Guia público

Deploy the Kubernetes Scanner

Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done. Público: Platform engineers, Kubernetes administrators, security engineers. Tempo típico de configuração: 2 minutes.

quickstart

Use isto se

Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done.

Audience: Platform engineers, Kubernetes administrators, security engineersTypical time: 2 minutes

Antes de começar

  • Install Helm ≥ 3.14: brew install helm
  • Confirm kubectl is configured for the target cluster.
  • Create an ingestion API key in Settings → API Keys with Ingestion scope.

Caminho rápido

Copy a working starter, run it in your environment, then come back here for the deeper rollout details.

Apenas para demonstração

Esta configuração foi concebida para facilitar a utilização. Para implementar clientes de scanner em escala, planeie a sua arquitetura de implementação adequadamente ou contacte-nos para obter as melhores práticas empresariais.

Obtém o bundle de código fonte

Descarrega os ficheiros exatos usados neste guia ou executa o instalador de um só comando para os escrever localmente antes do deploy.

Helm chart source

Creates `deploy/helm/blackshield-k8s-scanner/` locally with the current platform API URL prefilled so you can inspect, modify, and install the chart from source.

deploy/helm/blackshield-k8s-scanner/
bash
BLACKSHIELD_K8S_IMAGE=public.ecr.aws/blackshield-security/k8s-scanner:1.0.8 \
BLACKSHIELD_SITE_URL=https://blackshield.chaplau.com \
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)
cd deploy/helm/blackshield-k8s-scanner
Descarregar fonte

Argo CD ApplicationSet

Creates a Git-based Argo CD ApplicationSet manifest with the current platform API URL prefilled so multi-cluster rollout can track the chart source in your GitOps repository.

deploy/argocd/k8s-scanner-appset.yaml
bash
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-argocd.sh)
Descarregar fonte

Executar isto

Install with Helm (Deployment mode)

bash
# Create namespace and secret
kubectl create namespace blackshield
kubectl create secret generic blackshield-k8s-scanner \
  --namespace blackshield \
  --from-literal=api-key=sp_xxxx

# Bootstrap the local chart source from the guide first
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)

# Optional for local k3s clusters:
# --set env.KUBE_BENCH_BENCHMARK=cis-1.6-k3s

# Install chart — scans every 6 hours
helm upgrade --install blackshield-k8s-scanner ./deploy/helm/blackshield-k8s-scanner \
  --namespace blackshield \
  --set existingSecret.name=blackshield-k8s-scanner \
  --set existingSecret.key=api-key \
  --set scanIntervalSeconds=21600 \
  --wait

GitOps: Argo CD ApplicationSet (all clusters)

yaml
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: blackshield-k8s-scanner
  namespace: argocd
spec:
  generators:
    - clusters: {}   # all registered clusters
  template:
    metadata:
      name: "blackshield-k8s-scanner-{{name}}"
    spec:
      project: default
      source:
        repoURL: https://github.com/acme/platform-deployments.git
        targetRevision: main
        path: deploy/helm/blackshield-k8s-scanner
        helm:
          valuesObject:
            env:
              BLACKSHIELD_API_URL: "https://api.blackshield.chaplau.com"
            existingSecret:
              name: blackshield-k8s-scanner
              key: api-key
            scanIntervalSeconds: 21600
      destination:
        server: "{{server}}"
        namespace: blackshield
      syncPolicy:
        automated: { prune: true, selfHeal: true }
        syncOptions: [CreateNamespace=true]

Entender e personalizar

Use the guided steps below when you want to tailor the rollout, validate ownership, or expand the deployment safely.

1

Passo 1

Create the secret and bootstrap the local chart

Store the API key in a Kubernetes Secret, then pull the chart source locally so the generated values already point at your deployed platform.

  • kubectl create namespace blackshield
  • kubectl create secret generic blackshield-k8s-scanner --namespace blackshield --from-literal=api-key=sp_xxxx
  • Run the source bundle on this page to create `deploy/helm/blackshield-k8s-scanner/` with `BLACKSHIELD_API_URL` prefilled, then run `cd deploy/helm/blackshield-k8s-scanner`.
  • Review `values.yaml` before the first install so any scan cadence or resource overrides are intentional.

Como é o sucesso

Review `values.yaml` before the first install so any scan cadence or resource overrides are intentional.

Open API Keys · Requer login
2

Passo 2

Install the chart

Choose Deployment mode (internal loop) or CronJob mode (Kubernetes schedule) and install directly from the local chart source.

  • Deployment mode (default): helm upgrade --install blackshield-k8s-scanner . --namespace blackshield --set existingSecret.name=blackshield-k8s-scanner --set existingSecret.key=api-key --set scanIntervalSeconds=21600 --wait
  • CronJob mode: add --set mode=cronjob --set cronSchedule='0 */6 * * *'
  • Local k3s: set env.KUBE_BENCH_BENCHMARK=cis-1.6-k3s if kube-bench cannot infer the benchmark automatically.
  • The chart automatically creates ClusterRole + ClusterRoleBinding with least-privilege read-only access.
  • NetworkPolicy restricts egress to port 443 only and the chart mounts a writable /tmp scratch volume for scanner caches while keeping the root filesystem read-only.

Como é o sucesso

NetworkPolicy restricts egress to port 443 only and the chart mounts a writable /tmp scratch volume for scanner caches while keeping the root filesystem read-only.

All Deployment Guides
3

Passo 3

Scale with GitOps

Use Argo CD ApplicationSet or Flux HelmRelease to deploy to every cluster from one place.

  • Commit the chart source into your GitOps repo before generating the Argo CD manifest so Argo CD can sync from Git.
  • Run the Argo CD source bundle from this guide inside that Git checkout. It auto-detects `origin` and the current branch when possible, and it prefills `BLACKSHIELD_API_URL` from the deployed platform.
  • Argo CD: kubectl apply -f deploy/argocd/k8s-scanner-appset.yaml — deploys to all registered clusters.
  • Flux: apply deploy/flux/k8s-scanner-helmrelease.yaml per cluster or cluster group.
  • Promote new releases by updating the Git revision or chart source in the ApplicationSet and syncing Argo CD.
  • Verify health: kubectl port-forward svc/blackshield-k8s-scanner 8080:8080 -n blackshield && curl localhost:8080/health

Como é o sucesso

Verify health: kubectl port-forward svc/blackshield-k8s-scanner 8080:8080 -n blackshield && curl localhost:8080/health

View Findings · Requer login

Como é o sucesso

  • helm upgrade --install completes with STATUS: deployed.
  • kubectl get pods -n blackshield shows the scanner pod as Running.
  • curl http://localhost:8080/health (via port-forward) returns status: healthy.
  • Cluster posture findings appear in the platform Findings view.

Continuar

Keep your rollout moving with the next recommended step.

Ingerir os seus primeiros achados
Deploy the Kubernetes Scanner | Documentação BlackShield