I build security scanner prototype for Kubernetes with Python3 standard library only. I presented this slide at PyCon Indonesia 2023.

1. BUILD A SECURITY SCANNER FOR
KUBERNETES BASED ON CIS BENCHMARK
WITH PYTHON3 STANDARD LIBRARY
Ridwan Fadjar Septian

2. TABLE OF
CONTENT
01.
02.
CIS BENCHMARK FOR K8S
BUILDING THE PROTOTYPE
How CIS Benchmark works for K8s
03. DEVELOPMENT TOOLS
04. PRE-COMMIT
Architecture and source code
Tools for building the prototype
Ensuring quality at before create pull request
05. GITHUB ACTION
Ensuring quality before merge
to master

3. HELLO!
I’m Ridwan Fadjar. Currently, I’m working as Cloud
Infrastructure Engineer at Dkatalis Digital Lab. I love to
create something with Python, Ansible or Terraform

4. CIS BENCHMARK
FOR K8S
01.
How CIS benchmark for Kubernetes

5. FREE TO USE
RATIONALE
CIS Benchmarks are freely
available in PDF format for
non-commercial use
https://www.cisecurity.org/b
enchmark/kubernetes
The reason why the control
should be remediate

6. REMEDIATION
AUDIT
Practical steps to remediate
any violation to CIS controls
for K8s
Best practice to check the
evidence againts controls
with straight forward
instructions

7. REFERENCES
IMPACT
Useful reference from
credible source that define
the audit control
possible risk that might surface if we
don’t remediate the control

8. BUILDING
Arhictecture and source code
02.

9. ARCHITECTURE

10. SOURCE CODE - MAIN

11. SOURCE CODE - UTILS

12. SOURCE CODE - SCANNER

13. SOURCE CODE - BENCMARKER

14. SOURCE CODE - CONTROLS

15. SUMMARY
argparse, for parsing command line
arguments from user
subprocess, for building utilities which
used by the scanner
typing, ensure data type that used as
parameters and return value are meet
expectation and secure
Python Standard Library which I used for
building this security scanner are only those
three below:

16. HOW TO RUN IT?

17. SCANNING WORKER NODE
SCANNING MASTER NODE
python3 kubus/kubus.py --dist minikube --target
worker
$ python3 kubus/kubus.py --dist minikube --target master

18. SCANNING MASTER NODE

19. DEVELOPMET
TOOLS
Tools for building the prototype
03.

20. DEVELOPMENT TOOLS
Python3, latest edition of Python programming language (e.g. support
typing value)
Black, the uncompromising Python code formatter created by PSF
Ruff, an extremely fast Python linter and code formatter, written in Rust
created by Astral-sh (but I use the linter only)
Bandit, tool designed to find common security issues in Python code
created by PyCQA
Pre-commit, tools for performing multiple tasks as hook before you
commit your changes
Github Action, automation for software development workflows
I use several tools when building this security scanner:

21. BLACK - EXAMPLE (BEFORE)

22. BLACK - EXAMPLE (AFTER)

23. RUFF - EXAMPLE

24. RUFF - EXAMPLE

25. BANDIT - EXAMPLE

26. BANDIT - EXAMPLE

27. PRE-COMMIT
Ensuring quality at before create pull request
04.

28. AT A GLANCE
Ensure that your project is Git initialized
Write pre-commit hooks file inside the project
Install pre-commit -> pip install pre-commit
Install dependencies -> pre-commit install
Run pre-commit manually -> pre-commit run --all-files

29. PRE-COMMIT HOOKS - EXAMPLE

30. PRE-COMMIT HOOKS - EXAMPLE
( 1)

31. PRE-COMMIT HOOKS - EXAMPLE
( 1)

32. PRE-COMMIT HOOKS - EXAMPLE
( 1)

33. PRE-COMMIT HOOKS - EXAMPLE
( 2)

34. PRE-COMMIT HOOKS - EXAMPLE
( 2)

35. GITHUB ACTION
Ensuring quality before merge to master
05.

36. GITHUB ACTION PIPELINE - EXAMPLE

37. GITHUB ACTION PIPELINE - EXAMPLE

38. GITHUB ACTION PIPELINE - EXAMPLE

39. GITHUB ACTION PIPELINE - EXAMPLE

40. GITHUB ACTION PIPELINE - EXAMPLE

41. GITHUB ACTION PIPELINE - EXAMPLE

42. GITHUB ACTION PIPELINE - EXAMPLE

43. DEMO
Trying the prototype on Minikube

44. Q & A
Is there anyone who want to raise question?

45. THANK YOU
Github Repo:
https://github.com/ridwanbejo/kubus