anilpothula / datree

Prevent Kubernetes misconfigurations from reaching production (again 😤 )! From code to cloud, Datree provides an E2E policy enforcement solution to run automatic checks for rule violations. See our docs: https://hub.datree.io

Explore the docs »

Datree

Datree (pronounced /da-tree/) is a cloud native solution to prevent Kuberentes misconfigurations by blocking resources that do not meet your policy.

✌️ Quick-start in two steps

Install Datree to get insights on the status of your cluster and enforce your desired policies on new resources.

NOTE:
By default, Datree does not block misconfigured resources, it only monitors and alerts about them.
To enable enforcement mode, see the documentation.

1. Add the Datree Helm repository

Run the following command in your terminal:

helm repo add datree-webhook https://datreeio.github.io/admission-webhook-datree
helm repo update

2. Install Datree on your cluster

Replace <DATREE_TOKEN> with the token from your dashboard, and run the following command in your terminal:

helm install -n datree datree-webhook datree-webhook/datree-admission-webhook --debug \
--create-namespace \
--set datree.token=<DATREE_TOKEN> \
--set datree.clusterName=$(kubectl config current-context)

This will create a new namespace (datree), where Datree’s services and application resources will reside. datree.token is used to connect your dashboard to your cluster. Note that the installation can take up to 5 minutes.

⚙️ How it works

Datree scans Kubernetes resources against a centrally managed policy, and blocks those that violate your desired policies.

Datree comes with multiple pre-built policies covering various use-cases, such as workload security, high availability, ArgoCD best practices, NSA hardening guide, and many more.

In addition to our built-in rules, you can write any custom rule you wish and then run it against your Kubernetes configurations to check for rule violations. The custom rule engine is based on JSON Schema.

🤩 Additional features

Datree offers a suite of features to make adoption seamless:

• Monitoring - Datree is first installed in monitoring mode that reports on policy violations, rather than block their deployments.
• CLI - Help your developers find misconfigurations in their configs before deploying them, by integrating Datree into their CI.
• Misconfiguration prioritization - Datree makes it easy to improve the quality of your cluster by prioritizing the misconfigurations to be fixed.
• Cluster score - Rank the stability of your cluster based on the number of detected misconfigurations.

📊 Management dashboard (web application)

Datree can be customized via code (policy as code) or via a management dashboard. The dashboard offers the following capabilities in an intuitive visual interface:

• Customize policies
• Edit rules failure message
• Issue tokens
• View policy check history
• Configure Kubernetes schema version

Contributing

Contributions are welcome!

Thank you to all the people who already contributed to Datree ❤️