Security Overlays

Domestic information security solutions with proven compatibility.

Introduction #

In addition to built-in tools (Trivy, Kyverno), the Shturval platform supports overlaid security features. Such tools can be installed as separate services in a cluster and complement the built-in functionality:

• in-depth analysis of images and containers;
• control of configurations and security policies;
• compliance with industry and regulatory requirements.

The connection is made through marketplace of partner products or according to the instructions of the information security tool provider. Below is a brief overview of products with confirmed compatibility.

Working with repositories and the charts catalog in the GUI: Overview of working with services and repositories, Connecting your repository, How to deploy a new service (including marketplace scenarios for partners when connecting their repository).

Positive Technologies Container Security (PT CS) #

Positive Technologies Container Security (PT CS) provides security:

• container images;
• running containers and their configurations;
• image repositories;
• node operating systems.

For more information about PT CS capabilities and integration, see the official Positive Technologies documentation (PT CS help portal and installation guide using the update server).

To integrate PT CS with the Shturval platform you need:

• valid PT CS license;
• credentials for access to the Helm repository PT CS (repository address, login, password/token).

The installation is performed by connecting a third-party Helm repository and installing the chart into the target cluster (according to the supplier’s instructions). After installation, PT CS can be used as an additional tool for checking container images and configurations for vulnerabilities and non-compliance with security requirements.

Kaspersky Container Security (KCS) #

Kaspersky Container Security (KCS) is a security overlay for Kubernetes that helps identify security issues at all stages of the containerized application lifecycle, from development to production.

Integration of KCS with the Shturval platform is carried out through marketplace of partner products:

1. Open the Services and repositories → Product Marketplace section in the cluster GUI.
2. Select the Kaspersky product and click Add.
3. In the modal window, specify:
   • Username and Password to access the private repositoryHelm Kaspersky software (or mirror);
   • URL of the repository (by default - the public repository of the product; when using a mirror, replace it with the mirror address).
4. Confirm the repository connection.

After successful connection:

• on the Available charts tab, enter kcs and check the version;
• select the proposed chart version and proceed to installation;
• in the installation wizard, select the version and complete the installation of Kaspersky Container Security.

Installed KCS services continue to work regardless of further changes in the repository connection settings; disabling the repository only affects the availability of charts, and not the already deployed components.

Luntry #

Luntry is a comprehensive security tool for containers and Kubernetes that:

• provides a high level of visibility and control of process safety;
• helps to create an infrastructure without “blind spots”;
• simplifies the interaction of IT and information security teams even in large projects.

Luntry integration is also performed through partner product marketplace:

1. In the Product Marketplace section, select the Luntry product and click Add.
2. Set up a connection to the product repository (if necessary, access to a private repository).
3. Connect the repository.

The following are two options:

• immediately select and install Luntry charts in the Available charts tab in the product modal window;
• or complete the connection without installation, and then install the charts later:
  • either on the luntry tab of the Available charts page;
  • or in the modal window for managing the Luntry product (the Manage button on the marketplace page).

Installed Luntry services continue to run when the repository configuration changes; disabling the repository only affects the availability of charts, but does not disable already deployed resources.