Kubernetes clusters

The checkops-agent agent runs in your cluster, read-only and with no inbound port. Once an hour it sends CheckOps the images that actually run, matched to your products. When Trivy Operator is installed, it also sends its reports: image SBOMs and vulnerabilities, configuration audit, RBAC, nodes, exposed secrets (never the secret itself) and CIS score, plus the PolicyReports of Kyverno, Kubewarden and kube-bench.

Note

Clusters per plan: Starter 1, Pro 5, Business 20. A new cluster beyond the limit is refused on its first upload.

Add a cluster

In CheckOps, open Clusters → Add a cluster. The wizard:

1. asks for the cluster name (lowercase letters, digits, ., _, -), which must be unique in your organisation;
2. creates an API token dedicated to this cluster and shows the commands below, ready to copy;
3. waits for the agent’s first upload, then links to the cluster page.

Commands, run with kubectl pointed at the cluster:

kubectl create namespace checkops
kubectl -n checkops create secret generic checkops-agent-token --from-literal=CHECKOPS_TOKEN='ck_live_...'

helm upgrade --install checkops-agent oci://harbor.clearcloud.fr/helm-charts/checkops-agent -n checkops \
  --set clusterName='prod-paris' \
  --set checkopsUrl='https://api.checkops.eu' \
  --set existingSecret=checkops-agent-token

Several clusters

Install the agent once per cluster, each time with its own clusterName: two installs with the same name would overwrite each other’s inventory. One token per cluster is recommended, so that you can revoke one without stopping the others.

The Clusters page lists every cluster with its Kubernetes version, the agent’s last upload, containers, open critical and high vulnerabilities, compliance score, exposed secrets and Falco alerts of the last 7 days. Click a cluster to see its details.

Remove a cluster

Uninstall the agent first (helm uninstall checkops-agent -n checkops), then open the cluster in CheckOps and use Remove this cluster at the bottom of the page. Its workloads, audit, secrets and Falco alerts are deleted. Without uninstalling, the cluster comes back at the agent’s next upload.

Troubleshooting

kubectl -n checkops logs deploy/checkops-agent

The first lines show the connection to Kubernetes and to CheckOps, and the error if any (invalid token, plan limit reached).