github.com/datreeio/datree

Explore the docs »

Datree

Datree (pronounced /da-tree/) secures your Kubernetes by blocking the deployment of misconfigured resources.

✌️ Quick-start in two steps

Install Datree to get insights on the status of your cluster and enforce your desired policies on new resources.

NOTE:
By default, Datree does not block misconfigured resources, it only monitors and alerts about them.
To enable enforcement mode, see the documentation.

1. Add the Datree Helm repository

Run the following command in your terminal:

helm repo add datree-webhook https://datreeio.github.io/admission-webhook-datree
helm repo update

2. Install Datree on your cluster

Replace <DATREE_TOKEN> with the token from your dashboard, and run the following command in your terminal:

helm install -n datree datree-webhook datree-webhook/datree-admission-webhook --debug \
--create-namespace \
--set datree.token=<DATREE_TOKEN> \
--set datree.clusterName=$(kubectl config current-context)

This will create a new namespace (datree), where Datree’s services and application resources will reside. datree.token is used to connect your dashboard to your cluster. Note that the installation can take up to 5 minutes.

Looking for a different installation method?
    
Datree also supports installation via ArgoCD, Flux and Openshift. See our documentation for instructions.

⚙️ How it works

Datree scans Kubernetes resources against a centrally managed policy, and blocks those that violate your desired policies.

Datree comes with over 100 rules covering various use-cases, such as workload security, high availability, ArgoCD best practices, NSA hardening guide, and many more.

In addition to our built-in rules, you can write any custom rule you wish and then run it against your Kubernetes configurations to check for rule violations. Custom rules can be written in JSON schema or in Rego.

📊 Management dashboard (web application)

Datree's dashboard provides valuable information about your clusters' health and stability. It details the resources that failed your policy checks, and shows you how to fix each violation.

Datree can be configured via code or via the dashboard. The dashboard offers the following capabilities in an intuitive visual interface:

• Control Datree's configuration:
  • Default action on failure - set whether resources that failed the policy check should be blocked or only monitored
  • Set which policy to use for your checks
  • Define resources and/or namespaces to ignore
• Create & customize policies
• Edit rules' failure message
• Issue tokens
• View policy check history
• Configure Kubernetes schema version

🤩 Additional features

Datree offers a suite of features to make adoption seamless:

• Monitoring - By default, Datree is installed in monitoring mode and does not block deployments until you decide to do so.
• CLI - Help your developers find misconfigurations in their configs before deploying them, by integrating Datree into their CI.
• Simple integrations - Datree works seamlessly with popular CD tools such as ArgoCD and FluxCD, and comes with ready-made integrations for various CI platforms.
• Cluster score - Rank the stability of your cluster based on the number of detected misconfigurations.

Contributing

Contributions are welcome!

Thank you to all the people who already contributed to Datree ❤️