11# Mondoo Operator for Kubernetes
22
33[ ![ Tests] ( https://github.com/mondoohq/mondoo-operator/actions/workflows/tests.yaml/badge.svg )] ( https://github.com/mondoohq/mondoo-operator/actions/workflows/tests.yaml )
4+
45<!-- [](https://github.com/mondoohq/mondoo-operator/actions/workflows/edge-integration-tests.yaml) -->
56<!-- [](https://github.com/mondoohq/mondoo-operator/actions/workflows/cloud-tests.yaml) -->
67
@@ -32,13 +33,13 @@ Install the operator in each cluster you want to scan. The operator scans the cl
3233┌─────────────────────────────────────┐
3334│ Your Kubernetes Cluster │
3435│ │
35- │ ┌─────────────────────────────┐ │
36- │ │ Mondoo Operator │ │
37- │ │ │ │
38- │ │ • K8s Resources Scanning │ │
39- │ │ • Node Scanning │ │
40- │ │ • Container Image Scanning │ │
41- │ └─────────────────────────────┘ │
36+ │ ┌─────────────────────────────┐ │
37+ │ │ Mondoo Operator │ │
38+ │ │ │ │
39+ │ │ • K8s Resources Scanning │ │
40+ │ │ • Node Scanning │ │
41+ │ │ • Container Image Scanning │ │
42+ │ └─────────────────────────────┘ │
4243│ │ │
4344│ ▼ │
4445│ Scans this cluster directly │
@@ -53,11 +54,11 @@ apiVersion: k8s.mondoo.com/v1alpha2
5354kind : MondooAuditConfig
5455spec :
5556 kubernetesResources :
56- enable : true # Scan K8s resources in this cluster
57+ enable : true # Scan K8s resources in this cluster
5758 nodes :
58- enable : true # Scan nodes in this cluster
59+ enable : true # Scan nodes in this cluster
5960 containers :
60- enable : true # Scan container images
61+ enable : true # Scan container images
6162` ` `
6263
6364### External Cluster Scanning
@@ -68,9 +69,9 @@ Install the operator in a central management cluster and scan remote clusters vi
6869┌─────────────────────────────────────┐
6970│ Management Cluster │
7071│ │
71- │ ┌─────────────────────────────┐ │
72- │ │ Mondoo Operator │ │
73- │ └──────────┬──────────────────┘ │
72+ │ ┌─────────────────────────────┐ │
73+ │ │ Mondoo Operator │ │
74+ │ └──────────┬──────────────────┘ │
7475└─────────────┼───────────────────────┘
7576 │
7677 │ kubeconfig / WIF / SPIFFE
@@ -86,6 +87,7 @@ Install the operator in a central management cluster and scan remote clusters vi
8687** Use when:** You want centralized scanning, cannot install operators in target clusters, or want to reduce operational overhead.
8788
8889** Authentication methods:**
90+
8991- ** Kubeconfig** : Use a kubeconfig file stored in a Secret
9092- ** Workload Identity (WIF)** : Native cloud provider authentication for GKE, EKS, AKS
9193- ** SPIFFE** : Use SPIFFE/SPIRE for cross-cluster authentication
@@ -96,7 +98,7 @@ apiVersion: k8s.mondoo.com/v1alpha2
9698kind : MondooAuditConfig
9799spec :
98100 kubernetesResources :
99- enable : false # Don't scan local cluster
101+ enable : false # Don't scan local cluster
100102 externalClusters :
101103 - name : production
102104 kubeconfigSecretRef :
@@ -115,28 +117,28 @@ apiVersion: k8s.mondoo.com/v1alpha2
115117kind : MondooAuditConfig
116118spec :
117119 kubernetesResources :
118- enable : true # Scan local cluster
119- externalClusters : # Also scan remote clusters
120+ enable : true # Scan local cluster
121+ externalClusters : # Also scan remote clusters
120122 - name : production
121123 kubeconfigSecretRef :
122124 name : prod-kubeconfig
123125 nodes :
124- enable : true # Scan local nodes
126+ enable : true # Scan local nodes
125127 containers :
126- enable : true # Scan container images
128+ enable : true # Scan container images
127129` ` `
128130
129131## Features
130132
131- | Feature | Self-Cluster | External Cluster |
132- |---------|: ------------:| :----------------: |
133- | Kubernetes Resources Scanning | ✅ | ✅ |
134- | Node Scanning | ✅ | ❌ |
135- | Container Image Scanning | ✅ | ✅ |
136- | Namespace Filtering | ✅ | ✅ |
137- | Kubeconfig Auth | - | ✅ |
138- | Workload Identity (GKE/EKS/AKS) | - | ✅ |
139- | SPIFFE Auth | - | ✅ |
133+ | Feature | Self-Cluster | External Cluster |
134+ | ------------------------------- | :----------: | : --------------: |
135+ | Kubernetes Resources Scanning | ✅ | ✅ |
136+ | Node Scanning | ✅ | ❌ |
137+ | Container Image Scanning | ✅ | ✅ |
138+ | Namespace Filtering | ✅ | ✅ |
139+ | Kubeconfig Auth | - | ✅ |
140+ | Workload Identity (GKE/EKS/AKS) | - | ✅ |
141+ | SPIFFE Auth | - | ✅ |
140142
141143
142144
@@ -153,6 +155,7 @@ The following Kubernetes environments are tested:
153155<!-- - AWS EKS 1.23, 1.24, 1.25, and 1.26
154156- Azure AKS 1.24, 1.25, and 1.26
155157- GCP GKE 1.23, 1.24, 1.25, and 1.26 -->
158+
156159- Minikube with Kubernetes versions 1.31, 1.32, 1.33, and 1.34
157160- K3S 1.31, 1.32, 1.33, and 1.34
158161
0 commit comments