{"id":16868628,"url":"https://github.com/chen-keinan/kube-knark","last_synced_at":"2025-03-22T07:30:58.672Z","repository":{"id":47416547,"uuid":"346600094","full_name":"chen-keinan/kube-knark","owner":"chen-keinan","description":"Open Source runtime tool which help to detect malware code execution and run time mis-configuration change on a kubernetes cluster ","archived":false,"fork":false,"pushed_at":"2022-01-22T18:56:49.000Z","size":6766,"stargazers_count":36,"open_issues_count":0,"forks_count":4,"subscribers_count":2,"default_branch":"master","last_synced_at":"2025-03-18T09:12:53.422Z","etag":null,"topics":["ebpf","ebpf-programs","golang","kubernetes","linux","scanner","security"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/chen-keinan.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2021-03-11T06:23:32.000Z","updated_at":"2024-11-29T01:55:30.000Z","dependencies_parsed_at":"2022-08-30T23:11:55.986Z","dependency_job_id":null,"html_url":"https://github.com/chen-keinan/kube-knark","commit_stats":null,"previous_names":[],"tags_count":2,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chen-keinan%2Fkube-knark","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chen-keinan%2Fkube-knark/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chen-keinan%2Fkube-knark/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chen-keinan%2Fkube-knark/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/chen-keinan","download_url":"https://codeload.github.com/chen-keinan/kube-knark/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":244924952,"owners_count":20532872,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","ebpf-programs","golang","kubernetes","linux","scanner","security"],"created_at":"2024-10-13T14:58:59.598Z","updated_at":"2025-03-22T07:30:53.655Z","avatar_url":"https://github.com/chen-keinan.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Go Report Card](https://goreportcard.com/badge/github.com/chen-keinan/kube-knark)](https://goreportcard.com/report/github.com/chen-keinan/kube-knark)\n[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/chen-keinan/beacon/blob/main/LICENSE)\n[![Build Status](https://travis-ci.com/chen-keinan/kube-knark.svg?branch=master)](https://travis-ci.com/chen-keinan/kube-knark)\n\u003cimg src=\"./pkg/images/coverage_badge.png\" alt=\"test coverage badge\"\u003e\n[![Gitter](https://badges.gitter.im/kube-knark/community.svg)](https://gitter.im/kube-knark/community?utm_source=badge\u0026utm_medium=badge\u0026utm_campaign=pr-badge)\n\u003cbr\u003e\u003cimg src=\"./pkg/images/kube_krank.png\" width=\"300\" alt=\"kube-krank logo\"\u003e\u003cbr\u003e\n# Kube-Knark Project\n###  Trace your kubernetes runtime !!\nKube-Knark is an open-source tracer that uses pcap \u0026 ebpf technology to perform runtime tracing on a deployed Kubernetes cluster. It is tracing the Kubernetes API execution and master node configuration files permission changes. The trace matching events are leveraged via go plugin webhooks\n\n### kube-knark trace the following :\n- The full [Kubernetes API specification](https://kubernetes.io/docs/reference/kubernetes-api/) execution calls especially mutation \u003cbr\u003e \n- kubernetes master node configuration files permission changes [CIS Kubernetes Benchmark specification](https://www.cisecurity.org/benchmark/kubernetes/)\n\nkube-knark tracing data are reported :\n- Console dashboard\n- Go Plugin hooks\n\nkube-Knark console:\n\u003cbr\u003e\u003cimg src=\"./pkg/images/knark-console.png\" width=\"800\" alt=\"kube-krank-console logo\"\u003e\u003cbr\u003e\n\n* [Requirements](#requirements)\n* [Installation](#installation)\n* [Quick Start](#quick-start)\n* [User Plugin Usage](#user-plugin-usage)\n* [Supported Specs](#supported-specs)\n* [Contribution](#Contribution)\n\n## Requirements\n- Go 1.13+\n- Linux Kernel 4.15+\n- Clang 10+\n- LLVM\n- Kernel Headers\n- Pcap\n\n## Installation\n```shell\ngit clone https://github.com/chen-keinan/kube-knark\ncd kube-knark\nmake build\n```\n## Quick Start\nExecute kube-knark without plugins \n```shell\n ./kube-knark \n```\n## User Plugin Usage (via go plugins)\nThe Kube-knark expose 2 hooks for user plugins [Example](https://github.com/chen-keinan/kube-knark/tree/master/examples/plugins) :\n- **OnK8sAPICallHook** - this hook accepts k8s api call event with all details (http request /response ,matching API spec) \n- **OnK8sFileConfigChangeHook** - this hook accepts master file configuration change event with command details (chown or chmod ,args and matching file change spec)\n\n##### Compile user plugin\n```shell\ngo build -buildmode=plugin -o=~/\u003cplugin folder\u003e/\u003cplugin\u003e.so ~/\u003cplugin folder\u003e/\u003cplugin\u003e.go\n```\n##### Copy plugin to folder (.kube-knark folder is created on the 1st startup)\n```shell\ncp ~/\u003cplugin folder\u003e/\u003cplugin\u003e.so ~/.kube-knark/plugins/compile/\u003cplugin\u003e.so\n```\n## Supported Specs \nThe Kube-knark support 2 specs and can be easily extended:\n- The full k8s API spec [Kubernetes API specification](https://github.com/chen-keinan/kube-knark/tree/master/internal/spec/api)\n- master config file change spec [Master Node Config](https://github.com/chen-keinan/kube-knark/tree/master/internal/spec/filesystem)\n\nboth specs can be easily extended by amended the spec files under ```~/.kube-knark/spec``` folder\n\n## Contribution\n- code contribution is welcome !! , contribution with tests and passing linter is more than welcome :) \n- /.dev folder include vagrantfile to be used for development : [Dev Instruction](https://github.com/chen-keinan/kube-knark/tree/master/.dev)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchen-keinan%2Fkube-knark","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchen-keinan%2Fkube-knark","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchen-keinan%2Fkube-knark/lists"}