Deep Security Smart Check uses the helm package manager for Kubernetes.

To install Deep Security Smart Check you must have a running Amazon EKS cluster.

Follow the instructions here to create an Amazon EKS cluster.

Then create a storage class as described here. You will specify the storage class name when you install Deep Security Smart Check.

You will need helm version v2.8.0 or later. There's a handy quickstart that will help you get started, or if you like living dangerously:

curl https://raw.githubusercontent.com/kubernetes/helm/master/scripts/get | bash

Helm has a cluster-side component called tiller that needs to be installed as well.

Make sure that your kubectl context is set correctly to point to your cluster:

kubectl config current-context

If your kubectl context is not pointing to your cluster, use kubectl config get-contexts and kubectl config use-context to set it.

Install the tiller cluster-side component:

helm init

You will also need to configure a service account for tiller:

kubectl create serviceaccount \
  --namespace kube-system \
  tiller

kubectl create clusterrolebinding tiller-cluster-role \
  --clusterrole=cluster-admin \
  --serviceaccount=kube-system:tiller

kubectl patch deploy \
  --namespace kube-system \
  tiller-deploy \
  --patch '{"spec":{"template":{"spec":{"serviceAccount":"tiller"}}}}'

Use helm version to confirm that you have at least version v2.8.0 of the client and server installed.

Note: the commands above will give tiller full cluster administrator privileges. Review Securing your Helm Installation for help on what to consider when setting up Helm in your cluster.

We recommend that you register for a 30-day trial license code. Deep Security Smart Check will operate without an activation code; however, malware pattern updates will not be available and you will see a warning message in the administration console.

The Helm chart for Deep Security Smart Check is hosted in a public repository on Github.

To install Deep Security Smart Check into the default Kubernetes namespace:

helm install \
  --set auth.masterPassword={password} \
  --set activationCode={activation code} \
  --set persistence.storageClassName={storage class name} \
  --name deepsecurity-smartcheck \
  https://github.com/deep-security/smartcheck-helm/archive/1.0.8-aws-container-marketplace.tar.gz

Experienced helm users will note that we are using deepsecurity-smartcheck as the helm release name in these examples. There is no requirement to use this release name.

Note: If you do not have an activation code then omit the --set activationCode={activation code} line.

The install process will display instructions for obtaining the initial username and password and for connecting to Deep Security Smart Check.

You can delete all of the resources created for Deep Security Smart Check by running helm delete:

helm delete --purge deepsecurity-smartcheck

Use the helm list command to list installed releases.

This is a destructive command and will delete all of the Deep Security Smart Check resources, including database contents, without further confirmation.

Our docs page provides links to the Deep Security Smart Check Deployment Guide and full API documentation.

To install Deep Security Smart Check into an existing Kubernetes namespace that's different from the current kube config namespace, use the --namespace parameter in the helm install command:

helm install \
  --namespace {namespace} \
  --set auth.masterPassword={password} \
  --set persistence.storageClassName={storage class name} \
  --name deepsecurity-smartcheck \
  https://github.com/deep-security/smartcheck-helm/archive/1.0.8-aws-container-marketplace.tar.gz

Helm uses a file called values.yaml to set configuration defaults.

You can override the defaults in this file by specifying a comma-separated list of key-value pairs on the command line:

helm install \
  --set key1=value1,key2=value2,... \
  --name deepsecurity-smartcheck \
  https://github.com/deep-security/smartcheck-helm/archive/1.0.8-aws-container-marketplace.tar.gz

or by creating a YAML file with the specific values you want to override and providing the location of this file on the command line:

helm install \
  --values overrides.yaml \
  --name deepsecurity-smartcheck \
  https://github.com/deep-security/smartcheck-helm/archive/1.0.8-aws-container-marketplace.tar.gz

If you create a file to override the values, make sure to copy the structure from the chart's values.yaml file. You only need to provide the values that you are overriding.

Refer to the values.yaml file for a full list of available values to override; some common keys are listed here:

See the wiki page Replacing the service certificate.

The Helm team have some helpful guidelines for securing your Helm installation as well as an abbreviated list of best practices for reference.

Deep Security Smart Check stores its data in a postgres database.

The following example command will perform a full database dump, compressing the output and writing it to the file db.gz in the current directory. You can then archive the db.gz file according to your needs.

kubectl exec $(kubectl get pods -l service=db -o jsonpath='{.items[0].metadata.name}') -- \
  sh -c 'pg_dumpall -U $POSTGRES_USER | gzip -' \
  > db.gz

Note: If you are running Deep Security Smart Check in a namespace other than the default namespace and your kubectl context is not set to use that namespace, you will need to add the --namespace NAMESPACE parameter to both kubectl commands in this example.

Important: While Deep Security Smart Check encrypts credentials stored in the database, the database backup file contains other information that you may consider sensitive, such as registry locations, names, and scan results. Ensure that you store your backups safely with appropriate access controls to prevent misuse or accidental disclosure.

The following example command will perform a database restore from the compressed database dump created in the previous procedure.

kubectl exec -i \
  $(kubectl get pods -l service=db -o jsonpath='{.items[0].metadata.name}') -- \
  sh -c 'gunzip -f -c - | psql -U $POSTGRES_USER' \
  < db.gz

Note: If you are running Deep Security Smart Check in a namespace other than the default namespace and your kubectl context is not set to use that namespace, you will need to add the --namespace NAMESPACE parameter to both kubectl commands in this example.

If you see errors like:

pod has unbound PersistentVolumeClaims

You likely have not defined a storage class. Since Amazon EKS does not create a default storage class you will have to create one as described here , then specify the storage class name when installing Deep Security Smart Check:

helm install \
  --set persistence.storageClassName={storage class name} \
  --values overrides.yaml \
  --name deepsecurity-smartcheck \
  https://github.com/deep-security/smartcheck-helm/archive/1.0.8-aws-container-marketplace.tar.gz