Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done. लक्षित पाठक: Platform engineers, Kubernetes administrators, security engineers. सामान्य सेटअप समय: 2 minutes.
Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done.
एक प्रारंभिक सेटअप कॉपी करें, इसे अपने परिवेश में चलाएं, फिर गहन रोलआउट विवरण के लिए यहां वापस आएं।
Demonstration only
This configuration is designed for ease of use. To deploy scanner clients at scale, please plan your deployment architecture accordingly or contact us for enterprise best practices.
Download the exact source files referenced on this page, or run the one-command installer to write them locally before following the deployment steps.
Creates `deploy/helm/blackshield-k8s-scanner/` locally with the current platform API URL prefilled so you can inspect, modify, and install the chart from source.
BLACKSHIELD_K8S_IMAGE=public.ecr.aws/blackshield-security/k8s-scanner:1.0.13 \
BLACKSHIELD_SITE_URL=https://blackshield.chaplau.com \
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)
cd deploy/helm/blackshield-k8s-scannerCreates a Git-based Argo CD ApplicationSet manifest with the current platform API URL prefilled so multi-cluster rollout can track the chart source in your GitOps repository.
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-argocd.sh)# Create namespace and secret
kubectl create namespace blackshield
kubectl create secret generic blackshield-k8s-scanner \
--namespace blackshield \
--from-literal=api-key=sp_xxxx
# Bootstrap the local chart source from the guide first
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)
# Optional for local k3s clusters:
# --set env.KUBE_BENCH_BENCHMARK=cis-1.6-k3s
# Install chart — scans every 6 hours
helm upgrade --install blackshield-k8s-scanner ./deploy/helm/blackshield-k8s-scanner \
--namespace blackshield \
--set existingSecret.name=blackshield-k8s-scanner \
--set existingSecret.key=api-key \
--set scanIntervalSeconds=21600 \
--waitapiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
name: blackshield-k8s-scanner
namespace: argocd
spec:
generators:
- clusters: {} # all registered clusters
template:
metadata:
name: "blackshield-k8s-scanner-{{name}}"
spec:
project: default
source:
repoURL: https://github.com/acme/platform-deployments.git
targetRevision: main
path: deploy/helm/blackshield-k8s-scanner
helm:
valuesObject:
env:
BLACKSHIELD_API_URL: "https://api.blackshield.chaplau.com"
existingSecret:
name: blackshield-k8s-scanner
key: api-key
scanIntervalSeconds: 21600
destination:
server: "{{server}}"
namespace: blackshield
syncPolicy:
automated: { prune: true, selfHeal: true }
syncOptions: [CreateNamespace=true]जब आप रोलआउट को अनुकूलित करना चाहते हैं, स्वामित्व को मान्य करना चाहते हैं या परिनियोजन का सुरक्षित रूप से विस्तार करना चाहते हैं, तो नीचे दिए गए चरणों का उपयोग करें।
चरण 1
Store the API key in a Kubernetes Secret, then pull the chart source locally so the generated values already point at your deployed platform.
सफलता कैसी दिखती है
Review `values.yaml` before the first install so any scan cadence or resource overrides are intentional.
चरण 2
Choose Deployment mode (internal loop) or CronJob mode (Kubernetes schedule) and install directly from the local chart source.
सफलता कैसी दिखती है
NetworkPolicy restricts egress to port 443 only and the chart mounts a writable /tmp scratch volume for scanner caches while keeping the root filesystem read-only.
चरण 3
Use Argo CD ApplicationSet or Flux HelmRelease to deploy to every cluster from one place.
सफलता कैसी दिखती है
Verify health: kubectl port-forward svc/blackshield-k8s-scanner 8080:8080 -n blackshield && curl localhost:8080/health
Keep your rollout moving with the next recommended step.
अपनी पहली फाइंडिंग्स इनजेस्ट करें