Skip to content

Commit

Permalink
Add acknowledgments
Browse files Browse the repository at this point in the history
  • Loading branch information
christophetd committed Jun 1, 2023
1 parent 2f0fc3f commit 283eb7a
Showing 1 changed file with 11 additions and 1 deletion.
12 changes: 11 additions & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -119,7 +119,9 @@ $ mkat eks test-imds-access
2023/04/12 00:35:15 IMDS is accessible and allows any pod to retrieve credentials for the AWS role eksctl-mkat-cluster-nodegroup-ng-NodeInstanceRole-AXWUFF35602Z
```
## How does MKAT compare to other tools?
## FAQ
### How does MKAT compare to other tools?
| **Tool** | **Description** |
|:---:|:---:|
Expand All @@ -132,10 +134,18 @@ $ mkat eks test-imds-access
| [kubeletmein](https://github.com/4ARMED/kubeletmein) | kubeletmein _is_ specific to managed K8s environments. It's an utility to generate a kubeconfig file using the node's IAM credentials, to then use it in a compromised pod. |
| [hardeneks](https://github.com/aws-samples/hardeneks) | hardeneks _is_ specific to managed K8s environments, but only for EKS. It identifies issues and lack of best practices inside of the cluster, and does not focus on cluster to cloud pivots. |
### What permissions does MKAT need to run?
See [this page](./permissions.md) for a detailed list of the permissions MKAT needs to run.
## Roadmap
We currently plan to:
* Add a feature to identify EKS pods that are exposed through an AWS load balancer, through the [aws-load-balancer-controller](https://github.com/kubernetes-sigs/aws-load-balancer-controller)
* Add support for GCP GKE
* Allow scanning for additional types of cloud credentials
* Enhance the IAM role trust policy evaluation logic to take into account additional edge cases
## Acknowledgements
Thank you to Rami McCarthi and Mikail Tunç for their early testing and actionable feedback on MKAT!

0 comments on commit 283eb7a

Please sign in to comment.