Guía pública

Deploy the Kubernetes Scanner

Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done. Audiencia: Platform engineers, Kubernetes administrators, security engineers. Tiempo típico de configuración: 2 minutes.

quickstart

Úsalo si

Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done.

Audience: Platform engineers, Kubernetes administrators, security engineersTypical time: 2 minutes

Antes de comenzar

  • Install Helm ≥ 3.14: brew install helm
  • Confirm kubectl is configured for the target cluster.
  • Create an ingestion API key in Settings → API Keys with Ingestion scope.

Camino rápido

Copy a working starter, run it in your environment, then come back here for the deeper rollout details.

Solo demostración

Esta configuración está diseñada para facilitar el uso. Para desplegar clientes de escaneo a escala, planifique su arquitectura de despliegue en consecuencia o contáctenos para obtener las mejores prácticas empresariales.

Obtén el bundle de código fuente

Descarga los archivos exactos usados en esta guía o ejecuta el instalador de un solo comando para escribirlos localmente antes del despliegue.

Helm chart source

Creates `deploy/helm/blackshield-k8s-scanner/` locally with the current platform API URL prefilled so you can inspect, modify, and install the chart from source.

deploy/helm/blackshield-k8s-scanner/
bash
BLACKSHIELD_K8S_IMAGE=public.ecr.aws/blackshield-security/k8s-scanner:1.0.8 \
BLACKSHIELD_SITE_URL=https://blackshield.chaplau.com \
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)
cd deploy/helm/blackshield-k8s-scanner
Descargar fuente

Argo CD ApplicationSet

Creates a Git-based Argo CD ApplicationSet manifest with the current platform API URL prefilled so multi-cluster rollout can track the chart source in your GitOps repository.

deploy/argocd/k8s-scanner-appset.yaml
bash
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-argocd.sh)
Descargar fuente

Ejecuta esto

Install with Helm (Deployment mode)

bash
# Create namespace and secret
kubectl create namespace blackshield
kubectl create secret generic blackshield-k8s-scanner \
  --namespace blackshield \
  --from-literal=api-key=sp_xxxx

# Bootstrap the local chart source from the guide first
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)

# Optional for local k3s clusters:
# --set env.KUBE_BENCH_BENCHMARK=cis-1.6-k3s

# Install chart — scans every 6 hours
helm upgrade --install blackshield-k8s-scanner ./deploy/helm/blackshield-k8s-scanner \
  --namespace blackshield \
  --set existingSecret.name=blackshield-k8s-scanner \
  --set existingSecret.key=api-key \
  --set scanIntervalSeconds=21600 \
  --wait

GitOps: Argo CD ApplicationSet (all clusters)

yaml
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: blackshield-k8s-scanner
  namespace: argocd
spec:
  generators:
    - clusters: {}   # all registered clusters
  template:
    metadata:
      name: "blackshield-k8s-scanner-{{name}}"
    spec:
      project: default
      source:
        repoURL: https://github.com/acme/platform-deployments.git
        targetRevision: main
        path: deploy/helm/blackshield-k8s-scanner
        helm:
          valuesObject:
            env:
              BLACKSHIELD_API_URL: "https://api.blackshield.chaplau.com"
            existingSecret:
              name: blackshield-k8s-scanner
              key: api-key
            scanIntervalSeconds: 21600
      destination:
        server: "{{server}}"
        namespace: blackshield
      syncPolicy:
        automated: { prune: true, selfHeal: true }
        syncOptions: [CreateNamespace=true]

Entender y personalizar

Use the guided steps below when you want to tailor the rollout, validate ownership, or expand the deployment safely.

1

Paso 1

Create the secret and bootstrap the local chart

Store the API key in a Kubernetes Secret, then pull the chart source locally so the generated values already point at your deployed platform.

  • kubectl create namespace blackshield
  • kubectl create secret generic blackshield-k8s-scanner --namespace blackshield --from-literal=api-key=sp_xxxx
  • Run the source bundle on this page to create `deploy/helm/blackshield-k8s-scanner/` with `BLACKSHIELD_API_URL` prefilled, then run `cd deploy/helm/blackshield-k8s-scanner`.
  • Review `values.yaml` before the first install so any scan cadence or resource overrides are intentional.

Cómo se ve el éxito

Review `values.yaml` before the first install so any scan cadence or resource overrides are intentional.

Open API Keys · Requiere inicio de sesión
2

Paso 2

Install the chart

Choose Deployment mode (internal loop) or CronJob mode (Kubernetes schedule) and install directly from the local chart source.

  • Deployment mode (default): helm upgrade --install blackshield-k8s-scanner . --namespace blackshield --set existingSecret.name=blackshield-k8s-scanner --set existingSecret.key=api-key --set scanIntervalSeconds=21600 --wait
  • CronJob mode: add --set mode=cronjob --set cronSchedule='0 */6 * * *'
  • Local k3s: set env.KUBE_BENCH_BENCHMARK=cis-1.6-k3s if kube-bench cannot infer the benchmark automatically.
  • The chart automatically creates ClusterRole + ClusterRoleBinding with least-privilege read-only access.
  • NetworkPolicy restricts egress to port 443 only and the chart mounts a writable /tmp scratch volume for scanner caches while keeping the root filesystem read-only.

Cómo se ve el éxito

NetworkPolicy restricts egress to port 443 only and the chart mounts a writable /tmp scratch volume for scanner caches while keeping the root filesystem read-only.

All Deployment Guides
3

Paso 3

Scale with GitOps

Use Argo CD ApplicationSet or Flux HelmRelease to deploy to every cluster from one place.

  • Commit the chart source into your GitOps repo before generating the Argo CD manifest so Argo CD can sync from Git.
  • Run the Argo CD source bundle from this guide inside that Git checkout. It auto-detects `origin` and the current branch when possible, and it prefills `BLACKSHIELD_API_URL` from the deployed platform.
  • Argo CD: kubectl apply -f deploy/argocd/k8s-scanner-appset.yaml — deploys to all registered clusters.
  • Flux: apply deploy/flux/k8s-scanner-helmrelease.yaml per cluster or cluster group.
  • Promote new releases by updating the Git revision or chart source in the ApplicationSet and syncing Argo CD.
  • Verify health: kubectl port-forward svc/blackshield-k8s-scanner 8080:8080 -n blackshield && curl localhost:8080/health

Cómo se ve el éxito

Verify health: kubectl port-forward svc/blackshield-k8s-scanner 8080:8080 -n blackshield && curl localhost:8080/health

View Findings · Requiere inicio de sesión

Cómo se ve el éxito

  • helm upgrade --install completes with STATUS: deployed.
  • kubectl get pods -n blackshield shows the scanner pod as Running.
  • curl http://localhost:8080/health (via port-forward) returns status: healthy.
  • Cluster posture findings appear in the platform Findings view.

Continúa

Keep your rollout moving with the next recommended step.

Ingiere tus primeros hallazgos
Deploy the Kubernetes Scanner | Docs de BlackShield