Kubescape CLI

Docker Hardened Image

Kubescape is an open-source Kubernetes security platform designed to provide practical, end-to-end security for Kubernetes environments. It supports engineers and operators throughout the development and deployment lifecycle, offering tools for configuration scanning, vulnerability assessment, policy enforcement, network policy and seccomp validation, and runtime threat detection.

Trivy Operator Helm chart

Docker Hardened Image

Kubernetes-native security toolkit that leverages Trivy to continuously scan your Kubernetes cluster for security issues.

Kyverno Helm chart

Docker Hardened Image

Kyverno is a Kubernetes Native Policy Management engine.

Harbor Registry

Docker Hardened Image

Docker Distribution registry for storing and distributing container images within Harbor

Kyverno Readiness Checker

Docker Hardened Image

Kyverno Readiness Checker is a component that checks the readiness of a Kyverno installation

Syft

Docker Hardened Image

Syft is a CLI tool and Go library for generating Software Bill of Materials (SBOM) from container images and filesystems with support for multiple output formats and package ecosystems.

Grype

Docker Hardened Image

Grype is a vulnerability scanner for container images and filesystems. It provides fast and accurate vulnerability detection with support for multiple package ecosystems and output formats.

Dex

Docker Hardened Image

OpenID Connect (OIDC) identity and OAuth 2.0 provider with pluggable connectors

Istioctl

Docker Hardened Image

Istioctl image for managing Istio deployments

TruffleHog

Docker Hardened Image

TruffleHog is a secrets scanning tool that finds credentials, API keys, and sensitive data in git repositories, filesystems, S3 buckets, and more. Written in Go.

Cilium DNS Proxy

Docker Hardened Image

Cilium Standalone DNS Proxy is an alpha component that provides independent DNS proxying capabilities, receiving policy rules from the Cilium agent via gRPC.

Open Policy Agent

Docker Hardened Image

OPA is a policy engine that streamlines policy management across your stack for improved development, security and audit capability.

Vault Helm chart

Docker Hardened Image

Vault is a tool for securely accessing secrets.

OpenFGA

Docker Hardened Image

OpenFGA is an open source Fine Grained Authorization solution that implements Google's Zanzibar paper, helping you manage complex authorization rules in your applications.

Istio Base Helm chart

Docker Hardened Image

This chart installs resources shared by all Istio revisions. This includes Istio CRDs.

kube-mgmt

Docker Hardened Image

Sidecar for managing OPA instances in Kubernetes.

Trivy Operator

Docker Hardened Image

Kubernetes-native security toolkit that leverages Trivy to continuously scan your Kubernetes cluster for security issues.

notation

Docker Hardened Image

Notation is a CLI tool for signing and verifying OCI artifacts with trust policies and plugin-based key management.

Gatekeeper

Docker Hardened Image

Policy Controller for Kubernetes, built on Open Policy Agent.

SonarQube

Docker Hardened Image

SonarQube is a self-managed, automatic code review tool that systematically helps you deliver clean code.

Tailscale

Docker Hardened Image

Tailscale lets you securely connect devices and containers without exposing them to the public internet.

AWS EKS Pod Identity Agent

Docker Hardened Image

The AWS EKS Pod Identity Agent runs on Amazon EKS nodes and exchanges Kubernetes service account tokens for temporary AWS IAM credentials, providing pods with IAM roles without using IRSA or instance profiles.

OAuth2 Proxy Helm chart

Docker Hardened Image

A reverse proxy that provides authentication using OAuth2 and OIDC providers.

trust-manager

Docker Hardened Image

cert-manager trust-manager manages trust bundles in Kubernetes and OpenShift clusters

Keycloak Helm chart

Docker Hardened Image

Keycloak is a high performance Java-based identity and access management solution. It lets developers add an authentication layer to their applications with minimum effort.

Gitleaks

Docker Hardened Image

Gitleaks is a SAST tool for detecting and preventing hardcoded secrets like passwords, API keys, and tokens in git repos. Written in Go.

APISIX

Docker Hardened Image

Apache APISIX is a dynamic, real-time, high-performance API Gateway.

Polaris

Docker Hardened Image

Polaris is an open source policy engine for Kubernetes that validates and remediates resource configuration. It includes 30+ built in configuration policies, as well as the ability to build custom policies with JSON Schema. When run on the command line or as a mutating webhook, Polaris can automatically remediate issues based on policy criteria.

Certbot

Docker Hardened Image

EFF's ACME client for obtaining and renewing TLS certificates from Let's Encrypt and any ACME-compatible CA.

node-collector

Docker Hardened Image

node-collector gathers file system and process information from Kubernetes cluster nodes for CIS benchmark compliance checking.