ataidesorg/kubectl

By ataidesorg

•Updated 5 months ago

Hardened kubectl, kustomize, and helm for Kubernetes ops

Image

Security

Integration & delivery

Developer tools

1.3K

Overview Tags

ataidesorg/kubectl repository overview

⁠kubectl Hardened Images

Security-hardened kubectl, kustomize, and helm container images implementing enterprise security best practices for Kubernetes command-line operations and CI/CD pipelines.

⁠Quick Start

# Use latest version
docker pull ataidesorg/kubectl:latest
docker run --rm -it -v ~/.kube:/home/kubectl/.kube:ro ataidesorg/kubectl:latest version

# Use specific version
docker pull ataidesorg/kubectl:1.33.8
docker run --rm -it -v ~/.kube:/home/kubectl/.kube:ro ataidesorg/kubectl:1.33.8 get pods

# Use in CI/CD pipeline
docker run --rm -v $PWD:/workspace -w /workspace \
  -v ~/.kube:/home/kubectl/.kube:ro \
  ataidesorg/kubectl:latest apply -f deployment.yaml

# Interactive kubectl shell
docker run --rm -it -v ~/.kube:/home/kubectl/.kube:ro \
  --entrypoint sh ataidesorg/kubectl:latest

⁠What's Hardened

⁠System Security

Non-root execution (UID/GID 1001)
Rocky Linux 10 hardened base image
Minimal package footprint
Secure file permissions (restrictive umask 077)
No setuid/setgid binaries
Essential Kubernetes tools only

⁠Network Security

TLS certificate validation enforced
Secure kubectl configuration handling
No unnecessary network tools
Clean network namespace isolation
Minimal attack surface for network-based exploits

⁠Container Security

Hardened Rocky Linux base with security patches
Read-only root filesystem compatible
Security context optimized
Capability dropping supported
No privilege escalation paths

⁠Supply Chain Security

All binaries downloaded with SHA256 checksum verification
Pinned tool versions (no curl | bash from master)
Multi-stage security hardened build
Container image signing ready
Transparent build process

⁠Available Tools

⁠Core Kubernetes Tools

kubectl v1.35.x: Official Kubernetes command-line tool
kustomize v5.8.1: Kubernetes native configuration management
helm v4.1.1: Kubernetes package manager

⁠Included Utilities

File Operations: Standard Linux file utilities for manifest processing
Text Processing: grep, sed, sort, cut, awk for YAML/JSON manipulation
Archive Tools: tar, gzip for backup and deployment operations
Shell Environment: bash, sh for scripting and automation

⁠Excluded for Security

Development Tools: Compilers, interpreters, package managers
Network Debugging: ping, telnet, netstat, ss
System Administration: su, sudo, systemctl
Dangerous Tools: System modification utilities

⁠Compliance Standards

All kubectl hardened images meet:

DISA STIG: Container security implementation guide controls
CIS Benchmarks: Center for Internet Security container benchmarks
NIST 800-190: Container security guidelines
NIST 800-53: National Institute of Standards cybersecurity framework
Common Criteria: Enterprise security requirements

⁠Security Controls Implemented

⁠Container Security (High Priority)

Non-privileged user execution (UID 1001)
Hardened Rocky Linux base with security updates
No privilege escalation mechanisms
Secure file permissions throughout
Read-only filesystem compatibility

⁠Access Control (Medium Priority)

No administrative tools or user management
Restricted command set (Kubernetes tools only)
Proper user/group configuration
Session security controls
Secure kubectl configuration handling

⁠Supply Chain (High Priority)

Verified kubectl binary download with SHA256 checksums
Cryptographic signature validation
Multi-stage build with security validation
Minimal dependencies
Container image attestation ready
Transparent build process

⁠Enterprise Features

⁠CI/CD Integration

# GitHub Actions example
- name: Deploy to Kubernetes
  run: |
    docker run --rm \
      -v ${{ github.workspace }}:/workspace \
      -v ${{ runner.temp }}/kubeconfig:/home/kubectl/.kube:ro \
      -w /workspace \
      ataidesorg/kubectl:latest \
      apply -f k8s/

# GitLab CI example
deploy:
  image: ataidesorg/kubectl:latest
  script:
    - kubectl version --client
    - kubectl apply -f deployment/
  only:
    - main

⁠Kubernetes Operations

# Secure cluster operations
docker run --rm -it \
  -v ~/.kube:/home/kubectl/.kube:ro \
  --user 1001:1001 \
  --read-only \
  --security-opt no-new-privileges \
  ataidesorg/kubectl:latest \
  get pods --all-namespaces

# Resource management
docker run --rm \
  -v $PWD/manifests:/manifests:ro \
  -v ~/.kube:/home/kubectl/.kube:ro \
  --user 1001:1001 \
  --read-only \
  ataidesorg/kubectl:latest \
  apply -f /manifests/

# Configuration management with Kustomize
docker run --rm \
  -v $PWD:/workspace \
  -v ~/.kube:/home/kubectl/.kube:ro \
  --user 1001:1001 \
  -w /workspace \
  ataidesorg/kubectl:latest \
  sh -c "kustomize build overlays/production | kubectl apply -f -"

⁠Debugging and Troubleshooting

# Secure debugging session
docker run --rm -it \
  -v ~/.kube:/home/kubectl/.kube:ro \
  --user 1001:1001 \
  --read-only \
  --security-opt no-new-privileges \
  ataidesorg/kubectl:latest \
  describe pod problematic-pod

# Log analysis
docker run --rm \
  -v ~/.kube:/home/kubectl/.kube:ro \
  --user 1001:1001 \
  --read-only \
  ataidesorg/kubectl:latest \
  logs -f deployment/app --tail=100

⁠Multi-Cluster Management

# Switch between clusters securely
docker run --rm -it \
  -v ~/.kube:/home/kubectl/.kube \
  --user 1001:1001 \
  ataidesorg/kubectl:latest \
  config use-context production

# Cross-cluster resource comparison
docker run --rm \
  -v ~/.kube:/home/kubectl/.kube:ro \
  --user 1001:1001 \
  --read-only \
  ataidesorg/kubectl:latest \
  sh -c "kubectl --context staging get pods -o yaml > /tmp/staging.yaml && kubectl --context production get pods -o yaml > /tmp/production.yaml"

⁠Building Locally

# Clone repository
git clone https://github.com/ataidesorg/container-images.git
cd container-images

# Build specific version
python scripts/build.py --filter kubectl --version latest

# Build all kubectl versions
python scripts/build.py --filter kubectl

# Run security validation
docker run --rm ataidesorg/kubectl:latest version --client
docker run --rm ataidesorg/kubectl:latest id

⁠Configuration Options

⁠Environment Variables

Variable	Default	Description
`HOME`	`/home/kubectl`	User home directory
`KUBECONFIG`	`$HOME/.kube/config`	Kubernetes config file path
`PATH`	`/usr/local/bin:/usr/bin:/bin`	Executable search path
`SHELL`	`/bin/bash`	Default shell

⁠Volume Mounts

# Recommended volume mounts
docker run --rm -it \
  -v ~/.kube:/home/kubectl/.kube:ro \      # Kubernetes config (read-only)
  -v $PWD:/workspace:ro \                  # Workspace files (read-only)
  -v /tmp:/tmp \                           # Temporary files
  --user 1001:1001 \
  ataidesorg/kubectl:latest

⁠Security Contexts

# Recommended security context for Kubernetes Jobs
apiVersion: batch/v1
kind: Job
metadata:
  name: kubectl-job
spec:
  template:
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1001
        runAsGroup: 1001
        fsGroup: 1001
      containers:
      - name: kubectl
        image: ataidesorg/kubectl:latest
        securityContext:
          readOnlyRootFilesystem: true
          allowPrivilegeEscalation: false
          capabilities:
            drop: ["ALL"]
        volumeMounts:
        - name: kubeconfig
          mountPath: /home/kubectl/.kube
          readOnly: true
        - name: tmp
          mountPath: /tmp
      volumes:
      - name: kubeconfig
        secret:
          secretName: kubeconfig
      - name: tmp
        emptyDir: {}

# Recommended Docker security options
docker run --rm \
  --user 1001:1001 \
  --read-only \
  --tmpfs /tmp:noexec,nosuid,nodev \
  --security-opt no-new-privileges \
  --cap-drop ALL \
  -v ~/.kube:/home/kubectl/.kube:ro \
  ataidesorg/kubectl:latest

⁠License

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0⁠

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.

⁠Security

If you discover a security vulnerability do not open a public issue, instead send an email to [email protected]

⁠Support

For enterprise support, training, and custom hardening requirements, contact [email protected]

Ataides - Forging the future of cybersecurity through open-source innovation.

Tag summary

Recent tags

Content type

Image

Digest

sha256:d8c9ca1ce…

Size

896.2 kB

Last updated

5 months ago

docker pull ataidesorg/kubectl:sha256-5e5593618327d6bab8e83ba4f4b0d4dd570265bb34ecd9f633c560a025c9aff8.att