Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done. الجمهور: Platform engineers, Kubernetes administrators, security engineers. وقت الإعداد المعتاد: 2 minutes.
Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done.
انسخ إعداد البداية وقم بتشغيله في بيئتك، ثم عد إلى هنا للحصول على تفاصيل التوزيع الأكثر عمقًا.
Demonstration only
This configuration is designed for ease of use. To deploy scanner clients at scale, please plan your deployment architecture accordingly or contact us for enterprise best practices.
Download the exact source files referenced on this page, or run the one-command installer to write them locally before following the deployment steps.
Creates `deploy/helm/blackshield-k8s-scanner/` locally with the current platform API URL prefilled so you can inspect, modify, and install the chart from source.
BLACKSHIELD_K8S_IMAGE=public.ecr.aws/blackshield-security/k8s-scanner:1.0.13 \
BLACKSHIELD_SITE_URL=https://blackshield.chaplau.com \
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)
cd deploy/helm/blackshield-k8s-scannerCreates a Git-based Argo CD ApplicationSet manifest with the current platform API URL prefilled so multi-cluster rollout can track the chart source in your GitOps repository.
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-argocd.sh)# Create namespace and secret
kubectl create namespace blackshield
kubectl create secret generic blackshield-k8s-scanner \
--namespace blackshield \
--from-literal=api-key=sp_xxxx
# Bootstrap the local chart source from the guide first
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)
# Optional for local k3s clusters:
# --set env.KUBE_BENCH_BENCHMARK=cis-1.6-k3s
# Install chart — scans every 6 hours
helm upgrade --install blackshield-k8s-scanner ./deploy/helm/blackshield-k8s-scanner \
--namespace blackshield \
--set existingSecret.name=blackshield-k8s-scanner \
--set existingSecret.key=api-key \
--set scanIntervalSeconds=21600 \
--waitapiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
name: blackshield-k8s-scanner
namespace: argocd
spec:
generators:
- clusters: {} # all registered clusters
template:
metadata:
name: "blackshield-k8s-scanner-{{name}}"
spec:
project: default
source:
repoURL: https://github.com/acme/platform-deployments.git
targetRevision: main
path: deploy/helm/blackshield-k8s-scanner
helm:
valuesObject:
env:
BLACKSHIELD_API_URL: "https://api.blackshield.chaplau.com"
existingSecret:
name: blackshield-k8s-scanner
key: api-key
scanIntervalSeconds: 21600
destination:
server: "{{server}}"
namespace: blackshield
syncPolicy:
automated: { prune: true, selfHeal: true }
syncOptions: [CreateNamespace=true]استخدم الخطوات الإرشادية أدناه عندما ترغب في تخصيص التوزيع أو التحقق من الملكية أو توسيع النشر بأمان.
الخطوة 1
Store the API key in a Kubernetes Secret, then pull the chart source locally so the generated values already point at your deployed platform.
معايير النجاح
Review `values.yaml` before the first install so any scan cadence or resource overrides are intentional.
الخطوة 2
Choose Deployment mode (internal loop) or CronJob mode (Kubernetes schedule) and install directly from the local chart source.
معايير النجاح
NetworkPolicy restricts egress to port 443 only and the chart mounts a writable /tmp scratch volume for scanner caches while keeping the root filesystem read-only.
الخطوة 3
Use Argo CD ApplicationSet or Flux HelmRelease to deploy to every cluster from one place.
معايير النجاح
Verify health: kubectl port-forward svc/blackshield-k8s-scanner 8080:8080 -n blackshield && curl localhost:8080/health
Keep your rollout moving with the next recommended step.
استيعاب أولى النتائج