From 8a00a5c54b644546571b4614b8bb43d29bb289bb Mon Sep 17 00:00:00 2001 From: dwertent Date: Tue, 31 Aug 2021 16:29:11 +0300 Subject: [PATCH] Add input table to readme --- README.md | 37 +++++++++++++++++-------------------- cmd/framework.go | 8 ++++---- cmd/root.go | 2 +- 3 files changed, 22 insertions(+), 25 deletions(-) diff --git a/README.md b/README.md index f08c8534..5c36040e 100644 --- a/README.md +++ b/README.md @@ -28,20 +28,17 @@ If you wish to scan all namespaces in your cluster, remove the `--exclude-namesp +### Flags + +| flag | default | description | options | +| --- | --- | --- | --- | +| `-e`/`--exclude-namespaces` | Scan all namespaces | Namespaces to exclude from scanning, Recommended to exclude `kube-system` and `kube-public` namespaces | +| `-s`/`--silent` | Display progress messages | Silent progress messages | +| `-f`/`--format` | `pretty-printer` | Output format | `pretty-printer`/`json`/`junit` | +| `-o`/`--output` | print to stdout | Save scan result in file | + ## Usage & Examples - -### Pre-Deployment Testing -Check your YAML files before you're deploying, simply add them at the end of command line: -``` -kubescape scan framework nsa *.yaml -``` - -### Integration with other tools - -Kubescape can produce output fitting for later processing: -* JSON (`-f json`) -* JUnit XML (`-f junit`) - + ### Examples * Scan a running Kubernetes cluster with [`nsa`](https://www.nsa.gov/News-Features/Feature-Stories/Article-View/Article/2716980/nsa-cisa-release-kubernetes-hardening-guidance/) framework @@ -49,32 +46,32 @@ Kubescape can produce output fitting for later processing: kubescape scan framework nsa --exclude-namespaces kube-system,kube-public ``` -* Scan local `yaml`/`json` files +* Scan local `yaml`/`json` files before deploying ``` -kubescape scan framework nsa examples/online-boutique/* +kubescape scan framework nsa *.yaml ``` -* Scan `yaml`/`json` files from url +* Scan `yaml`/`json` files from url ``` kubescape scan framework nsa https://raw.githubusercontent.com/GoogleCloudPlatform/microservices-demo/master/release/kubernetes-manifests.yaml ``` -* Output in `json` format +* Output in `json` format ``` kubescape scan framework nsa --exclude-namespaces kube-system,kube-public --format json --output results.json ``` -* Output in `junit xml` format +* Output in `junit xml` format ``` kubescape scan framework nsa --exclude-namespaces kube-system,kube-public --format junit --output results.xml ``` ### Helm Support -Render the helm template and pass as stdout +* Render the helm chart using [`helm template`](https://helm.sh/docs/helm/helm_template/) and pass to stdout ``` -helm template [CHART] [flags] --generate-name --dry-run | kubescape scan framework nsa - +helm template [NAME] [CHART] [flags] --dry-run | kubescape scan framework nsa - ``` for example: diff --git a/cmd/framework.go b/cmd/framework.go index 7b31a0dd..b4550c1b 100644 --- a/cmd/framework.go +++ b/cmd/framework.go @@ -75,10 +75,10 @@ func isValidFramework(framework string) bool { func init() { scanCmd.AddCommand(frameworkCmd) scanInfo = opapolicy.ScanInfo{} - frameworkCmd.Flags().StringVarP(&scanInfo.ExcludedNamespaces, "exclude-namespaces", "e", "", "namespaces to exclude from check") - frameworkCmd.Flags().StringVarP(&scanInfo.Format, "format", "f", "pretty-printer", `output format. supported formats: "pretty-printer"/"json"/"junit"`) - frameworkCmd.Flags().StringVarP(&scanInfo.Output, "output", "o", "", "output file. print output to file and not stdout") - frameworkCmd.Flags().BoolVarP(&scanInfo.Silent, "silent", "s", false, "silent progress output") + frameworkCmd.Flags().StringVarP(&scanInfo.ExcludedNamespaces, "exclude-namespaces", "e", "", "Namespaces to exclude from check") + frameworkCmd.Flags().StringVarP(&scanInfo.Format, "format", "f", "pretty-printer", `Output format. supported formats: "pretty-printer"/"json"/"junit"`) + frameworkCmd.Flags().StringVarP(&scanInfo.Output, "output", "o", "", "Output file. print output to file and not stdout") + frameworkCmd.Flags().BoolVarP(&scanInfo.Silent, "silent", "s", false, "Silent progress messages") } func CliSetup() error { diff --git a/cmd/root.go b/cmd/root.go index afa978fb..88b9db54 100644 --- a/cmd/root.go +++ b/cmd/root.go @@ -9,7 +9,7 @@ var cfgFile string var rootCmd = &cobra.Command{ Use: "kubescape", Short: "Kubescape is a tool for testing Kubernetes security posture", - Long: `Kubescape is a tool for testing Kubernetes security posture based on NSA and MITRE specifications.`, + Long: `Kubescape is a tool for testing Kubernetes security posture based on NSA specifications.`, } func Execute() {