Grype is a command-line security scanner designed to identify known vulnerabilities within container images, filesystems, and software manifests. It functions as a software composition analysis tool that detects security flaws in application components and open-source libraries to support supply chain security. The tool distinguishes itself by reconstructing the final state of container images through layered filesystem inspection and normalizing diverse package formats into a unified dependency graph. It maintains a local cache of security advisories synchronized from multiple upstream sourc
Ansible-lint is a static analysis tool and YAML scanner designed to enforce coding standards and best practices for Ansible playbooks. It functions as a linter and automated fixer that identifies suboptimal patterns and behavioral errors within infrastructure-as-code configuration files. The project provides capabilities for automated linting correction, allowing it to programmatically fix common styling and behavioral issues. It also includes pre-configured pipeline actions for integrating these validation checks into continuous integration workflows. The tool utilizes abstract syntax tree
Trivy is a comprehensive security scanner designed to identify vulnerabilities and misconfigurations across container images, filesystems, and infrastructure as code files. It functions as a software composition analysis tool and an infrastructure security scanner, providing automated checks for CI/CD pipelines and cloud environments to ensure the integrity of the software supply chain. The tool distinguishes itself through a modular, plugin-based architecture that allows for the independent inspection of diverse targets. It utilizes a declarative policy engine to evaluate configurations agai
Terrascan is an infrastructure as code security scanner and cloud configuration auditor designed to detect security violations and compliance risks in cloud templates and Dockerfiles before provisioning. It utilizes the Open Policy Agent to evaluate infrastructure templates against both standard security policies and custom organizational rules. The project functions as a security guardrail within build pipelines, blocking risky deployments by integrating scanning logic directly into CI/CD workflows. It also includes a container registry vulnerability scanner that collects vulnerability data
This is a kubectl plugin for scanning Kubernetes pods, deployments, daemonsets and statefulsets with kubesec.io. By default the plugin will send scan requests to the hosted version of kubesec.io. However, it is also possible to self host the scanning service and use that for scanning instead.
Die Hauptfunktionen von controlplaneio/kubectl-kubesec sind: Infrastructure as Code Analysis.
Open-Source-Alternativen zu controlplaneio/kubectl-kubesec sind unter anderem: anchore/grype — Grype is a command-line security scanner designed to identify known vulnerabilities within container images,… ansible-community/ansible-lint — Ansible-lint is a static analysis tool and YAML scanner designed to enforce coding standards and best practices for… aquasecurity/trivy — Trivy is a comprehensive security scanner designed to identify vulnerabilities and misconfigurations across container… bridgecrewio/checkov — Checkov is a static analysis tool and security scanner designed to identify misconfigurations in infrastructure as… checkmarx/kics — Find security vulnerabilities, compliance issues, and infrastructure misconfigurations early in the development cycle… accurics/terrascan — Terrascan is an infrastructure as code security scanner and cloud configuration auditor designed to detect security…