How do I scan a Kubernetes (K8s) Cluster?

Use this guide to configure cluster authentication and set up a target in Security Center to start scanning your Kubernetes environment.

Create a Network Asset

1. Log in to Security Center.
2. Go to Asset Manager > Network and click Add network asset.
3. Add the IP that is used by the Kubernetes API (e.g for the API http://174.32.12.45:6443 use the IP 174.32.12.45 for the network asset)
4. (Optional) If you want detect and assess internal services running inside of your Kubernetes cluster, add the internal network of your cluster as an IP network/range asset
   • This IP range needs to be included in the same scan as the API IP in order for the scan to automatically detect and create service assets
   • Refer to this article that describes how to find this IP (consider changing the title?): https://support.holmsecurity.com/knowledge/how-do-i-scan-a-cluster-to-find-assets

Import the Scan Profile

1. Navigate to Scan Network > Scan Profiles.
2. Import the profile Kubernetes Scan – Standard.

Configure Authentication

1. Click Edit imported profile and go to the Authentication tab.
2. Add a new Kubernetes Authentication Record.
   1. Enter the API URL and the Authentication Token
3. Run a scan targeting the cluster API asset, using this profile.
4. Done!