Guida pubblica

Deploy the Kubernetes Scanner

Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done. Pubblico: Platform engineers, Kubernetes administrators, security engineers. Tempo medio di configurazione: 2 minutes.

quickstart

Usa questa guida se

Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done.

Destinatari: Platform engineers, Kubernetes administrators, security engineersTempo stimato: 2 minutes

Prima di iniziare

  • Install Helm ≥ 3.14: brew install helm
  • Confirm kubectl is configured for the target cluster.
  • Create an ingestion API key in Settings → API Keys with Ingestion scope.

Percorso rapido

Copia una configurazione iniziale, eseguila nel tuo ambiente, quindi torna qui per i dettagli di distribuzione approfonditi.

Demonstration only

This configuration is designed for ease of use. To deploy scanner clients at scale, please plan your deployment architecture accordingly or contact us for enterprise best practices.

Get the source bundle

Download the exact source files referenced on this page, or run the one-command installer to write them locally before following the deployment steps.

Helm chart source

Creates `deploy/helm/blackshield-k8s-scanner/` locally with the current platform API URL prefilled so you can inspect, modify, and install the chart from source.

deploy/helm/blackshield-k8s-scanner/
bash
BLACKSHIELD_K8S_IMAGE=public.ecr.aws/blackshield-security/k8s-scanner:1.0.13 \
BLACKSHIELD_SITE_URL=https://blackshield.chaplau.com \
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)
cd deploy/helm/blackshield-k8s-scanner
Download source

Argo CD ApplicationSet

Creates a Git-based Argo CD ApplicationSet manifest with the current platform API URL prefilled so multi-cluster rollout can track the chart source in your GitOps repository.

deploy/argocd/k8s-scanner-appset.yaml
bash
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-argocd.sh)
Download source

Esegui

Install with Helm (Deployment mode)

bash
# Create namespace and secret
kubectl create namespace blackshield
kubectl create secret generic blackshield-k8s-scanner \
  --namespace blackshield \
  --from-literal=api-key=sp_xxxx

# Bootstrap the local chart source from the guide first
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)

# Optional for local k3s clusters:
# --set env.KUBE_BENCH_BENCHMARK=cis-1.6-k3s

# Install chart — scans every 6 hours
helm upgrade --install blackshield-k8s-scanner ./deploy/helm/blackshield-k8s-scanner \
  --namespace blackshield \
  --set existingSecret.name=blackshield-k8s-scanner \
  --set existingSecret.key=api-key \
  --set scanIntervalSeconds=21600 \
  --wait

GitOps: Argo CD ApplicationSet (all clusters)

yaml
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: blackshield-k8s-scanner
  namespace: argocd
spec:
  generators:
    - clusters: {}   # all registered clusters
  template:
    metadata:
      name: "blackshield-k8s-scanner-{{name}}"
    spec:
      project: default
      source:
        repoURL: https://github.com/acme/platform-deployments.git
        targetRevision: main
        path: deploy/helm/blackshield-k8s-scanner
        helm:
          valuesObject:
            env:
              BLACKSHIELD_API_URL: "https://api.blackshield.chaplau.com"
            existingSecret:
              name: blackshield-k8s-scanner
              key: api-key
            scanIntervalSeconds: 21600
      destination:
        server: "{{server}}"
        namespace: blackshield
      syncPolicy:
        automated: { prune: true, selfHeal: true }
        syncOptions: [CreateNamespace=true]

Comprendi e personalizza

Segui i passaggi guidati per adattare il rilascio, convalidare le titolarità ed estendere la distribuzione in sicurezza.

1

Passo 1

Create the secret and bootstrap the local chart

Store the API key in a Kubernetes Secret, then pull the chart source locally so the generated values already point at your deployed platform.

  • kubectl create namespace blackshield
  • kubectl create secret generic blackshield-k8s-scanner --namespace blackshield --from-literal=api-key=sp_xxxx
  • Run the source bundle on this page to create `deploy/helm/blackshield-k8s-scanner/` with `BLACKSHIELD_API_URL` prefilled, then run `cd deploy/helm/blackshield-k8s-scanner`.
  • Review `values.yaml` before the first install so any scan cadence or resource overrides are intentional.

Criteri di successo

Review `values.yaml` before the first install so any scan cadence or resource overrides are intentional.

Open API Keys · Accesso richiesto
2

Passo 2

Install the chart

Choose Deployment mode (internal loop) or CronJob mode (Kubernetes schedule) and install directly from the local chart source.

  • Deployment mode (default): helm upgrade --install blackshield-k8s-scanner . --namespace blackshield --set existingSecret.name=blackshield-k8s-scanner --set existingSecret.key=api-key --set scanIntervalSeconds=21600 --wait
  • CronJob mode: add --set mode=cronjob --set cronSchedule='0 */6 * * *'
  • Local k3s: set env.KUBE_BENCH_BENCHMARK=cis-1.6-k3s if kube-bench cannot infer the benchmark automatically.
  • The chart automatically creates ClusterRole + ClusterRoleBinding with least-privilege read-only access.
  • NetworkPolicy restricts egress to port 443 only and the chart mounts a writable /tmp scratch volume for scanner caches while keeping the root filesystem read-only.

Criteri di successo

NetworkPolicy restricts egress to port 443 only and the chart mounts a writable /tmp scratch volume for scanner caches while keeping the root filesystem read-only.

All Deployment Guides
3

Passo 3

Scale with GitOps

Use Argo CD ApplicationSet or Flux HelmRelease to deploy to every cluster from one place.

  • Commit the chart source into your GitOps repo before generating the Argo CD manifest so Argo CD can sync from Git.
  • Run the Argo CD source bundle from this guide inside that Git checkout. It auto-detects `origin` and the current branch when possible, and it prefills `BLACKSHIELD_API_URL` from the deployed platform.
  • Argo CD: kubectl apply -f deploy/argocd/k8s-scanner-appset.yaml — deploys to all registered clusters.
  • Flux: apply deploy/flux/k8s-scanner-helmrelease.yaml per cluster or cluster group.
  • Promote new releases by updating the Git revision or chart source in the ApplicationSet and syncing Argo CD.
  • Verify health: kubectl port-forward svc/blackshield-k8s-scanner 8080:8080 -n blackshield && curl localhost:8080/health

Criteri di successo

Verify health: kubectl port-forward svc/blackshield-k8s-scanner 8080:8080 -n blackshield && curl localhost:8080/health

View Findings · Accesso richiesto

Criteri di successo

  • helm upgrade --install completes with STATUS: deployed.
  • kubectl get pods -n blackshield shows the scanner pod as Running.
  • curl http://localhost:8080/health (via port-forward) returns status: healthy.
  • Cluster posture findings appear in the platform Findings view.

Continua

Keep your rollout moving with the next recommended step.

Ingerisci i primi risultati
Deploy the Kubernetes Scanner | BlackShield Docs