Quick start

Onboarding for security professionals: security tools, reports, and section navigation.

Who is this page for? #

If this is your first time working as a security specialist on the Shturval platform, this page provides a brief overview of built-in tools for assessing and securing clusters, reports, and documentation sections.

Security tools in the platform #

The Shturval platform includes built-in tools for assessing and securing clusters. Detailed instructions are in the corresponding subsections of For security specialists.

Container image scanning (Trivy) #

Container images are scanned for vulnerabilities with Trivy (in the platform, the container image scanning module shturval-scanner). Trivy is a universal security scanner for CVEs, misconfigurations, secrets, SBOM, and more in containers, Kubernetes, repositories, and other targets.

In the cluster, the platform provides:

• automated image scanning and report generation;
• by default, scanning uses the platform aggregated vulnerability database, including FSTEC BDU data and domestic OS BDU sources (including RED OS and Astra). You can also connect the native Trivy database, NVD, and other sources in the configuration.

Results appear on Security → Image Analysis in the cluster interface. A platform-wide summary report is available in the summary reports section. For details, see Container image analysis.

Host and platform scanning (CIS Benchmark, Trivy) #

Cluster configuration is checked against security standards with Trivy (Compliance Reports). Results appear on Security → Scan Results in the interface.

Supported reports:

• CIS Kubernetes Benchmark (k8s-cis-1.23);
• NSA Kubernetes Hardening Guide (k8s-nsa-1.0);
• Kubernetes Pod Security Standards — Baseline and Restricted (k8s-pss-baseline-0.1, k8s-pss-restricted-0.1).

By default, the detailed report is generated on a schedule (for example, every 6 hours). For details, see Scan results.

Security policies (Kyverno) #

Cluster objects are checked against security policies with Kyverno. The platform supports Generate, Mutate, and Validate policies (including blocking and validating policies).

Available features:

• Security Policy Manager — create, view, edit, and delete policies (including manifest import);
• Security policy report — results by policy and namespace; export to CSV/PDF.

A summary report on policies across all platform clusters is available in the summary reports section. Recommended policies are described in Security policies and Kyverno. Additional practices: Kyverno policies — best-practices.

Seccomp #

The platform lets you manage Seccomp profiles for workloads: limit system calls in containers to reduce the attack surface. Profiles are created via NCI (NodeConfigItem) and specified in the pod/container securityContext. For details, see Seccomp.

Audit and logging #

• Kubernetes audit policy — configured via NodeConfigItem (node configuration). When deploying a cluster with advanced security settings, audit events are available on the Logs tab of the cluster dashboard.
• Log export to SIEM — configured separately to forward logs to external systems.

For details, see Audit policy and Vector and log export.

Secrets management #

Integration with HashiCorp Vault is supported for storing and issuing secrets to applications in the cluster. For details, see HashiCorp Vault integration.

Platform security #

• Secure build pipeline — platform components are built with SAST, SCA, image scanning (Trivy), secret detection, and more. See Secure build pipeline.

Additional #

• Session Manager — view active user sessions in the GUI and terminate sessions — Session Manager.
• Overlay security tools — connect partner marketplace products such as Kaspersky Container Security, Luntry, and others — Marketplace.

Main capabilities #

Where to start #

1. Review security policies.
2. Explore the summary report and image analysis.
3. If needed, configure policies (Kyverno, Seccomp) and image/host scanning.