Enable and use Kubernetes Security Guardrails

Before clusters can be discovered or scanned:

1. Connect the cloud service provider (CSP) account (for example, AWS, Azure, or GCP) that hosts your Kubernetes clusters.
2. Confirm that Cloud Security (InsightCloudSec) has the required permissions to access cluster metadata.

For detailed instructions, review Onboard a Cloud Account.

Once your cloud account is connected, managed clusters accessible using CSP APIs are discovered by the remote scanner. Cluster resources are harvested and associated with the parent cloud account. Self-managed or restricted-access clusters require the local scanner. See Task 2 for details on getting the correct scanner deployed.

Cloud Security (InsightCloudSec) offers two scanners:

• Remote scanner: For managed clusters (for example, EKS, AKS, GKE) and when Rapid7 has API and network access to the clusters
  • To get started, go to Deploy the Kubernetes remote scanner.
• Local scanner: For self-managed clusters and when managed clusters are not accessible to Rapid7 or network or security policies restrict remote harvesting
  • To get started, go to Deploy the Kubernetes local scanner.

Use the following chart to determine which scanner supports your cluster type:

Cluster scans are disabled by default. After clusters are discovered:

1. Go to Cloud > Kubernetes Clusters.
2. Select the clusters you want to scan.
3. Click Resume.

This enables the scan cycle. The scanner will harvest cluster configuration data and begin assessment on the next scheduled cycle or when manually triggered.

Kubernetes Guardrails findings appear as Insights in Cloud Security (InsightCloudSec). Insights help you:

• Identify cluster misconfigurations
• Review compliance failures
• Prioritize remediation based on risk

For more information, visit Insights. Many Kubernetes Security Insights are included in the Kubernetes-related CIS Compliance Packs. You can also create custom Insight Packs to tailor compliance visibility to your organization’s requirements. Review Custom Packs for details.

You can review Kubernetes-related configuration findings and remediation guidance on the Misconfigurations page. For more information, review Misconfigurations.

The most common cause is that the remote scanner can’t access a cluster because it requires additional permissions. Review Configuring Permissions for details.

It’s also possible that your cluster is not supported by the remote scanner. Review Task 2: Deploy a Kubernetes scanner for details. In this case, you can use the local scanner instead.

You can migrate clusters between scanners but not run both scanners on the same cluster simultaneously.

To migrate a local scanner to a remote scanner (managed clusters):

1. Uninstall the local scanner.
2. Delete the cluster from Cloud Security (InsightCloudSec). This removes harvested Kubernetes data and Insight findings, but data will be restored after another harvesting cycle and a remote scan.
3. Deploy the remote scanner.
4. Allow the remote scanner to rediscover the cluster.
5. Resume scanning.

To migrate a remote scanner to a local scanner:

1. Find the cluster ID on the Cloud > Kubernetes Clusters page.
2. Deploy the local scanner. Ensure the local scanner configuration uses the same Cluster ID as the ID listed in Cloud Security (InsightCloudSec).

Rapid7 will automatically update the scanner type.

Certain Kubernetes Insights require create permissions for subjectaccessreviews, which are dedicated query objects that are used to check your Kubernetes pods’ permissions. If not granted, scans will complete, but related Insight checks will fail and no subjectaccessreviews will be created in your cluster.

Pod labels are ingested as resource tags.

To view resource tags:

1. Go to Inventory > Resources
2. Click Containers > Pods.
3. Find a Pod and click it to open resource properties.
4. Click the Tags tab.