4.3. Checking deployment YAML files

Procedure

• Run the following command to check the build-time and deploy-time violations of your security policies in YAML deployment files:

  $ roxctl deployment check --file=<yaml_filename> \
  --namespace=<cluster_namespace> \
  --cluster=<cluster_name_or_id> \
  --verbose

  where:

  <yaml_filename>

  Specifies the YAML file with one or more deployments to send to Central for policy evaluation.

  <cluster_namespace>

  Specifies a namespace to enhance deployments with context information such as network policies, role-based access controls (RBACs), and services for deployments that do not have a namespace in their specification. The namespace defined in the specification is not changed. The default value is default.

  <cluster_name_or_id>

  Specifies the cluster name or ID that you want to use as the context for the evaluation to enable extended deployments with cluster-specific information.

  --verbose

  Specifies that you receive additional information for each deployment during the policy check, including the RBAC permission level and a comprehensive list of applied network policies.

  The format is defined in the API reference. To cause Red Hat Advanced Cluster Security for Kubernetes (RHACS) to re-pull image metadata and image scan results from the associated registry and scanner, add the --force option.

  注意

  To check specific image scan results, you must have a token with both read and write permissions for the Image resource. The default Continuous Integration system role already has the required permissions.

  This command validates the following items:

  • Configuration options in a YAML file, such as resource limits or privilege options
  • Aspects of the images used in a YAML file, such as components or vulnerabilities