DOCSEARCHbyAlgolia
Submit Docs

Datree Documentation

website·Indexed 35 days ago

https://hub.datree.io

Documentation for Datree, a tool for scanning Kubernetes configurations. Includes guides on using the Datree CLI, implementing custom rules, and a library of built-in rules to prevent security risks such as privilege escalation, exposed secrets, and the use of removed APIs.

Tokens
51.9K
Snippets
322
Records
425
Agent score
68%

What's inside Datree

  2. Prevent containers from having root access capabilities

    The CONTAINERS_INCORRECT_PRIVILEGED_VALUE_TRUE rule identifies Kubernetes manifests where containers are run in privileged mode. Privileged containers have access to host-level resources (such as the file system), which poses a security risk. To secure the environment, container access should be limited to the pod level.

    Targeted Kubernetes Objects:

    • Deployment
    • Pod
    • DaemonSet
    • StatefulSet
    • ReplicaSet
    • CronJob
    • Job

  3. Manage centralized policies in Datree

    Datree policies are centralized, allowing you to configure rules in the dashboard and execute them across different environments using your account token. You can create new policies or use the default 'Starter' policy. To manage policies, navigate to the policies page in the Datree app.

  4. Analyze cluster scan violations using the Failures table

    The Failures table on the repairing page (/repairing/cluster) lists all rules that failed during the most recent cluster scan. The table includes information about the affected resources and supports filtering by namespace, resource kind, or rule name to isolate specific violations.

  5. Prevent containers from having unnecessary system call privileges

    The Datree rule CONTAINERS_INCORRECT_SECCOMP_PROFILE ensures that containers do not run with the unconfined seccomp profile, which reduces isolation and can grant attackers dangerous privileges. This rule targets Deployment, Pod, DaemonSet, StatefulSet, ReplicaSet, CronJob, and Job resources. In Kubernetes versions earlier than 1.24, containers default to unconfined if no profile is specified, making them susceptible to this threat.

  6. Understand the Cluster Posture Score

    Each cluster with Datree installed is assigned a posture score ranging from A to E. This score is calculated based on the number of misconfigurations detected during Datree's scans and serves as an indicator of the overall validity and stability of the cluster's resources.

  7. Datree Data Privacy and Policy Evaluation

    Datree performs policy evaluations locally on the user's machine. The contents of Kubernetes resources are not transmitted externally during the evaluation process.

  8. Understand Datree policy check execution and data privacy

    Datree performs policy evaluations entirely locally within the user's environment. Your files and their contents are never sent to or stored on the Datree backend; Datree does not have access to your files. Communication between the CLI and the dashboard is encrypted via HTTPS using SSL.

  9. Integrate Datree into the Kubernetes workflow

    Datree can be integrated at various stages of the Kubernetes lifecycle:

    • Develop: Run the CLI locally or as a pre-commit hook for instant validation.
    • Distribute (CI): Integrate with CI platforms to shift-left policy checks.
    • Deploy (CD): Use an admission webhook to gate the cluster.
    • Runtime: Use the kubectl-datree plugin to query deployed resources and check status.

  10. Understand how Datree triggers policy validation

    Datree uses a Kubernetes admission webhook to monitor and validate objects against configured policies. Validation is triggered during create, apply, and edit operations. By default, enforcement mode is disabled after installation; when enabled, the webhook will reject operations that contain misconfigurations and provide detailed resolution instructions.

  12. Track policy check executions using the Datree Activity Log

    The Activity Log in the Datree Hub records every executed policy check, enabling users to monitor executions from different sources and their corresponding results. The interface is split into two sections: a left pane containing a list of all performed policy checks and a right pane that displays detailed information for a specifically selected check.