公開ガイド

Deploy the Kubernetes Scanner

Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done. 対象: Platform engineers, Kubernetes administrators, security engineers. 一般的な設定時間: 2 minutes.

quickstart

該当する場合

Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done.

対象読者: Platform engineers, Kubernetes administrators, security engineers所要時間の目安: 2 minutes

開始前に

  • Install Helm ≥ 3.14: brew install helm
  • Confirm kubectl is configured for the target cluster.
  • Create an ingestion API key in Settings → API Keys with Ingestion scope.

ファストパス

スターター設定をコピーして環境で実行し、詳細な展開手順についてはここに戻って確認してください。

Demonstration only

This configuration is designed for ease of use. To deploy scanner clients at scale, please plan your deployment architecture accordingly or contact us for enterprise best practices.

Get the source bundle

Download the exact source files referenced on this page, or run the one-command installer to write them locally before following the deployment steps.

Helm chart source

Creates `deploy/helm/blackshield-k8s-scanner/` locally with the current platform API URL prefilled so you can inspect, modify, and install the chart from source.

deploy/helm/blackshield-k8s-scanner/
bash
BLACKSHIELD_K8S_IMAGE=public.ecr.aws/blackshield-security/k8s-scanner:1.0.13 \
BLACKSHIELD_SITE_URL=https://blackshield.chaplau.com \
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)
cd deploy/helm/blackshield-k8s-scanner
Download source

Argo CD ApplicationSet

Creates a Git-based Argo CD ApplicationSet manifest with the current platform API URL prefilled so multi-cluster rollout can track the chart source in your GitOps repository.

deploy/argocd/k8s-scanner-appset.yaml
bash
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-argocd.sh)
Download source

実行する

Install with Helm (Deployment mode)

bash
# Create namespace and secret
kubectl create namespace blackshield
kubectl create secret generic blackshield-k8s-scanner \
  --namespace blackshield \
  --from-literal=api-key=sp_xxxx

# Bootstrap the local chart source from the guide first
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)

# Optional for local k3s clusters:
# --set env.KUBE_BENCH_BENCHMARK=cis-1.6-k3s

# Install chart — scans every 6 hours
helm upgrade --install blackshield-k8s-scanner ./deploy/helm/blackshield-k8s-scanner \
  --namespace blackshield \
  --set existingSecret.name=blackshield-k8s-scanner \
  --set existingSecret.key=api-key \
  --set scanIntervalSeconds=21600 \
  --wait

GitOps: Argo CD ApplicationSet (all clusters)

yaml
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: blackshield-k8s-scanner
  namespace: argocd
spec:
  generators:
    - clusters: {}   # all registered clusters
  template:
    metadata:
      name: "blackshield-k8s-scanner-{{name}}"
    spec:
      project: default
      source:
        repoURL: https://github.com/acme/platform-deployments.git
        targetRevision: main
        path: deploy/helm/blackshield-k8s-scanner
        helm:
          valuesObject:
            env:
              BLACKSHIELD_API_URL: "https://api.blackshield.chaplau.com"
            existingSecret:
              name: blackshield-k8s-scanner
              key: api-key
            scanIntervalSeconds: 21600
      destination:
        server: "{{server}}"
        namespace: blackshield
      syncPolicy:
        automated: { prune: true, selfHeal: true }
        syncOptions: [CreateNamespace=true]

仕組みの理解とカスタマイズ

展開のカスタマイズ、担当者の確認、安全な運用拡大を行う場合は以下の手順に従ってください。

1

ステップ 1

Create the secret and bootstrap the local chart

Store the API key in a Kubernetes Secret, then pull the chart source locally so the generated values already point at your deployed platform.

  • kubectl create namespace blackshield
  • kubectl create secret generic blackshield-k8s-scanner --namespace blackshield --from-literal=api-key=sp_xxxx
  • Run the source bundle on this page to create `deploy/helm/blackshield-k8s-scanner/` with `BLACKSHIELD_API_URL` prefilled, then run `cd deploy/helm/blackshield-k8s-scanner`.
  • Review `values.yaml` before the first install so any scan cadence or resource overrides are intentional.

成功の基準

Review `values.yaml` before the first install so any scan cadence or resource overrides are intentional.

Open API Keys · ログインが必要
2

ステップ 2

Install the chart

Choose Deployment mode (internal loop) or CronJob mode (Kubernetes schedule) and install directly from the local chart source.

  • Deployment mode (default): helm upgrade --install blackshield-k8s-scanner . --namespace blackshield --set existingSecret.name=blackshield-k8s-scanner --set existingSecret.key=api-key --set scanIntervalSeconds=21600 --wait
  • CronJob mode: add --set mode=cronjob --set cronSchedule='0 */6 * * *'
  • Local k3s: set env.KUBE_BENCH_BENCHMARK=cis-1.6-k3s if kube-bench cannot infer the benchmark automatically.
  • The chart automatically creates ClusterRole + ClusterRoleBinding with least-privilege read-only access.
  • NetworkPolicy restricts egress to port 443 only and the chart mounts a writable /tmp scratch volume for scanner caches while keeping the root filesystem read-only.

成功の基準

NetworkPolicy restricts egress to port 443 only and the chart mounts a writable /tmp scratch volume for scanner caches while keeping the root filesystem read-only.

All Deployment Guides
3

ステップ 3

Scale with GitOps

Use Argo CD ApplicationSet or Flux HelmRelease to deploy to every cluster from one place.

  • Commit the chart source into your GitOps repo before generating the Argo CD manifest so Argo CD can sync from Git.
  • Run the Argo CD source bundle from this guide inside that Git checkout. It auto-detects `origin` and the current branch when possible, and it prefills `BLACKSHIELD_API_URL` from the deployed platform.
  • Argo CD: kubectl apply -f deploy/argocd/k8s-scanner-appset.yaml — deploys to all registered clusters.
  • Flux: apply deploy/flux/k8s-scanner-helmrelease.yaml per cluster or cluster group.
  • Promote new releases by updating the Git revision or chart source in the ApplicationSet and syncing Argo CD.
  • Verify health: kubectl port-forward svc/blackshield-k8s-scanner 8080:8080 -n blackshield && curl localhost:8080/health

成功の基準

Verify health: kubectl port-forward svc/blackshield-k8s-scanner 8080:8080 -n blackshield && curl localhost:8080/health

View Findings · ログインが必要

成功の基準

  • helm upgrade --install completes with STATUS: deployed.
  • kubectl get pods -n blackshield shows the scanner pod as Running.
  • curl http://localhost:8080/health (via port-forward) returns status: healthy.
  • Cluster posture findings appear in the platform Findings view.

次へ進む

Keep your rollout moving with the next recommended step.

最初の検出結果を取り込む
Deploy the Kubernetes Scanner | BlackShield Docs