YaraHunter scans container images, running Docker containers and filesystems to find malware.

It uses a YARA ruleset to identify resources that match known malware signatures and may indicate that the container or filesystem has been compromised.

More: https://github.com/deepfence/YaRadare

aws-secret-sidecar-injector is a mutating webhook that fetches secrets from AWS Secrets Manager.

More: https://github.com/aws-samples/aws-secret-sidecar-injector

We've just released "Learn Kubernetes weekly", a newsletter that features curated Kubernetes news, events, and job opportunities.

What you can expect:

- The best articles and tutorials to sharpen your Kubernetes skills.
- The best meetups, conferences, and training that you should attend.
- Libraries, frameworks, and tools that you can use in your projects.

The newsletter is not a collection of links or an essay; instead, we opted for a few short sentences for each article or project — so it's easier to judge if you should read the article or skip it.

The first issue is due tomorrow, and you can subscribe here: https://learnk8s.io/learn-kubernetes-weekly

RBAC Manager is an operator that supports declarative configuration for RBAC with new custom resources.

Instead of managing role bindings or service accounts directly, you can specify the desired state and RBAC Manager will make the necessary changes.

More: https://github.com/FairwindsOps/rbac-manager

In this tutorial, you will learn how to integrate tools such as kube-bench and Kubespace to identify potential vulnerabilities in a CI/CD pipeline before they reach the cluster.

More: https://medium.com/@sdevsecops/how-to-implement-devsecops-in-a-kubernetes-cluster-environment-github-actions-and-azure-devops-522bdd121e34

In this article, you will find a curated (but not exhaustive) list of FOSS projects addressing multi-tenancy challenges in Kuberntes.

More: https://divya-mohan0209.medium.com/mo-tenancy-mo-problems-f031f75374f7

The purpose of The Kubernetes networking guide is to provide an overview of various Kubernetes networking components with a specific focus on exactly how they implement the required functionality.

More: https://tkng.io

With Kyverno:

- Invalid resources can be blocked with helpful errors.
- Misconfigured resources can be corrected on the fly.
- New resources can be dynamically generated.

Learn how to use Kyverno to govern multi-tenant clusters in this article.

More: https://medium.com/compass-true-north/governing-multi-tenant-kubernetes-clusters-with-kyverno-3e11ba4a64ad

In Kubernetes, external traffic (e.g. north-south) is a major source of security risk.

In this article, you'll have a look at **tools to mitigate such risks. **

More: https://medium.com/slalom-build/managing-ingress-traffic-on-kubernetes-platforms-ebd537cdfb46

Kubescape is a tool that provides risk analysis, security compliance, RBAC visualizer and image vulnerabilities scanning.

More: https://github.com/kubescape/kubescape

This tutorial will provide you with all the steps and commands to set up SOPS in your shell, Kubernetes, Helm and Visual Studio Code.

More: https://itnext.io/goodbye-sealed-secrets-hello-sops-3ee6a92662bb

In this tutorial, you'll learn how to inject secrets in your Pods directly from AWS Secret Manager using the AWS Secrets Manager CSI Driver.

More: https://faun.pub/lets-do-devops-k8s-fetching-aws-secrets-manager-secrets-on-pod-launch-securely-be447fe2c0ff

In this article, you will expose the differences between Layer 7 security in Cilium vs Istio.

More: https://solo.io/blog/exploring-cilium-layer-7-capabilities-compared-to-istio

In this article, you will learn how to configure RBAC in Kubernetes.

You will configure RBAC both with kubectl and yaml definitions.

More: https://dev.to/mstryoda/configure-rbac-in-kubernetes-like-a-boss-h67

🗓 Kubernetes events starting in the next 24 hours:

28 Nov 2:00 pm GMT - CKS bootcamp | Cloud Technology Experts Inc - 📍 Online workshop

→ See all Kubernetes events

This repo contains two kubectl plugins:

1. kubectl exec-as — Like kubectl exec, but offers a --user flag to exec as root (or any other user).
2. kubectl prompt — Displays a warning prompt when issuing commands in a flagged cluster or namespace.

More: https://github.com/jordanwilson230/kubectl-plugins/tree/krew#kubectl-exec-as

Kube No Trouble (kubent) is a tool to check whether you're using any deprecated APIs in your cluster and therefore should upgrade your workloads first, before upgrading your Kubernetes cluster.

More: https://github.com/doitintl/kube-no-trouble

This article contains a list of useful risks and mitigations for securing workloads in Kubernetes.

More: https://medium.com/@mkbadeniyi/how-to-secure-cloud-native-applications-38f59d99785e

This article covers:

- What is a JWT, and why should you care?
- Dissecting Istio's JWT edge authentication & authorization.
- How to build an external authz service for Istio.

More: https://medium.com/globant/istio-jwt-authentication-authorization-at-the-edge-b35b612acd97

In this article, you will discover the ins and outs of eBPF and why it is particularly exciting when it comes to observing your containers and Kubernetes clusters.

More: https://groundcover.com/blog/what-is-ebpf

sKan is a tailor-made Kubernetes configuration files and resources scanner that enables developers and DevOps team members to check whether their work complies with security & ops best practices.

More: https://github.com/alcideio/skan