Container security
One bad pod should not
own your cluster.
Check your clusters against the CIS Kubernetes Benchmark and scan the images you ship for known exploited packages, in the same tracker.
Cluster prod ยท namespace payments
Kubernetes posture and image scan
| Check | Workload | Result |
|---|---|---|
| CIS 5.2.2 privileged container | ledger-worker | Fail |
| CIS 5.1.3 wildcard role | ci-deployer | Fail |
| CIS 5.3.2 network policy | payments | Missing |
| Image: openssl 1.1.1k | api:2.4.1 | CVE-2021-3711 |
| CIS 5.1.6 service account token | web | Pass |
What it does
- RBACOver-broad subjects and wildcard permissions in roles, cluster roles and bindings.
- WorkloadsPrivileged containers, hostPath, hostNetwork, missing security contexts and automounted tokens.
- SecretsPlaintext credentials and insecure secret configuration.
- Network policyMissing or permissive policies between workloads.
- ImagesPackages in any image matched against advisories, private registries included.
- Scoped when you wantLimit a cluster audit to one namespace.
What you get
- Findings with the failing CIS Kubernetes control
- Image advisories with known exploited status and fixes
- Managed and self-hosted clusters in one view
- Findings in the shared tracker
Mapped to
- CIS Kubernetes Benchmark
- CISA KEV
- EPSS
How it works
- Connect the clusterA kubeconfig, or an API server address with a token.
- Add your imagesAny image reference, with a registry credential if private.
- Fix by controlEach finding names its CIS control or its fixed version.
Documentation
Read the details
Setup, every option and the API, on docs.cerberon.dev.
Common questions
Do you support managed Kubernetes?
Yes. Any cluster you can reach with a kubeconfig or an API server address and token.
Can it scan images from a private registry?
Yes. Save a registry credential on the scan. It is sealed for the project.
See it on your own systems.
A 30-minute demo on your targets, or install it yourself and start scanning this afternoon.