Merge pull request #347 from intelops/kubehealthy-readme

kuberhealthy-trivy-enhance-readme

README.md

@@ -233,6 +233,37 @@ The TTL value is customizable, empowering you to define the specific duration af
 
 To guide you through the process of setting up a TTL, [please follow these steps](docs/CONFIGURATION_TTL.md)
 
+#### Customizing Security Scanning
+
+KubViz enables you to perform cluster scans, image scans, and SBOM creation in CycloneDX format. Utilizing this scan, vulnerabilities can be identified.
+
+You can customize the security scans by changing the chart values.
+
+- To [Disable](https://github.com/intelops/kubviz/blob/main/charts/agent/values.yaml#L186) the cluster scan you can pass 0 or empty string
+
+```yaml
+schedule:
+  enabled: true
+  trivyclusterscanInterval: 0
+...
+```
+- For changing the interval, pass the interval time
+
+```yaml
+schedule:
+  enabled: true
+  trivyclusterscanInterval: "@every 24h"
+...
+```
+
+Same you can change for [image-scan](https://github.com/intelops/kubviz/blob/main/charts/agent/values.yaml#L184) and [sbom](https://github.com/intelops/kubviz/blob/main/charts/agent/values.yaml#L185)
+
+## Health Check
+
+You can run different types of checks against your Kubernetes cluster to detect any issues or potential problems before they cause any downtime or service disruptions. Check will run in the background and sends data to kubviz. After analysing the data from dashboard you can take corrective action quickly, if any issues are detected.
+
+Please check the [configuration](docs/CONFIGURATION_HEALTHCHECK.md) for health checks
+
 ## Use Cases
 
 ### Cluster Event Tracking

docs/CONFIGURATION_HEALTHCHECK.md

@@ -0,0 +1,82 @@
+## Introduction
+
+All health checks are enabled by default upon installing the KubViz agent. They are automatically included, but if you don't need them, you can disable them.
+
+```yaml
+kuberhealthy:
+  enabled: false
+...
+```
+
+## Types of Checks
+
+Check Name | Description |
+------ | -------- | 
+Daemonset check | Ensures daemonsets can be successfully deployed |
+DNS status check | Checks for failures with DNS, including resolving within the cluster and outside of the cluster |
+Deployment check | Ensures that a Deployment and Service can be provisioned, created, and serve traffic within the Kubernetes cluster |
+Image pull check | Verifies that an image can be pulled from an image repository | 
+Pod status check | Checks for unhealthy pod statuses in a target namespace |
+Pod restart | Checks for excessive pod restarts in any namespace |
+Resource quota check | Checks if resource quotas (CPU & memory) are available |
+
+## Configuration
+
+- Daemonset, Deployment, and DNS checks are enabled by default.
+
+- Pod Status, Pod Restart, Image Pull, and Resource Quota checks need to be manually enabled.
+
+```yaml
+check:
+    podRestarts:
+      enabled: true
+...
+```
+
+```yaml
+    podStatus:
+      enabled: true
+...
+```
+
+```yaml
+    imagePullCheck:
+      enabled: true
+...
+```
+
+```yaml
+    resourceQuota:
+      enabled: true
+...
+```
+
+### Additional configuration for image-pull check 
+
+1. Pull the test image from docker hub
+
+```bash     
+docker pull kuberhealthy/test-check
+```
+
+2. Push this image on the repository you need tested.
+
+```bash
+docker push my.repository/repo/test-check
+```
+
+- The pod is designed to attempt a pull of the test image from the remote repository (never from local). If the image is unavailable, an error will be reported to the API
+
+### Additional configuration for resource quota check
+
+This check tests if namespace resource quotas CPU and memory are under a specified threshold or percentage.
+
+You need to add the namespaces to the 'WHITELIST'.
+
+```yaml
+      extraEnvs:
+        BLACKLIST: "default"
+        WHITELIST: "kube-system,kubviz"
+...
+```
+