Getting Started with Kubernetes

​

Prowler Cloud

​

Step 1: Access Prowler Cloud or Prowler Local Server

1. Navigate to Prowler Cloud or launch Prowler Local Server
2. Go to “Configuration” > “Providers”
3. Click “Add Provider”
4. Select “Kubernetes”
5. Enter your Kubernetes Cluster context from your kubeconfig file and optionally provide a friendly alias

​

Step 2: Configure Kubernetes Authentication

​

Step 3: Additional Setup for EKS, GKE, AKS, or External Clusters

1. Apply the necessary Kubernetes resources to your EKS, GKE, AKS or external cluster (you can find the files in the kubernetes directory of the Prowler repository):
   kubectl apply -f kubernetes/prowler-sa.yaml
   kubectl apply -f kubernetes/prowler-role.yaml
   kubectl apply -f kubernetes/prowler-rolebinding.yaml
   
2. Generate a long-lived token for authentication:
   kubectl create token prowler-sa -n prowler-ns --duration=0
   
   • Security Note: The --duration=0 option generates a non-expiring token, which may pose a security risk if not managed properly. Choose an appropriate expiration time based on security policies. For a limited-time token, set --duration=<TIME> (e.g., --duration=24h).
   Important: If the token expires, Prowler Cloud can no longer authenticate with the cluster. Generate a new token and remove and re-add the provider in Prowler Cloud with the updated kubeconfig.
   Token Expiration LimitsWhen the Kubernetes cluster has --service-account-max-token-expiration configured, any token requested with a duration exceeding the maximum allowed value (including --duration=0) is automatically reduced to the cluster’s maximum token expiration time. As an alternative solution, create a legacy Secret manually. Although Kubernetes no longer creates these secrets automatically, manual creation and linking to a ServiceAccount is still supported. These tokens do not expire until the secret or ServiceAccount is deleted.Steps:

   1. Create a secret-sa.yaml file (or any preferred name) with the following content:
      apiVersion: v1
      kind: Secret
      metadata:
        name: prowler-token-long-lived
        namespace: prowler-ns
        annotations:
          kubernetes.io/service-account.name: "prowler-sa"
      type: kubernetes.io/service-account-token
      
   2. Apply the secret:
      kubectl apply -f secret-sa.yaml
      
   3. Retrieve the token (which will be permanent):
      kubectl get secret prowler-token-long-lived -n prowler-ns -o jsonpath='{.data.token}' | base64 --decode
      
3. Update your kubeconfig to use the ServiceAccount token:
   kubectl config set-credentials prowler-sa --token=<SA_TOKEN>
   kubectl config set-context <CONTEXT_NAME> --user=prowler-sa
   
   Replace <SA_TOKEN> with the generated token and <CONTEXT_NAME> with your KubeConfig Context Name of your EKS, GKE or AKS cluster.
4. Add the modified kubeconfig in Prowler Cloud and test the connection.

​

Prowler CLI

​

Non In-Cluster Execution

prowler kubernetes --kubeconfig-file /path/to/kubeconfig

​

In-Cluster Execution

• prowler-sa.yaml
• job.yaml
• prowler-role.yaml
• prowler-rolebinding.yaml

kubectl apply -f kubernetes/prowler-sa.yaml
kubectl apply -f kubernetes/job.yaml
kubectl apply -f kubernetes/prowler-role.yaml
kubectl apply -f kubernetes/prowler-rolebinding.yaml
kubectl get pods --namespace prowler-ns --> prowler-XXXXX
kubectl logs prowler-XXXXX --namespace prowler-ns

prowler -p kubernetes --cluster-name production-cluster

env:
    - name: CLUSTER_NAME
      value: production-cluster