Kubernetes Connector

Overview

Key Components

The Chkk Kubernetes Connector is composed of two main components:

Chkk Operator
Chkk Agent

Working together, these components periodically (or on-demand) extract cluster metadata and ingest it into the Chkk SaaS platform. Once ingestion is complete, Chkk scans and analyzes your environment for potential risks or helpful insights (e.g., add-on, application service, and Kubernetes operator instances running in your cluster).

Chkk Operator

The Chkk Operator is a Kubernetes Operator that manages and configures the Chkk Kubernetes Connector. It deploys Chkk Agent through a single Custom Resource Definition (CRD) and simplifies configurations by:

Providing a single source of truth (the CRD) for your Connector.
Reporting deployment status, health, and errors in the CRD’s status.
Limiting the risk of potential misconfigurations by enforcing higher-level settings.

Once deployed, the Operator:

Validates your Chkk Connector configurations.
Keeps the Connector aligned with your CRD-based configuration.
Orchestrates creation and updates of the Connector resources.
Reports the Connector’s status in the Operator’s CRD.

Chkk Agent

Chkk Agent is a Kubernetes Custom Resource managed by the Operator. It defines how and when to collect data from your cluster. Some key features include:

Manages the Agent CronJob: Schedules periodic scans of your cluster to keep you informed of the latest known risks.
Resource Filtering: Allows you to include or exclude specific namespaces or resource types.

Setup

Prerequisites

Before installing the Chkk Kubernetes Connector, ensure the following:

Allowlisted Access
- You must be allowlisted to access the Chkk SaaS. Contact us to get a dedicated Chkk Organization provisioned for you: chkk.io.
Network Firewall Rules
- If your cluster is in a restricted network, allow outbound connections to:
  - chkk.io and its subdomains
  - s3.amazonaws.com and its subdomains
Proxy Settings
- If you use a proxy server, you will be required to configure the HTTP_PROXY, HTTPS_PROXY, and NO_PROXY environment variables at the time of installation.
Image Hosting
- The Chkk Kubernetes Connector container images are hosted publicly on the Amazon ECR Public Registry. Ensure your cluster can pull images from this registry.
- Chkk supports custom registries. If you host all images in a private registry, detailed configuration instructions will be provided during installation.

Resource Requirements

Below are the baseline resource requests for each component of the Chkk Kubernetes Connector. Actual usage varies by cluster size and scan frequency.

Component	CPU	Memory
Chkk Operator	100m	256Mi
Chkk Agent	500m	1024Mi
Chkk Agent Manager	50m	128Mi

Supported Kubernetes Distributions

The Chkk Kubernetes Connector is compatible with all Kubernetes providers that are compliant with the upstream API. For the list of supported Kubernetes providers and versions, refer to Support and Compatibility

Installation Modes

There are three deployment methods available for installing the Chkk Kubernetes Connector:

Helm
K8s YAML
Terraform

System Requirements

Before installing the Chkk Kubernetes Connector, please ensure that your system meets the minimum requirements for the selected deployment method:

Helm

K8s YAML

Terraform

Installation & Validation

Log in to the Chkk Dashboard: chkk.io.
In the left-hand sidebar, navigate to Risk Ledger → Clusters.
Click Add Cluster in the top-right corner.
Follow the step-by-step instructions and select your preferred deployment mode.

Configuration

Configuration Parameters

The table below lists the configurable parameters for installing the Chkk Operator.

Parameter	Description	Sample Default
`image.repository`	Image repository	`public.ecr.aws/chkk/operator`
`image.tag`	Image tag	`v0.0.14`
`image.pullPolicy`	Image pull policy	`Always`
`replicaCount`	Number of replicas	`1`
`revisionHistoryLimit`	Revision history limit	`2`
`secret.create`	Create a new secret	`true`
`secret.chkkAccessToken`	Chkk access token	`CHKK-ACCESS-TOKEN`
`secret.ref.secretName`	Name of an existing Secret with the Chkk access token (only used if `secret.create=false`)	`chkk-operator`
`secret.ref.keyName`	Key in the existing Secret’s `data` that contains the token (only used if `secret.create=false`)	`CHKK_ACCESS_TOKEN`
`serviceAccount.create`	Create a service account	`true`
`serviceAccount.name`	Service account name	`chkk-operator-sa`
`podAnnotations`	Annotations applied to the Chkk Operator Pod	`{ chkk.io/name: "chkk-operator" }`
`disableAnalytics`	Disable analytics data collection	`false`
`proxy.http_proxy`	HTTP proxy	`""`
`proxy.https_proxy`	HTTPS proxy	`""`
`proxy.no_proxy`	No proxy	`""`
`tolerations`	Node tolerations	See `values.yaml`
`nodeSelector`	Node labels for scheduling	`{}`
`affinity`	Pod scheduling affinity	See `values.yaml`
`securityContext`	Pod-Level Security Context	See `values.yaml`
`containerSecurityContext`	Container-Level Security Context	See `values.yaml`

Configuration Examples

Custom Secret

If you prefer to manage the secret externally, set secret.create to false and reference your secret in the values.yaml file:

secret:
  create: false
  ref:
    secretName: my-secret
    keyName: CHKK_ACCESS_TOKEN

Custom RBAC

To customize the RBAC settings, modify the serviceAccount parameters in the values.yaml file. You can specify whether to create a new service account and provide a custom name.

serviceAccount:
  create: false
  name: chkkagent-custom-sa

Custom Image

To use a custom image, update the image.repository and image.tag fields in the values.yaml file. You can also set the image.pullPolicy to control when the image is pulled.

image:
  repository: custom-repo/chkk/operator
  tag: v0.0.14
  pullPolicy: IfNotPresent

Tolerations

To schedule the Chkk Operator on nodes with specific taints, configure the tolerations section in the values.yaml file. You can specify the key, operator, value, and effect for each toleration.

tolerations:
  - key: "example.com/special-taint"
    operator: "Equal"
    value: "true"
    effect: "NoSchedule"

Proxy Configuration

When configuring the Chkk Connector to run behind a proxy, set the following fields in your values.yaml to ensure proper connectivity and to disable telemetry reporting.

You must set disableAnalytics: true when defining proxy settings.

proxy:
  http_proxy: "http://your-proxy.example.com:3128"
  https_proxy: "http://your-proxy.example.com:3128"
  no_proxy: "localhost,127.0.0.1,.svc,.cluster.local"

disableAnalytics: true

This ensures the Chkk Operator and Agent operate correctly within your network environment.

Upgrade

Get the current version of Helm chart installed in your K8s cluster

helm list -n chkk-system -o json

Sample output:

[{
  "name": "chkk-operator",
  "namespace": "chkk-system",
  "revision": "1",
  "chart": "chkk-operator-0.0.9",
  "app_version": "0.0.9"
}]

Update the Helm repository

Update the Helm repository to fetch latest chart

helm repo update chkk

Upgrade the Kubernetes Connector

Replace <CHKK_ACCESS_TOKEN> with your Chkk ingestion token, which you can copy from the Chkk Dashboard under Settings → Tokens.

Create a new Secret and ServiceAccount

Run the following command to upgrade the Chkk Kubernetes Connector to the latest version.

helm upgrade chkk-operator chkk/chkk-operator \
  --namespace chkk-system \
  --set secret.chkkAccessToken=<CHKK_ACCESS_TOKEN>

Use the existing Secret with a new ServiceAccount

Verify the Secret exists in your cluster

kubectl get secret chkk-operator-token -n chkk-system

Sample output:

NAME                   TYPE                                  DATA   AGE
chkk-operator-token    Opaque                                1      10m

Run the following command to upgrade the Chkk Kubernetes Connector to the latest version using the existing Secret.

helm upgrade chkk-operator chkk/chkk-operator \
  --namespace chkk-system \
  --set secret.ref.secretName=chkk-operator-token \
  --set secret.ref.keyName=<CHKK_ACCESS_TOKEN> \
  --set secret.create=false

Use the existing Secret and ServiceAccount

Verify the ServiceAccount and Secret with the Chkk access token exists in your cluster

Get the Secret:

kubectl get secret chkk-operator-token -n chkk-system

Sample output:

NAME                   TYPE                                  DATA   AGE
chkk-operator-token    Opaque                                1      10m

Get the ServiceAccount:

kubectl get serviceaccount chkk-operator -n chkk-system

Sample output:

NAME               SECRETS   AGE
chkk-operator      1        10m

Run the following command to upgrade the Chkk Kubernetes Connector to the latest version using the existing ServiceAccount and Secret.

helm upgrade chkk-operator chkk/chkk-operator \
  --namespace chkk-system \
  --set secret.ref.secretName=chkk-operator-token \
  --set secret.ref.keyName=<CHKK_ACCESS_TOKEN> \
  --set secret.create=false \
  --set serviceAccount.create=false \
  --set serviceAccount.name=<SERVICE_ACCOUNT>

Verify the upgrade

kubectl get deployment chkk-operator -n chkk-system -o json \
| jq '.spec.template.spec.containers[].image'

Sample output:

"public.ecr.aws/chkk/operator:v0.0.14"

Overview

Covered OSS Projects

Product Details

AI

Operationalizing Chkk

Connectors

Security & Trust

Use Cases & Insights

Resources

Overview

Key Components

Chkk Operator

Chkk Agent

Setup

Prerequisites

Resource Requirements

Supported Kubernetes Distributions

Installation Modes

System Requirements

Installation & Validation

Configuration

Configuration Parameters

Configuration Examples

Upgrade

Overview

Covered OSS Projects

Product Details

AI

Operationalizing Chkk

Connectors

Security & Trust

Use Cases & Insights

Resources

​Overview

​Key Components

​Chkk Operator

​Chkk Agent

​Setup

​Prerequisites

​Resource Requirements

​Supported Kubernetes Distributions

​Installation Modes

​System Requirements

​Installation & Validation

​Configuration

​Configuration Parameters

​Configuration Examples

​Upgrade

Overview

Key Components

Chkk Operator

Chkk Agent

Setup

Prerequisites

Resource Requirements

Supported Kubernetes Distributions

Installation Modes

System Requirements

Installation & Validation

Configuration

Configuration Parameters

Configuration Examples

Upgrade