mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
45 lines
1.8 KiB
Markdown
45 lines
1.8 KiB
Markdown
# Standards and References - Kubesec Manifest Scanning
|
|
|
|
## Industry Standards
|
|
|
|
### CIS Kubernetes Benchmark v1.9
|
|
- Section 5.2: Pod Security Standards -- Kubesec validates privileged mode, host namespaces
|
|
- Section 5.7: General Policies -- Service account configuration, resource limits
|
|
- Maps directly to kubesec scoring checks for container security contexts
|
|
|
|
### NIST SP 800-190: Application Container Security Guide
|
|
- Section 3.1: Image vulnerabilities and configuration defects
|
|
- Section 3.4: Orchestrator security -- manifest validation before deployment
|
|
- Section 4.1: Countermeasures for image vulnerabilities
|
|
|
|
### Kubernetes Pod Security Standards (PSS)
|
|
- **Privileged**: No restrictions (kubesec score = lowest)
|
|
- **Baseline**: Prevents known privilege escalation (kubesec validates hostPID, hostNetwork, privileged)
|
|
- **Restricted**: Best practices enforcement (kubesec validates all recommended controls)
|
|
|
|
## Compliance Mapping
|
|
|
|
| Kubesec Check | CIS Control | NIST 800-190 | PCI DSS |
|
|
|---------------|-------------|--------------|---------|
|
|
| Privileged containers | 5.2.1 | 3.4.4 | 2.2 |
|
|
| Host PID namespace | 5.2.2 | 3.4.2 | 2.2 |
|
|
| Host network | 5.2.4 | 3.4.3 | 1.3 |
|
|
| Root execution | 5.2.6 | 3.4.1 | 7.1 |
|
|
| ReadOnlyRootFilesystem | 5.2.8 | 4.1.2 | 2.2 |
|
|
| Resource limits | 5.4.1 | 4.3.1 | 2.2 |
|
|
| Service accounts | 5.1.5 | 3.4.5 | 7.2 |
|
|
|
|
## Tool Ecosystem
|
|
|
|
### Complementary Scanning Tools
|
|
- **Kubescape**: NSA/CISA framework compliance scanning
|
|
- **Checkov**: Infrastructure-as-code security scanning (covers Kubernetes)
|
|
- **Datree**: Policy enforcement with custom rules
|
|
- **OPA/Gatekeeper**: Runtime policy enforcement as admission controller
|
|
|
|
### Integration Points
|
|
- Pre-commit hooks for developer feedback
|
|
- CI/CD pipeline gates to prevent insecure deployments
|
|
- Admission webhooks for runtime enforcement
|
|
- IDE plugins for shift-left security
|