datreeio / kubectl-datree

A kubectl plugin that extends Datree to test resources within the cluster

kubectl-datree

Overview

This kubectl plugin extends the Datree CLI's capabilities to allow scanning resources within your cluster for misconfigurations.

Use cases

• Reveal unknown configuration issues
• Get ready for future k8s version upgrade
• Enforce standards and best practices

Supported Platforms

This plugin supports MacOS and Linux.

Installation

Via Krew

1. Install krew
2. Install the datree plugin:

kubectl krew install datree

Manual installation

1. Download the installation script from this repository.
2. Open a terminal at the location of the script.
3. Run /bin/sh manual_install.sh (an administrator password will be required to complete the installation).

Usage

kubectl datree test [datree CLI args] -- [options]

Arguments:

datree CLI args:
  This plugin supports all of the Datree CLI arguments: https://hub.datree.io/cli-arguments

options:
  [-n <namespace>] Test all resources in the cluster belonging to the specified namespace
  [--all] Test all resources in the cluster
      When using '--all', you can specify namespaces to exclude using '--exclude <namespace> --exclude <namespace2>'
  [<resource type> <resource name> <namespace>] Test a single resource in the cluster

  Running 'kubectl datree test' with no arguments is equivalent to 'kubectl datree test -- -n default'

Specification

The plugin supports the following resource types:

• Pod
• Service
• Ingress
• Daemonset
• Deployment
• Replicaset
• Statefulset
• Job
• CronJob
• CRD (not the custom resource itself, but its definition)

⚠️ When running against a given namespace, only resources of these types will be checked.

Examples

The following command will fetch all resources within the namespace exmpl, and execute a policy check against them:

kubectl datree test -- -n exmpl

The following command will fetch the resource of kind Service named myAwesomeService in namespace mySweetNamespace, and execute a policy check against it using k8s schema version 1.22.0:

kubectl datree test -s "1.22.0" -- service myAwesomeService mySweetNamespace

The following command will fetch all resources from all namespaces in the cluster except for 'default':

kubectl datree test -- --all --exclude default

Example test with no misconfigurations:

kubectl-datree's Issues

Getting error while run test on namespace

Hello Team,

I am getting below error while run test on namespace.

E0722 14:54:43.548729 17348 run.go:120] "command failed" err="unknown command "datree" for "kubectl""

Note: I have install on WSL environment.

Tests missing critical schemas due to being namespaced

Hello!

I've started using this plugin to test compatibility of my cluster to 1.22 and noticed that since this is namespaced it's missing CRDs! These are super critical, could there be an option to do a full cluster scan regardless of namespace that goes over ALL my cluster resources?

Could not resolve host: get.datree.io

curl https://get.datree.io | /bin/bash
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0curl: (6) Could not resolve host: get.datree.io

download page is not working