Skip to content

Commit

Permalink
docs: document verbose commands
Browse files Browse the repository at this point in the history
  • Loading branch information
shaneboulden committed Jan 30, 2024
1 parent 7c0f2f0 commit 7c13552
Show file tree
Hide file tree
Showing 3 changed files with 31 additions and 7 deletions.
2 changes: 0 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,6 @@ yes
Run `kacti`:
```
$ kacti trials --deploy --namespace kacti --image quay.io/smileyfritz/log4shell-app:v0.5 log4shell
Setting up kubeconfig from: /home/user/.kube/config
Running trial: log4shell { ns: kacti / img: quay.io/smileyfritz/log4shell-app:v0.5 }
-> Success, Deployment scaled to zero replicas
```
You can find more `kacti` guides in the [docs](https://kacti.dev/docs/intro).
Expand Down
32 changes: 30 additions & 2 deletions docs/kacti/docs/kacti-trials/kacti-trials.md
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,11 @@ When a ship is newly constructed or comes out of a significant refit period it w

In a similar way, `kacti` uses trials to validate Kubernetes admission control. How does the admission controller perform - does it block workloads containing critical CVEs, or trying to expose SSH? Does it permit valid workloads to be accepted by the cluster?

Each trial represents a distinct test, validating whether the container image / configuration is blocked, or accepted by the Kubernetes cluster.
Each trial represents a distinct test, validating whether the container image / configuration is blocked, or accepted by the Kubernetes cluster.

Trials consist of a Kubernetes API under test (currently only Deployments are supported), a name and description, a namespace, and an image.

## Running trials
You can run trials using the following command:
```
$ kacti trials --deploy --namespace kacti --image quay.io/smileyfritz/log4shell-app:v0.5 log4shell
Expand All @@ -24,7 +25,34 @@ In this example:
`kacti` will display the result of the trial. If the deployment was successfully created and scaled up, the result will be a `failure`. Otherwise, if the deployment creation was blocked, or the number of replicas was scaled to zero, the result will be `success`.
```
$ kacti trials --deploy --namespace kacti --image quay.io/smileyfritz/log4shell-app:v0.5 log4shell
-> Success, Deployment scaled to zero replicas
```
## Using short-hand
`kacti` also accepts short-hand flags for imperative trials. You can see all of the options using `kacti trials -h`.
```
Perform functional verification trials against Kubernetes admission controllers.
Usage:
kacti trials [flags]
Flags:
-d, --deploy Run a deployment trial
-f, --file Run a set of trials from a file
-h, --help help for trials
-i, --image string Image for the trial
-n, --namespace string Namespace for the trial
-v, --verbose Verbose output
```
You can see an example here:
```
$ kacti trials -d -n kacti -i quay.io/smileyfritz/log4shell-app:v0.5 log4shell
```

## More trial details
You can get more detail on trial activity using the `--verbose` flag:
```
$ kacti trials --deploy --namespace kacti --image quay.io/smileyfritz/log4shell-app:v0.5 log4shell --verbose
Setting up kubeconfig from: /home/user/.kube/config
Running trial: log4shell { ns: kacti / img: quay.io/smileyfritz/log4shell-app:v0.5 }
-> Success, Deployment scaled to zero replicas
-> Success, Deployment creation was blocked
```
4 changes: 1 addition & 3 deletions docs/kacti/docs/kacti-trials/trials-from-file.md
Original file line number Diff line number Diff line change
Expand Up @@ -40,10 +40,8 @@ $ cat << EOF > kacti.yaml
EOF
$ kacti trials --file kacti.yaml
Setting up kubeconfig from: /home/user/.kube/config
Using trials from: kacti.yaml
Running trial: log4shell { ns: kacti / img: quay.io/smileyfritz/log4shell-app:v0.5 }
Results:
log4shell { ns: kacti / img:quay.io/smileyfritz/log4shell-app:v0.5 }
-> Success, Deployment scaled to zero replicas
```
```

0 comments on commit 7c13552

Please sign in to comment.