Comment on page
Run KuboScore on your cluster in cloud mode.
We recommend to create a specific ServiceAccount object in your cluster to authenticate KuboScore and grant it specific permissions, but nothing prevents you from using an already existing ServiceAccount.
In this example, the ServiceAccount
ksa-kuboscorewill be created in the
defaultNamespace. You are free to rename the ServiceAccount and/or to create it in another Namespace.
kubectl create serviceaccount ksa-kuboscore --namespace default
Kubernetes ≥ 1.24
If your cluster version equals or is over 1.24 (or if you have the
LegacyServiceAccountTokenNoAutoGenerationfeature gate enabled), you will have to manually generate an authentication token for the ServiceAccount.
To get your cluster’s Kubernetes version, you can use this
kubectl version --short=true
To generate an authentication token for the ServiceAccount, you need to create a Secret defined by the following YAML. Save its content in a
Apply the Secret on your cluster to generate the ServiceAccount token:
kubectl apply -f kuboscore-secret.yaml
If you are using an already existing ServiceAccount that has broader permissions than what is listed below, you can skip this section.
KuboScore needs some privileges to be able to perform its analysis, therefore we need to create a ClusterRole and a ClusterRoleBinding object.
You will find below the ClusterRole definition. Create a new file called
kuboscore-clusterrole.yamland paste the content of this definition in it:
Likewise, create a
kuboscore-clusterrolebinding.yamlfile and paste the content of the following ClusterRoleBinding definition in it:
If you want to use a different ServiceAccount, update the values of
subjects.namespaceto match your ServiceAccount name and its Namespace.
- kind: ServiceAccount
If you want to use a different ServiceAccount, update the parameters provided to the script to match your ServiceAccount name and its Namespace.
curl -sO https://download.kubolabs.io/scripts/create_kubeconfig
chmod +x create_kubeconfig
./create_kubeconfig ksa-kuboscore --namespace default
To score your cluster, we need to be able to reach it. You will find below the network restrictions that we support:
Once access to your cluster is configured, scoring it is pretty easy:
Cluster credentials form.
On the cluster credentials form, we ask you for a bunch of information to be able to connect to your cluster.
This is a description that you can set to quickly find your cluster among other analysis.
If your cluster sits in a private network only reachable through a bastion host, you must tick the « This cluster is only reachable through an SSH tunnel » checkbox and add the following additional information.
This is the IP address or DNS hostname on which your bastion is publicly exposed.
This is the port used for SSH connections by your bastion.
Bastion SSH key
This is the Kubernetes API endpoint to use from inside your network in the following form: