Koney is a Kubernetes operator that implements so-called “deception policies” to discover and deter malicious users. Currently, it supports honeytokens as the only deception method by:
- creating fake “sensitive” files, such as
/run/secrets/koney/service_token, in all selected Pods;- monitoring the attempts to access them by collecting alerts from the Cilium’s Tetragon operator or via a smaller eBPF-powered file access monitoring tool (
kivebpf);- logging these events and, optionally, sending alerts to external systems (currently, it supports only Dynatrace).
Future project plans include adding other deceptive techniques (HTTP endpoints and payloads) and integrating the operator with Kyverno policies.
▶️ GitHub repo
Language: Go | License: AGPL 3.0 | 89 ⭐️
#tools #security