Kubernetes Remote Scanner

The following permissions are required for Cloud Security (InsightCloudSec) to access the Elastic Kubernetes Service (EKS):

"eks:DescribeCluster",
"eks:ListClusters"

The following permissions are required for Cloud Security (InsightCloudSec) to retrieve the credentials needed to authenticate and connect to AKS clusters for scanning purposes:

"actions": [
  "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
  "Microsoft.ContainerService/managedClusters/read"
]

The following data-level permissions are required for Cloud Security (InsightCloudSec) to read all cluster resources and create subjectaccessreviews to validate access permissions within the Kubernetes cluster:

"dataActions": [
  "Microsoft.ContainerService/managedClusters/*/read",
  "Microsoft.ContainerService/managedClusters/authorization.k8s.io/subjectaccessreviews/write"
]

The following permissions/roles are needed for a service account in order to scan a Kubernetes cluster in the Google Kubernetes Engine (GKE):

• Kubernetes Engine Cluster Viewer (roles/container.clusterViewer)
  • Provides access to get and list GKE clusters and get cluster credentials.
  • Note: This role is a subset of the Kubernetes Engine Viewer role (roles/container.viewer)
  • Provides permissions: container.clusters.get, container.clusters.list, resourcemanager.projects.get, resourcemanager.projects.list
• Kubernetes Engine Viewer (roles/container.viewer)
  • Provides read-only access to resources within GKE clusters, such as nodes, pods, and GKE API objects
  • Review the GCP documentation  for more information about the permissions this role provides
• Permission needed for secrets visibility and validation: container.secrets.list
• Permission needed for subjectaccessreview creation: container.subjectAccessReviews.create

Provisioning access permission for reading the Kubernetes cluster resources from EKS requires the following steps:

• Define the access permissions in the EKS cluster RBAC:

  • Create a ClusterRole using the provided YAML file that allows read access to all Kubernetes resources
  • Create a ClusterRoleBinding to a Kubernetes RBAC group; this will bind the role to all service accounts that are under the provided group

• MAP an IAM role using eksctl or by directly editing the ConfigMap. Refer to the AWS Docs  for details

1. Open a command shell within the desired directory and run the following command to connect to your Kubernetes cluster in the command line, ensuring you replace the placeholder values appropriately: aws eks --region <region-name> update-kubeconfig --name <cluster-name>.
   Review the AWS EKS Documentation  for more information.

2. Copy the following example file to a local file to the desired directory and save it as ClusterRole-Create.yaml:

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRole
   metadata:
     name: cluster-reader-role
   rules:
     - apiGroups:
         - '*'
       resources:
         - '*'
       verbs:
         - get
         - list
     - apiGroups:
         - authorization.k8s.io
       resources:
         - subjectaccessreviews
       verbs:
         - create

3. Within the desired directory, run this command to create the cluster role in Kubernetes: kubectl apply -f ClusterRole-Create.yaml

4. In the same directory, copy the following example file to a local file and save it as ClusterRoleBinding-Apply.yaml:

   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   metadata:
     name: cluster-reader-binding
   roleRef:
     apiGroup: rbac.authorization.k8s.io
     kind: ClusterRole
     name: cluster-reader-role
   subjects:
     - kind: Group
       name: cluster-reader-group
       apiGroup: rbac.authorization.k8s.io

5. In the same command shell, run this command to create the cluster role in Kubernetes: kubectl apply -f ClusterRoleBinding-Apply.yaml

The final step is to map the existing IAM role to the cluster-reader-group by configuring aws-auth ConfigMap. There are two ways to perform this configuration:

• Using eksctl, an open source tool  that simplifies the configuration of EKS.
• Directly editing the ConfigMap

Using eksctl

1. If you haven’t already, download  and install ekstctl.
2. Use the following command to perform the configuration:

eksctl create iamidentitymapping \
    --cluster my-cluster \
    --region=region-code \
    --arn arn:aws:iam::111122223333:role/rapid7-readonly \
    --group cluster-reader-group \
    --no-duplicate-arns

Directly edit the ConfigMap

1. Run the following command to open the ConfigMap for editing: kubectl edit -n kube-system configmap/aws-auth.
   This will open vim by default; if you prefer to use a different editor, like nano, use the following command instead: KUBE_EDITOR="nano" kubectl edit -n kube-system configmap/aws-auth
2. Adjust the maproles section to look something like the example below, ensuring you replace the rolearn with the harvesting role mentioned above:

apiVersion: v1
data:
  mapRoles: |
    - groups:
      - cluster-reader-group
      rolearn: arn:aws:iam::111122223333:role/rapid7-readonly
      username: my-role

The following steps outline the details for the configuration of a separate role that provides access to EKS.

Note that the completion of these steps only create the new separate role and you will still need to grant access through the process outlined above.

1. From Cloud Security (InsightCloudSec) navigate to Cloud>Clouds and select your target account from the Clouds Listing tab.
2. Select the Settings tab and click the Update EKS Scanner Role button.
3. Select or create your new separate role as desired and complete the form with the required account details.
4. Click OK to finalize your changes.
5. Refer to the steps outlined in the Provide an existing IAM Role With Read Access Permissions to EKS section and complete them as outlined for your new role.

Once you complete the steps to provide Read Access Permissions to EKS, Kubernetes access will be configured and the cluster will begin harvesting (assuming it is not in a paused state within Cloud Security (InsightCloudSec)).

To create and assign a custom role using the Azure CLI:

1. On your local machine, create a JSON file named ics-kubernetes-role.json with the following content, replacing YOUR_SUBSCRIPTION_ID with your actual subscription ID:

   {
       "Name": "ICS Kubernetes Read All/Create subjectaccessreview",
       "Description": "Role that allows a user to read all resources on a kubernetes cluster and create subjectaccessreviews",
       "AssignableScopes": [
           "/subscriptions/YOUR_SUBSCRIPTION_ID"
       ],
       "Actions": [
           "Microsoft.ContainerService/managedClusters/listClusterUserCredential/action",
           "Microsoft.ContainerService/managedClusters/read"
       ],
       "NotActions": [],
       "DataActions": [
           "Microsoft.ContainerService/managedClusters/*/read",
           "Microsoft.ContainerService/managedClusters/authorization.k8s.io/subjectaccessreviews/write"
       ],
       "NotDataActions": []
   }

2. Run the following command in the same directory as your JSON file:

   az role definition create --role-definition ics-kubernetes-role.json

3. Assign the custom role to your Cloud Security (InsightCloudSec) Azure Application:

   az role assignment create --assignee <APPLICATION_ID> --role "ICS Kubernetes Read All/Create subjectaccessreview" --scope "/subscriptions/YOUR_SUBSCRIPTION_ID"

Kubernetes access is now configured and the cluster will begin harvesting (assuming it is not in a paused state in Cloud Security (InsightCloudSec)).

To create and assign a custom role using the Azure Portal:

1. Log in to the Azure Portal  as an admin user for the account that hosts your Cloud Security (InsightCloudSec) Application.
2. Find your subscription, then go to Access control (IAM) > Roles.
3. Click + Add > Add custom role
4. Enter the Basics:
   • Name: ICS Kubernetes Read All/Create subjectaccessreview
   • Description: Role that allows a user to read all resources on a Kubernetes cluster and create subjectaccessreviews
   • Assignable scope: Select your subscription.
5. Click the Permissions tab.
6. Click Add permissions and add the following:
   • Actions:
     • Microsoft.ContainerService/managedClusters/listClusterUserCredential/action
     • Microsoft.ContainerService/managedClusters/read
   • Data Actions:
     • Microsoft.ContainerService/managedClusters/*/read
     • Microsoft.ContainerService/managedClusters/authorization.k8s.io/subjectaccessreviews/write
7. Click Review + create to create the role.
8. Go to Access control (IAM).
9. Click + Add > Add role assignment.
10. Search for and select the new ICS Kubernetes Read All/Create subjectaccessreview role.
11. Click Next.
12. For the Members:
    • Leave Assign access to as the default (User, group, or service principal).
    • Click + Select members.
    • Search for and select your InsightCloudSec Azure Application. Click Select.
13. Click Review + assign to complete the role assignment.

Kubernetes access is now configured and the cluster will begin harvesting (assuming it is not in a paused state in Cloud Security (InsightCloudSec)).