公开指南

Deploy the Kubernetes Scanner

Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done. 受众: Platform engineers, Kubernetes administrators, security engineers. 典型配置时长: 2 minutes.

quickstart

适用场景

Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done.

目标受众: Platform engineers, Kubernetes administrators, security engineers预计耗时: 2 minutes

开始之前

  • Install Helm ≥ 3.14: brew install helm
  • Confirm kubectl is configured for the target cluster.
  • Create an ingestion API key in Settings → API Keys with Ingestion scope.

快捷路径

复制开箱即用的入门配置，在您的环境中运行，然后返回此处查看详细的深度配置。

Demonstration only

This configuration is designed for ease of use. To deploy scanner clients at scale, please plan your deployment architecture accordingly or contact us for enterprise best practices.

Get the source bundle

Download the exact source files referenced on this page, or run the one-command installer to write them locally before following the deployment steps.

Helm chart source

Creates `deploy/helm/blackshield-k8s-scanner/` locally with the current platform API URL prefilled so you can inspect, modify, and install the chart from source.

deploy/helm/blackshield-k8s-scanner/
bash
BLACKSHIELD_K8S_IMAGE=public.ecr.aws/blackshield-security/k8s-scanner:1.0.13 \
BLACKSHIELD_SITE_URL=https://blackshield.chaplau.com \
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)
cd deploy/helm/blackshield-k8s-scanner
Download source

Argo CD ApplicationSet

Creates a Git-based Argo CD ApplicationSet manifest with the current platform API URL prefilled so multi-cluster rollout can track the chart source in your GitOps repository.

deploy/argocd/k8s-scanner-appset.yaml
bash
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-argocd.sh)
Download source

运行命令

Install with Helm (Deployment mode)

bash
# Create namespace and secret
kubectl create namespace blackshield
kubectl create secret generic blackshield-k8s-scanner \
  --namespace blackshield \
  --from-literal=api-key=sp_xxxx

# Bootstrap the local chart source from the guide first
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)

# Optional for local k3s clusters:
# --set env.KUBE_BENCH_BENCHMARK=cis-1.6-k3s

# Install chart — scans every 6 hours
helm upgrade --install blackshield-k8s-scanner ./deploy/helm/blackshield-k8s-scanner \
  --namespace blackshield \
  --set existingSecret.name=blackshield-k8s-scanner \
  --set existingSecret.key=api-key \
  --set scanIntervalSeconds=21600 \
  --wait

GitOps: Argo CD ApplicationSet (all clusters)

yaml
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: blackshield-k8s-scanner
  namespace: argocd
spec:
  generators:
    - clusters: {}   # all registered clusters
  template:
    metadata:
      name: "blackshield-k8s-scanner-{{name}}"
    spec:
      project: default
      source:
        repoURL: https://github.com/acme/platform-deployments.git
        targetRevision: main
        path: deploy/helm/blackshield-k8s-scanner
        helm:
          valuesObject:
            env:
              BLACKSHIELD_API_URL: "https://api.blackshield.chaplau.com"
            existingSecret:
              name: blackshield-k8s-scanner
              key: api-key
            scanIntervalSeconds: 21600
      destination:
        server: "{{server}}"
        namespace: blackshield
      syncPolicy:
        automated: { prune: true, selfHeal: true }
        syncOptions: [CreateNamespace=true]

原理解析与进阶定制

当您需要深度定制部署、验证资产归属或安全扩大部署范围时，请参考下方详细指引步骤。

1

步骤 1

Create the secret and bootstrap the local chart

Store the API key in a Kubernetes Secret, then pull the chart source locally so the generated values already point at your deployed platform.

  • kubectl create namespace blackshield
  • kubectl create secret generic blackshield-k8s-scanner --namespace blackshield --from-literal=api-key=sp_xxxx
  • Run the source bundle on this page to create `deploy/helm/blackshield-k8s-scanner/` with `BLACKSHIELD_API_URL` prefilled, then run `cd deploy/helm/blackshield-k8s-scanner`.
  • Review `values.yaml` before the first install so any scan cadence or resource overrides are intentional.

达成目标状态

Review `values.yaml` before the first install so any scan cadence or resource overrides are intentional.

Open API Keys · 需要登录
2

步骤 2

Install the chart

Choose Deployment mode (internal loop) or CronJob mode (Kubernetes schedule) and install directly from the local chart source.

  • Deployment mode (default): helm upgrade --install blackshield-k8s-scanner . --namespace blackshield --set existingSecret.name=blackshield-k8s-scanner --set existingSecret.key=api-key --set scanIntervalSeconds=21600 --wait
  • CronJob mode: add --set mode=cronjob --set cronSchedule='0 */6 * * *'
  • Local k3s: set env.KUBE_BENCH_BENCHMARK=cis-1.6-k3s if kube-bench cannot infer the benchmark automatically.
  • The chart automatically creates ClusterRole + ClusterRoleBinding with least-privilege read-only access.
  • NetworkPolicy restricts egress to port 443 only and the chart mounts a writable /tmp scratch volume for scanner caches while keeping the root filesystem read-only.

达成目标状态

NetworkPolicy restricts egress to port 443 only and the chart mounts a writable /tmp scratch volume for scanner caches while keeping the root filesystem read-only.

All Deployment Guides
3

步骤 3

Scale with GitOps

Use Argo CD ApplicationSet or Flux HelmRelease to deploy to every cluster from one place.

  • Commit the chart source into your GitOps repo before generating the Argo CD manifest so Argo CD can sync from Git.
  • Run the Argo CD source bundle from this guide inside that Git checkout. It auto-detects `origin` and the current branch when possible, and it prefills `BLACKSHIELD_API_URL` from the deployed platform.
  • Argo CD: kubectl apply -f deploy/argocd/k8s-scanner-appset.yaml — deploys to all registered clusters.
  • Flux: apply deploy/flux/k8s-scanner-helmrelease.yaml per cluster or cluster group.
  • Promote new releases by updating the Git revision or chart source in the ApplicationSet and syncing Argo CD.
  • Verify health: kubectl port-forward svc/blackshield-k8s-scanner 8080:8080 -n blackshield && curl localhost:8080/health

达成目标状态

Verify health: kubectl port-forward svc/blackshield-k8s-scanner 8080:8080 -n blackshield && curl localhost:8080/health

View Findings · 需要登录

达成目标状态

  • helm upgrade --install completes with STATUS: deployed.
  • kubectl get pods -n blackshield shows the scanner pod as Running.
  • curl http://localhost:8080/health (via port-forward) returns status: healthy.
  • Cluster posture findings appear in the platform Findings view.

下一步

Keep your rollout moving with the next recommended step.

导入首批发现
Deploy the Kubernetes Scanner | BlackShield Docs