Public Guide
Scan cluster posture with kube-bench (CIS benchmarks), kubescape, and Kyverno policy telemetry. One Helm chart install, one kubectl secret — done. Audience: Platform engineers, Kubernetes administrators, security engineers. Typical setup time: 2 minutes.
Step 1
Store the API key in a Kubernetes Secret and add the chart repository.
Step 2
Choose Deployment mode (internal loop) or CronJob mode (Kubernetes schedule).
Step 3
Use Argo CD ApplicationSet or Flux HelmRelease to deploy to every cluster from one place.
Download the exact source files referenced on this page, or run the one-command installer to write them locally before following the deployment steps.
Creates `deploy/helm/secplatform-k8s-scanner/` locally so you can inspect, modify, and install the chart from source.
bash <(curl -fsSL https://stg-blackshield.chaplau.com/source-bundles/k8s-scanner-helm.sh)
cd deploy/helm/secplatform-k8s-scannerCreates the Argo CD ApplicationSet manifest locally for multi-cluster rollout from GitOps.
bash <(curl -fsSL https://stg-blackshield.chaplau.com/source-bundles/k8s-scanner-argocd.sh)# Create namespace and secret
kubectl create namespace secplatform
kubectl create secret generic secplatform-k8s-scanner \
--namespace secplatform \
--from-literal=api-key=sp_xxxx
# Install chart — scans every 6 hours
helm repo add secplatform https://charts.yourdomain.com
helm repo update
helm upgrade --install secplatform-k8s-scanner secplatform/k8s-scanner \
--namespace secplatform \
--set env.SECPLATFORM_API_URL=https://api.yourdomain.com \
--set existingSecret.name=secplatform-k8s-scanner \
--set existingSecret.key=api-key \
--set scanIntervalSeconds=21600 \
--waitapiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
name: secplatform-k8s-scanner
namespace: argocd
spec:
generators:
- clusters: {} # all registered clusters
template:
metadata:
name: "secplatform-k8s-scanner-{{name}}"
spec:
project: default
source:
repoURL: https://charts.yourdomain.com
chart: k8s-scanner
targetRevision: "1.0.0"
helm:
valuesObject:
env:
SECPLATFORM_API_URL: "https://api.yourdomain.com"
existingSecret:
name: secplatform-k8s-scanner
key: api-key
scanIntervalSeconds: 21600
destination:
server: "{{server}}"
namespace: secplatform
syncPolicy:
automated: { prune: true, selfHeal: true }
syncOptions: [CreateNamespace=true]