Skip to main content

Kubernetes

Boost the security of your Kubernetes environment, otherwise known as K8s, with ThreatKey's Kubernetes integration. Designed to identify misconfigurations and security risks proactively, this integration ensures the robust protection of your container orchestration operations. It also offers robust remediation management capabilities, ensuring a swift and efficient resolution of any identified security threats.

Key features​

Security risk identification​

With ThreatKey's Kubernetes integration, you can uncover potential security risks and misconfigurations within your Kubernetes environment. Using advanced analytics, the integration identifies potential issues and helps you secure your container orchestration platform.

Remediation management​

The Kubernetes integration includes a comprehensive remediation management feature. This capability allows you to oversee and track your remediation efforts, promoting quick and efficient resolutions for any security risks.

Reporting and analytics​

Gain a deeper understanding of your Kubernetes environment's security posture with our detailed reporting and analytics. The insights can inform strategic decisions, aid in compliance efforts, and promote continuous security improvement.

Connect your AWS Elastic Kubernetes Service (EKS) cluster to ThreatKey​

First, you'll create an AWS policy that describes the permissions we need. Once you have that policy, you'll attach it to either an AWS role or an AWS user. We recommend attaching the policy to an AWS role, but ThreatKey can work with AWS users as well. Then you can grant that AWS principal access to your EKS cluster, point ThreatKey at the EKS cluster, and we'll do the rest!

If you already have an AWS policy attached to an AWS principal, you can skip directly to "Grant the AWS role access to your EKS cluster." Once your AWS principal has access to your EKS cluster, you can continue to "Point ThreatKey at your EKS cluster."

Prepare AWS IAM and connect it to EKS​

Create an AWS policy​

  1. Go to the AWS IAM Dashboard.

  2. Create an AWS IAM policy.

    1. Use the sidebar to go to the Policies page and select Create policy.

  3. Switch to the JSON version of the policy editor and enter the following JSON.

    {
      "Version": "2012-10-17",
      "Statement": [
        {
          "Effect": "Allow",
          "Action": [
            "eks:AccessKubernetesApi",
            "eks:DescribeCluster",
            "eks:ListClusters"
          ],
          "Resource": "**"
        }
      ]
    }

    With this policy, you can onboard multiple clusters with the same role. Just run the commands in the upcoming "Grant the AWS role access to your EKS cluster" step for each additional cluster.

  4. Continue through the prompts to name your policy something descriptive, such as "TK-EKS-Policy."

  5. Create the policy.

Create an AWS principal​

An AWS principal can either be an AWS role or an AWS user.

We recommend setting up an AWS role for ThreatKey so you don't have to copy and paste long-term credentials anywhere.

If you need to use an AWS user instead, we support that as well. We do store the AWS user's permanent long-term credentials securely on our end, but the fact that those credentials exist at all makes AWS users inherently riskier than AWS roles for application authentication.

warning

Please be very careful with the credentials for AWS users.

Option 1: Create an AWS role to use the policy​

tip

We recommend this option. If you need to use an AWS user instead, see Option 2.

  1. Go to the AWS IAM Dashboard.
  2. Create a role.
    1. Use the sidebar to go to the Roles page and select Create role.
  3. Select AWS account as the trusted entity type.
  4. Select Another AWS account and enter 742123671053 as the Account ID.
  5. Select Require external ID from the options and enter the unique External ID that we provide in the ThreatKey app.
  6. Continue to the next prompt to add permissions to this new role.
  7. Search for the AWS policy you made earlier and attach it to this role by checking the box next to it.
  8. Continue to the next prompt to name the role something descriptive, such as "ThreatKeyK8sRole."
  9. Create the role.

If you used the policy we provided earlier, you will be able to use this same role to onboard additional EKS clusters as well. Just run the following commands to grant this role access to those clusters.

Grant the AWS role access to your EKS cluster​

  1. Open a shell that has kubectl and access to the AWS Command Line Interface.

  2. Provision ThreatKey's K8s ClusterRole and ClusterRoleBinding


kubectl apply -f https://threatkey-assets.s3.amazonaws.com/k8s/provision.yml

  1. Replace all the placeholders in this example command and then run it to grant the new AWS role access to your EKS cluster.
    1. The --profile argument is optional and only necessary if you have multiple AWS profiles configured on your machine.
eksctl create iamidentitymapping \
  --cluster <cluster_name> \
  --region=<region> \
  --arn arn:aws:iam::<aws_account_number>:role/<role_just_created> \
  --username ThreatkeyAccessUser \
  --no-duplicate-arns \
  --profile <profile_associated_with_role_and_eks>

Option 2: Create an AWS user to use the policy​

warning

We recommend using an AWS role instead of an AWS user. To use an AWS role, see Option 1 above.

  1. Go to the AWS IAM Dashboard.
  2. Create an AWS user.
    1. Use the sidebar to go to the Users page and select Create user.
  3. Name the user something descriptive, such as "ThreatKeyK8sUser" and continue to the next prompt.
  4. Select Attach policies directly from the permissions options.
  5. Search for the policy you made earlier and attach it to this user by checking the box next to the policy.
  6. Continue to the next prompt.
  7. Create the user.

Generate credentials for the AWS user​

  1. Go to the AWS IAM Dashboard.
  2. Go to the user.
    1. Use the sidebar to go to the Users page and search for the user we created in the earlier section.
    2. Select the user to open that user's page.
  3. Go to the Security credentials pane
  4. In the Access keys section, select Create access key.
  5. Select Other as your use case.
  6. Create the access key.
  7. Save the Access Key ID and Secret Access Key somewhere secure, such as a password manager.
warning

Please be very careful with the credentials for AWS users.

If you used the policy we provided earlier, you will be able to use these same credentials to onboard additional EKS clusters as well. Just run the following commands to grant this user access to those clusters.

Grant the AWS user access to EKS​

  1. Open a shell that has kubectl and access to the AWS Command Line Interface.
  2. Provision ThreatKey's K8s ClusterRole and ClusterRoleBinding
kubectl apply -f https://threatkey-assets.s3.amazonaws.com/k8s/provision.yml
  1. Replace all the placeholders in this example command and then run it to grant the new AWS user access to the EKS cluster.
    1. The --profile argument is optional and only necessary if you have multiple AWS profiles configured on your machine.
eksctl create iamidentitymapping \
  --cluster <cluster_name> \
  --region=<region> \
  --arn arn:aws:iam::<aws_account_number>:user/<user_just_created> \
  --username ThreatkeyAccessUser \
  --no-duplicate-arns \
  --profile <profile_associated_with_role_and_eks>

Point ThreatKey at your EKS cluster​

  1. Go to the K8s Source in the ThreatKey Console.
    1. Use the sidebar to go to the Environment page and select the K8s Source.
  2. Select AWS as the provider.
  3. If you made an AWS role earlier, select Role for the secret type. If you made an AWS user, select AKID.
    1. Enter the AWS role ARN or the AWS user Access Key ID and Secret Access Key into the appropriate fields.
  4. Enter the ARN of your EKS cluster.
    1. It should look something like arn:aws:eks:<region>:<account_id>:<cluster_name>.
  5. Connect to Kubernetes!

You should now be able to see your new K8s connection in the Sources section of the ThreatKey Console!

Need help?​

We're available to assist with any questions or issues you may run into during the installation and setup process. You can reach us at support@threatkey.com or through our live chat.

AWS documentation​