Skip to content

Commit

Permalink
docs: update starboard settings (aquasecurity#802)
Browse files Browse the repository at this point in the history
Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>
  • Loading branch information
danielpacak authored Nov 10, 2021
1 parent 3d1e35f commit fd29abc
Showing 1 changed file with 18 additions and 10 deletions.
28 changes: 18 additions & 10 deletions docs/settings.md
Original file line number Diff line number Diff line change
Expand Up @@ -5,17 +5,20 @@ confidential settings (such as a GitHub token). Starboard plugins read configura
and Secrets named after the plugin. For example, Trivy configuration is stored in the ConfigMap and Secret named
`starboard-trivy-config`.

The `starboard init` command ensures the `starboard` ConfigMap and the `starboard` Secret in the `starboard` namespace
with default settings. Similarly, the operator ensures the `starboard` ConfigMap and the `starboard` Secret in the
`OPERATOR_NAMESPACE`.
The `starboard install` command ensures the `starboard` ConfigMap and the `starboard` Secret in the `starboard`
namespace with default settings. Similarly, the operator ensures the `starboard` ConfigMap and the `starboard` Secret in
the `OPERATOR_NAMESPACE`.

You can change the default settings with `kubectl patch` or `kubectl edit` commands. For example, by default Trivy
displays vulnerabilities with all severity levels (`UNKNOWN`, `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`). However, you can
display only `HIGH` and `CRITICAL` vulnerabilities by patching the `trivy.severity` value in the `starboard-trivy-config`
ConfigMap:

```
kubectl patch cm starboard-trivy-config -n <starboard_operator> \
STARBOARD_NAMESPACE=<your starboard namespace>
```
```
kubectl patch cm starboard-trivy-config -n $STARBOARD_NAMESPACE \
--type merge \
-p "$(cat <<EOF
{
Expand All @@ -30,9 +33,11 @@ EOF
To set the GitHub token used by Trivy add the `trivy.githubToken` value to the `starboard-trivy-config` Secret:

```
STARBOARD_NAMESPACE=<your starboard namespace>
GITHUB_TOKEN=<your token>
kubectl patch secret starboard-trivy-config -n <starboard_operator> \
```
```
kubectl patch secret starboard-trivy-config -n $STARBOARD_NAMESPACE \
--type merge \
-p "$(cat <<EOF
{
Expand All @@ -45,9 +50,7 @@ EOF
```

The following table lists available settings with their default values. Check plugins' documentation to see
configuration settings for common use cases. For example, switch Trivy from
[`Standalone`](./integrations/vulnerability-scanners/trivy.md#standalone) to
[`ClientServer`](./integrations/vulnerability-scanners/trivy.md#clientserver) mode.
configuration settings for common use cases. For example, switch Trivy from [Standalone] to [ClientServer] mode.

| CONFIGMAP KEY | DEFAULT | DESCRIPTION |
| ------------------------------ | ------------------------------------- | ----------- |
Expand All @@ -63,9 +66,14 @@ configuration settings for common use cases. For example, switch Trivy from
You can find it handy to delete a configuration key, which was not created by default by the `starboard init`
command. For example, the following `kubectl patch` command deletes the `trivy.httpProxy` key:
```
kubectl patch cm starboard-trivy-config -n <starboard_operator> \
STARBOARD_NAMESPACE=<your starboard namespace>
```
```
kubectl patch cm starboard-trivy-config -n $STARBOARD_NAMESPACE \
--type json \
-p '[{"op": "remove", "path": "/data/trivy.httpProxy"}]'
```

[Standalone]: ./integrations/vulnerability-scanners/trivy.md#standalone
[ClientServer]: ./integrations/vulnerability-scanners/trivy.md#clientserver
[tolerations]: https://kubernetes.io/docs/concepts/scheduling-eviction/taint-and-toleration

0 comments on commit fd29abc

Please sign in to comment.