-
Notifications
You must be signed in to change notification settings - Fork 10
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #94 from intelops/chandu
kubviz docs updated by Anila
- Loading branch information
Showing
5 changed files
with
96 additions
and
7 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,54 @@ | ||
--- | ||
title: "Security Tracking" | ||
date: 2024-04-03 | ||
weight: 8 | ||
draft: false | ||
--- | ||
|
||
## Cluster Scanning | ||
|
||
Using KubViz, you can comprehensively scan Kubernetes containers for security flaws such as vulnerabilities and misconfigurations. | ||
|
||
### Purpose | ||
|
||
- It helps in detecting vulnerabilities in operating system packages (like Alpine, Debian, Ubuntu, etc.) | ||
- This could include ensuring the security of containerized applications, compliance with security standards, or reducing the risk of security breaches. | ||
- Detects configuration issues in Kubernetes cluster. | ||
|
||
## Image Scanning | ||
|
||
KubViz helps to identify vulnerabilities in container images. | ||
|
||
It focuses on scanning container images for known vulnerabilities in the installed packages and libraries. | ||
|
||
It will analyze the layers of the image and compare the installed packages and libraries against its vulnerability database. It will then provide a report highlighting any known vulnerabilities found. | ||
|
||
## Sbom | ||
|
||
Generate reports for Software Bill of Materials (SBOM) from images within your Kubernetes cluster using KubViz in the CycloneDX format. | ||
|
||
These reports will be available in JSON format, and you can visualize this data on Grafana dashboard. | ||
|
||
## Customizing Security Scanning | ||
|
||
You can customize the security scans by changing the chart values. | ||
|
||
- To [Disable](https://github.com/intelops/kubviz/blob/main/charts/agent/values.yaml#L189) the cluster scan you can pass 0 or empty string | ||
|
||
```yaml | ||
schedule: | ||
enabled: true | ||
trivyclusterscanInterval: 0 | ||
... | ||
``` | ||
|
||
- For changing the interval, pass the interval time | ||
|
||
```yaml | ||
schedule: | ||
enabled: true | ||
trivyclusterscanInterval: "@every 24h" | ||
... | ||
``` | ||
|
||
Same you can change for [image-scan](https://github.com/intelops/kubviz/blob/main/charts/agent/values.yaml#L187) and [sbom](https://github.com/intelops/kubviz/blob/main/charts/agent/values.yaml#L188) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,35 @@ | ||
--- | ||
title: "Health Check" | ||
date: 2024-04-03 | ||
weight: 9 | ||
draft: false | ||
--- | ||
|
||
## Health Check | ||
|
||
You can run different types of checks against your Kubernetes cluster to detect any issues or potential problems before they cause any downtime or service disruptions. Check will run in the background and sends data to kubviz. After analysing the data from dashboard you can take corrective action quickly, if any issues are detected. | ||
|
||
### Configuration | ||
|
||
You'll need to [configure](https://github.com/intelops/kubviz/blob/main/charts/agent/values.yaml#L192) it to run health checks on your Kubernetes cluster. | ||
|
||
```yaml | ||
kuberhealthy: | ||
enabled: true | ||
... | ||
``` | ||
|
||
## Run Health Checks | ||
|
||
Once you've configured it will start running health checks on your Kubernetes cluster. It supports a variety of health checks, The checks are: | ||
|
||
|
||
Check Name | Description | | ||
------ | -------- | | ||
Daemonset check | Ensures daemonsets can be successfully deployed | | ||
DNS status check | Checks for failures with DNS, including resolving within the cluster and outside of the cluster | | ||
Deployment check | Ensures that a Deployment and Service can be provisioned, created, and serve traffic within the Kubernetes cluster | | ||
Image pull check | Verifies that an image can be pulled from an image repository | | ||
Pod status check | Checks for unhealthy pod statuses in a target namespace | | ||
Pod restart | Checks for excessive pod restarts in any namespace | | ||
Resource quota check | Checks if resource quotas (CPU & memory) are available | |