Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

update readme to allow working setup #7

Closed
wants to merge 1 commit into from
Closed

update readme to allow working setup #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 6 additions & 4 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,14 +13,16 @@ Download and extract the scan plugin to `~/.kube/plugins/scan`:
```bash
mkdir -p ~/.kube/plugins/scan && \
curl -sL https://github.com/stefanprodan/kubectl-kubesec/releases/download/0.2.0/kubectl-kubesec_0.2.0_`uname -s`_amd64.tar.gz | tar xzvf - -C ~/.kube/plugins/scan
mv ~/.kube/plugins/scan/scan ~/.kube/plugins/scan/kubectl-scan
export PATH=$PATH:~/.kube/plugins/scan
```

### Usage

Scan a Deployment:

```bash
kubectl -n kube-system plugin scan deployment/kubernetes-dashboard
kubectl -n kube-system kubectl-scan deployment/kubernetes-dashboard
```

Result:
Expand All @@ -44,7 +46,7 @@ Drop all capabilities and add only those required to reduce syscall attack surfa
Scan a DaemonSet:

```bash
kubectl -n weave plugin scan daemonset/weave-scope-agent
kubectl -n weave kubectl-scan daemonset/weave-scope-agent
```

Result:
Expand All @@ -66,7 +68,7 @@ Mounting the docker.socket leaks information about other containers and can allo
Scan a StatefulSet:

```bash
kubectl plugin scan statefulset/memcached
kubectl kubectl-scan statefulset/memcached
```

Result:
Expand All @@ -89,7 +91,7 @@ Run as a high-UID user to avoid conflicts with the host's user table
Scan a Pod:

```bash
kubectl -n kube-system plugin scan pod/tiller-deploy-5c688d5f9b-ztjbt
kubectl -n kube-system kubectl-scan pod/tiller-deploy-5c688d5f9b-ztjbt
```

Result:
Expand Down