Quick start

Onboarding for security professionals: tools, reports, and section navigation.

Who is this page for? #

If this is your first time working as a security specialist on the Shturval platform, this page gives a brief overview of built-in cluster assessment and hardening tools, reports, and documentation sections.

Security tools in the platform #

The Shturval platform includes built-in tools for assessing and securing clusters. Detailed instructions are in the subsections of For security specialists.

Container image scanning (Trivy) #

Container images are scanned for vulnerabilities with Trivy (platform module shturval-scanner). Trivy is a universal security scanner for CVEs, misconfigurations, secrets, and SBOM in containers, Kubernetes, repositories, and more.

The cluster provides:

• automated image scanning and report generation;
• by default, scanning uses the platform aggregated vulnerability database, including FSTEC BDU and domestic OS BDU sources (RED OS, Astra, and others). You can also connect the native Trivy database, NVD, and other sources.

Results appear on Security → Image Analysis in the cluster GUI. A platform-wide summary report is available in summary reports. More details: Scanning container images.

Host and platform scanning (CIS Benchmark, Trivy) #

Cluster configuration is checked against security standards with Trivy (Compliance Reports). Results appear on Security → Scan Results in the GUI.

Supported reports:

• CIS Kubernetes Benchmark (k8s-cis-1.23);
• NSA Kubernetes Hardening Guide (k8s-nsa-1.0);
• Kubernetes Pod Security Standards - Baseline and Restricted (k8s-pss-baseline-0.1, k8s-pss-restricted-0.1).

By default, the detailed report is generated on a schedule (for example, every 6 hours). More details: Scanning hosts and platforms (CIS Benchmarks).

Security Policies (Kyverno) #

Cluster objects are checked against security policies with Kyverno. Supported policy types: Generate, Mutate, and Validate (including blocking and validating). Available:

• Security Policy Manager — create, view, edit, and delete policies (including manifest import);
• Security policy report — results by policy and namespace; export to CSV/PDF.

A summary report on the policies of all platform clusters is available in the summary reports section. Recommended policies (prohibiting latest, requiring CPU/RAM requests and limits, prohibiting privileged containers, etc.) are described in the section Kyverno: prohibiting latest tags, requiring limits. Additional practices: Kyverno policies - best-practices.

Seccomp #

The platform allows you to manage Seccomp profiles for workloads: limiting system calls in containers to reduce the attack surface. Profiles are created via NCI (NodeConfigItem) and specified in the pod/container’s securityContext. More details: Seccomp.

Auditing and logging #

• Kubernetes audit policy - configured via NodeConfigItem (node configuration). When deploying a cluster with advanced security settings, audit events are available on the Logs tab of the cluster dashboard.
• Export of logs to SIEM - can be configured separately to redirect logs to external systems.

More details: Setting up Audit Logs, Exporting security logs to SIEM.

Managing secrets #

Integration with HashiCorp Vault is supported for storing and issuing secrets to applications in the cluster. More details: Vault HashiCorp Integration.

Platform security #

• Secure build — platform components are built with SAST, SCA, image scanning (Trivy), secret detection, and related checks — see Secure build.

Additional #

• Session Manager — view active user sessions in the GUI and terminate sessions (platform access section).
• Overlay security tools — connect partner marketplace products such as Kaspersky Container Security and Luntry.

Main capabilities #

Where to start #

1. Review security tools in the platform.
2. Learn what reports are available and where to view them.
3. If necessary, configure policies (Kyverno, network policies, Seccomp) and image/host scanning.