries — with Gatekeeper (allowed repos), Kyverno, or the ImagePolicyWebhook admission plugin.

/etc/kubernetes/admission/admission-config.yaml

apiVersion: apiserver.config.k8s.io/v1
kind: AdmissionConfiguration
plugins:
  - name: ImagePolicyWebhook
    configuration:
      imagePolicy:
        kubeConfigFile: /etc/kubernetes/admission/kubeconfig.yaml
        allowTTL: 50
        denyTTL: 50
        retryBackoff: 500
        defaultAllow: false

In the API server manifest: --enable-admission-plugins=NodeRestriction,ImagePolicyWebhook and --admission-control-config-file=/etc/kubernetes/admission/admission-config.yaml (plus the volume mount).

Onthoud

defaultAllow: false = when the webhook can not be reached, pods are denied (fail closed).

8.6

Analyse manifests statically

Find risky settings in YAML before it is applied.

$kubesec scan deployment.yaml
$kube-linter lint ./manifests
$trivy config ./manifests
$checkov -d ./manifests --framework kubernetes

Typical findings: running as root, no resource limits, privileged: true, latest tags, writable root file system, host namespaces.

Alle commando's in dit hoofdstuk