Tools

From our Kubernetes perspective and based on its dedicated CIS Benchmarks, the Secrets management part will require us to do the following:

• Enable encryption capabilities for the etcd service
• Define and enforce resource access policies for sensitive data payloads such as Secret but also ConfigMap objects
• Consider an external Secrets management solution to enhance the platform’s security posture
• Audit all interactions that are done with these objects within and outside of the platform

To do so, you’ll require a set of tools that help you discover, analyze, and mitigate potential security exposures. We will explore five tools:

• Trivy, from Aqua Sec: This will help you not only scan container image vulnerabilities but also secret-related security exposures.
• kube-bench: For assessing the CIS Benchmarks.
• Compliance Operator: For assessing supported OpenSCAP profiles and providing mitigating paths.
• StackRox: For assessing...