{"id":16868459,"url":"https://github.com/chen-keinan/mesh-kridik","last_synced_at":"2025-06-13T06:37:02.012Z","repository":{"id":37044918,"uuid":"413327567","full_name":"chen-keinan/mesh-kridik","owner":"chen-keinan","description":"mesh-kridik is an open-source security checker that performs various security checks on a Kubernetes cluster with istio service mesh and is leveraged by OPA (Open Policy Agent) to enforce security rules.","archived":false,"fork":false,"pushed_at":"2024-12-09T16:56:32.000Z","size":40872,"stargazers_count":26,"open_issues_count":6,"forks_count":5,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-20T05:32:35.790Z","etag":null,"topics":["istio","kubernetes","kubernetes-cluster","opa","open-policy-agent","open-source","policy","scanner","security","service-mesh"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/chen-keinan.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-10-04T08:00:54.000Z","updated_at":"2024-10-03T20:41:43.000Z","dependencies_parsed_at":"2024-10-28T12:29:55.380Z","dependency_job_id":"6e7b2bbe-4588-4161-a3f9-f44056c2821b","html_url":"https://github.com/chen-keinan/mesh-kridik","commit_stats":null,"previous_names":["chen-keinan/kube-mesh-kridik"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/chen-keinan/mesh-kridik","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chen-keinan%2Fmesh-kridik","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chen-keinan%2Fmesh-kridik/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chen-keinan%2Fmesh-kridik/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chen-keinan%2Fmesh-kridik/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/chen-keinan","download_url":"https://codeload.github.com/chen-keinan/mesh-kridik/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/chen-keinan%2Fmesh-kridik/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":259595726,"owners_count":22881895,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["istio","kubernetes","kubernetes-cluster","opa","open-policy-agent","open-source","policy","scanner","security","service-mesh"],"created_at":"2024-10-13T14:58:25.037Z","updated_at":"2025-06-13T06:37:01.722Z","avatar_url":"https://github.com/chen-keinan.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Go Report Card](https://goreportcard.com/badge/github.com/chen-keinan/mesh-kridik)](https://goreportcard.com/report/github.com/chen-keinan/mesh-kridik)\n[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://github.com/chen-keinan/mesh-kridik/blob/main/LICENSE)\n[![Go](https://github.com/chen-keinan/mesh-kridik/actions/workflows/go.yml/badge.svg?branch=master)](https://github.com/chen-keinan/mesh-kridik/actions/workflows/go.yml)\n\u003cimg src=\"./pkg/img/coverage_badge.png\" alt=\"test coverage badge\"\u003e\n[![Gitter](https://badges.gitter.im/beacon-sec/mesh-kridik.svg)](https://gitter.im/beacon-sec/mesh-kridik?source=orgpage)\n\u003cbr\u003e\u003cimg src=\"./pkg/img/mesh_kridik_img.png\" width=\"350\" alt=\"mesh-kridik logo\"\u003e\u003cbr\u003e\n\n# mesh-kridik\nEnhance your Kubernetes service mesh security !!\n\nmesh-kridik is an open-source security checker that performs various security checks on a Kubernetes cluster with istio service mesh and outputs a security report\n\nThe security checks tests are the full implementation of [istio security best practices](https://istio.io/latest/docs/ops/best-practices/security/) \u003cbr\u003e\n\nThe security checks performed on a Kubernetes cluster with istio service mesh and is leveraged by OPA (Open Policy Agent) to enforce security rules, and the output audit report includes:\nthe root cause of the security issue  and proposed remediation for the security issue.\n\n![mesh kridik](./pkg/img/mesh-kridik-repo.gif)\n\n* [Requirements](#requirements)\n* [Installation](#installation)\n* [Quick Start](#quick-start)\n* [Istio Security Checks](#istio-security-checks)\n* [User Plugin Usage](#user-plugin-usage)\n* [Supported Spec](#supported-spec)\n* [Contribution](#Contribution)\n\n## Requirements\n- Go 1.16+\n- jq\n- istio\n\n## Installation\n\n```shell\ngit clone https://github.com/chen-keinan/mesh-kridik\ncd mesh-kridik\nmake build\n```\n\n- Note: mesh-kridik require root user to be executed\n\n## Quick Start\n\nExecute Mesh-Kridik without any flags , execute all tests\n```shell\n ./mesh-kridik \n\n```\n\nExecute mesh-kridik  with flags , execute test on demand\n\n```shell\nUsage: mesh-kridik [--version] [--help] \u003ccommand\u003e [\u003cargs\u003e]\n\nAvailable commands are:\n  -r , --report : run security checks and generate remediation report\n  -i , --include: execute only specific security check, example -i=1.1\n  -e , --exclude: ignore specific security check,  example -e=1.1,2.0\n ```\n\nExecute tests and generate failure tests report and it remediation's\n\n\n```\n./mesh-kridik -r\n``` \n\n## Istio Security Checks\n\u003ctable style=\"width:600px; font-size:10px;\"\u003e\n\u003ctr\u003e\n    \u003cth style=\"width:100px\"\u003eName\u003c/th\u003e\n    \u003cth style=\"width:200px\"\u003eDescription\u003c/th\u003e\n    \u003cth style=\"width:300px\"\u003eImpact\u003c/th\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003e Mutual TLS \u003c/td\u003e\n    \u003ctd\u003e Istio  Mutual TLS proxies are configured in permissive mode by default \u003c/td\u003e\n    \u003ctd\u003e proxies will accept both mutual TLS and plaintext traffic\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003eIstio Safer Authorization Policy Patterns\u003c/td\u003e\n    \u003ctd\u003e Use ALLOW-with-positive-matching or DENY-with-negative-match patterns\u003c/td\u003e\n    \u003ctd\u003eThese authorization policy patterns are safer because the worst result in the case of policy mismatch is an unexpected 403 rejection instead of an authorization policy bypass.\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003epath normalization in authorization policy\u003c/td\u003e\n    \u003ctd\u003eThe enforcement point for authorization policies is the Envoy proxy instead of the usual resource access point in the backend application\u003c/td\u003e\n    \u003ctd\u003eA mismatch can lead to either unexpected rejection or a policy bypass\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003eTLS origination for egress traffic\u003c/td\u003e\n    \u003ctd\u003eUse of DestinationRule on service ServiceEntry for egress traffic\u003c/td\u003e\n    \u003ctd\u003eNot using TLS origination for egress traffic to an external service will be send with plain/text\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003eProtocol detection\u003c/td\u003e\n    \u003ctd\u003eexplicitly declare the service protocol\u003c/td\u003e\n    \u003ctd\u003emiss detection may result in unexpected traffic behavior\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003eCNI support\u003c/td\u003e\n    \u003ctd\u003eistio transparent traffic capture\u003c/td\u003e\n    \u003ctd\u003enot al net traffic will not be capture\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003eoverly broad hosts\u003c/td\u003e\n    \u003ctd\u003eavoid overly broad hosts settings in Gateway\u003c/td\u003e\n    \u003ctd\u003emay cause potential exposure of unexpected domains\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003eRestrict Gateway creation privileges\u003c/td\u003e\n    \u003ctd\u003erestrict creation of Gateway resources to trusted cluster administrators\u003c/td\u003e\n    \u003ctd\u003emay cause  creation of gateway by untrusted users\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003eConfigure a limit on downstream connections\u003c/td\u003e\n    \u003ctd\u003eUpdate global_downstream_max_connections in the config map according to the number of concurrent connections needed by individual gateway instances in your deployment. Once the limit is reached, Envoy will start rejecting tcp connections\u003c/td\u003e\n    \u003ctd\u003eno limit on the number of downstream connections can cause exploited by a malicious actor\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003eConfigure third party service account tokens\u003c/td\u003e\n    \u003ctd\u003eIt is recommended to configure 3rd party tokens Because the properties of the first party token are less secure\u003c/td\u003e\n    \u003ctd\u003efirst party token properties are less secure and might cause authentication breach\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003eControl Plane\u003c/td\u003e\n    \u003ctd\u003eIstiod exposes a few unauthenticated plaintext ports for convenience by default\u003c/td\u003e\n    \u003ctd\u003eexposes the XDS service port 15010 and debug port 8080 over unauthenticated  plaintext\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003eData Plane\u003c/td\u003e\n    \u003ctd\u003eThe proxy exposes a variety of ports\u003c/td\u003e\n    \u003ctd\u003eThe applications running in the same pod as the proxy have access; there is no trust boundary between the sidecar and application\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n    \u003ctd\u003eUnderstand traffic capture limitations\u003c/td\u003e\n    \u003ctd\u003eSecuring egress traffic by setting the meshConfig.outboundTrafficPolicy.mode \u003c/td\u003e\n    \u003ctd\u003eexternal service access will not be controlled\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/table\u003e\n\n## User Plugin Usage (via go plugins)\nThe Kube-kridik expose a hook for user plugins [Example](https://github.com/chen-keinan/mesh-kridik/tree/master/examples/plugins) :\n- **MeshSecurityCheckResultHook** - this hook accepts k8s service mesh security checks results\n\n##### Compile user plugin\n```shell\ngo build -buildmode=plugin -o=~/\u003cplugin folder\u003e/\u003cplugin\u003e.so ~/\u003cplugin folder\u003e/\u003cplugin\u003e.go\n```\n##### Copy plugin to folder (.kube-kridik folder is created on the 1st startup)\n```shell\ncp ~/\u003cplugin folder\u003e/\u003cplugin\u003e.so ~/.kube-kridik/plugins/compile/\u003cplugin\u003e.so\n```\n## Supported Spec\nThe Kube-kridik support this specifications and can be easily extended:\n- The full Istio service mesh best practices [istio security best practices](https://github.com/chen-keinan/mesh-kridik/tree/master/internal/security/mesh/istio)\n\nthis specs can be easily extended by amended the spec files under ```~/.mesh-kridik/security/mesh/istio``` folder\n\n## Contribution\n- code contribution is welcome !! , contribution with tests and passing linter is more than welcome :)\n- /.dev folder include vagrantfile to be used for development : [Dev Instruction](https://github.com/chen-keinan/mesh-kridik/tree/master/.dev)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchen-keinan%2Fmesh-kridik","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fchen-keinan%2Fmesh-kridik","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fchen-keinan%2Fmesh-kridik/lists"}