Skip to content

Commit

Permalink
docs: Various updates (aquasecurity#660)
Browse files Browse the repository at this point in the history
Signed-off-by: Daniel Pacak <pacak.daniel@gmail.com>
  • Loading branch information
danielpacak authored Aug 3, 2021
1 parent 511694d commit 8fa3421
Show file tree
Hide file tree
Showing 19 changed files with 378 additions and 349 deletions.
27 changes: 11 additions & 16 deletions docs/cli/getting-started.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ You need to have a Kubernetes cluster, and the kubectl command-line tool must be
cluster. If you do not already have a cluster, you can create one by installing [minikube] or [kind], or you can use one
of these Kubernetes playgrounds:

* [Katacode](https://www.katacoda.com/courses/kubernetes/playground)
* [Katacoda](https://www.katacoda.com/courses/kubernetes/playground)
* [Play with Kubernetes](http://labs.play-with-k8s.com/)

You also need the `starboard` command to be installed, e.g. from the [binary releases](./installation/binary-releases.md).
Expand All @@ -26,10 +26,8 @@ starboard init
The `init` subcommand creates the `starboard` namespace, in which Starboard executes Kubernetes jobs to perform
scans. It also sends custom security resources definitions to the Kubernetes API:

```
$ kubectl api-resources --api-group aquasecurity.github.io
```
```console
$ kubectl api-resources --api-group aquasecurity.github.io
NAME SHORTNAMES APIGROUP NAMESPACED KIND
ciskubebenchreports kubebench aquasecurity.github.io false CISKubeBenchReport
configauditreports configaudit aquasecurity.github.io true ConfigAuditReport
Expand Down Expand Up @@ -77,10 +75,10 @@ starboard get vulnerabilities deployment/nginx -o yaml
In this example, the `nginx` deployment has a single container called `nginx`, hence only one instance of the
`vulnerabilityreports.aquasecurity.github.io` resource is created with the label `starboard.container.name=nginx`.

To read more about custom resources and label selectors check [custom resource definitions][crds].
To read more about custom resources and label selectors check [custom resource definitions].

[trivy]: https://github.com/aquasecurity/trivy
[crds]: ./../crds.md
[trivy]: ./../integrations/vulnerability-scanners/trivy.md
[custom resource definitions]: ./../crds/index.md

Moving forward, let's take the same `nginx` Deployment and audit its Kubernetes configuration. As you remember we've
created it with the `kubectl create deployment` command which applies the default settings to the deployment descriptors.
Expand Down Expand Up @@ -108,24 +106,21 @@ NAME SCANNER AGE DANGER WARNING PASS
deployment-nginx Polaris 5s 0 8 9
```

[comment]: <> (Similar to vulnerabilities the Starboard Octant plugin can visualize config audit reports. What's more important,)
[comment]: <> (Starboard and Octant provide a single pane view with visibility into potentially dangerous and exploitable)
[comment]: <> (vulnerabilities as well as configuration issues that might affect stability, reliability, and scalability of the)
[comment]: <> (`nginx` Deployment.)
[comment]: <> (<p align="center">)
[comment]: <> ( <img src="docs/images/next-steps/deployment_configauditreports.png">)
[comment]: <> (</p>)

## Generating HTML Reports

Once you scanned the `nginx` Deployment for vulnerabilities and checked its configuration you can generate an HTML
report of identified risks:

```
starboard get report deployment/nginx > nginx.deploy.html
```

```
open nginx.deploy.html
```
![Vulnerability Report](../images/vulnerabilityReport.png)

![HTML Report](../images/html-report.png)

## What's Next?

To learn more about the available Starboard commands and scanners, such as [kube-bench][aqua-kube-bench] or
Expand Down
4 changes: 2 additions & 2 deletions docs/cli/index.md
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# Overview

Starboard CLI is a single executable binary which can be used to find risks, such as vulnerabilities or insecure pod
descriptors, in Kubernetes workloads. By default, the risk assessment reports are stored as [custom resources][crds].
descriptors, in Kubernetes workloads. By default, the risk assessment reports are stored as [custom resources].

To learn more about the available Starboard CLI commands, run `starboard help` or type a command followed by the
`-h` flag:
Expand All @@ -10,4 +10,4 @@ To learn more about the available Starboard CLI commands, run `starboard help` o
starboard scan kubehunterreports -h
```

[crds]: ./../crds.md
[custom resources]: ./../crds/index.md
317 changes: 0 additions & 317 deletions docs/crds.md

This file was deleted.

Loading

0 comments on commit 8fa3421

Please sign in to comment.