Cluster Analysis
#Cluster Analysis
The ** Cluster Analysis** dashboard enables users to upload cluster configuration files and perform AI-powered analysis on their Kubernetes environments.
It helps identify configuration issues, security risks, and optimization opportunities.
Navigation Tabs
The interface includes two primary tabs for managing analysis workflows.
New Analysis
The New Analysis tab allows users to:
- Upload a kubeconfig file
- Provide cluster details
- Run AI-based analysis
This is the default active view used for initiating new scans.
History
The History tab provides access to previously executed analysis.
It allows users to:
- Review past cluster reports
- Track configuration changes over time
- Compare analysis results
Upload Kubeconfig YAML File
This section allows users to upload their Kubernetes configuration file.
Cluster Name
Users must provide a cluster name before running analysis.
This helps in identifying and organizing multiple cluster analyses.
File Upload
Users can upload their kubeconfig file using:
- Drag and drop functionality
- Manual file selection
Supported formats:
.yml.yaml
This file contains authentication and cluster configuration details required for analysis.
Analyze Cluster with AI & CIS Benchmarks
This button triggers the automated evaluation engine.
Once clicked:
- The kubeconfig file is securely parsed in-memory.
- CIS Kubernetes Benchmark Assessment: Evaluates control plane hardening, worker node configuration, RBAC permissions, and etcd encryption against Center for Internet Security standards.
- Security & Efficiency Scoring: Generates an overall cluster score (0–100%) with categorized severity findings (Critical, High, Medium, Low).
- Remediation Snippets: Generates copy-paste
kubectland manifest patches to remediate misconfigurations.
Benchmark Categories Evaluated
| Category | CIS Section | Evaluated Checks |
|---|---|---|
| Control Plane Security | Section 1 | API server audit logging, TLS encryption, unauthorized anonymous access, etcd peer authentication. |
| Etcd Hardening | Section 2 | Client certificate verification, encrypted storage at rest, dedicated etcd user. |
| Worker Node Security | Section 4 | Kubelet client certificate rotation, anonymous auth disabled, read-only port closed. |
| Policies & Pod Security | Section 5 | Pod Security Standards (Privileged vs Baseline vs Restricted), NetworkPolicy coverage, rootless container execution. |
How to Get Kubeconfig File
This section provides commands to retrieve kubeconfig files from different cloud providers.
AWS (EKS)
aws eks --region region-name update-kubeconfig --name cluster-name
GCP (GKE)
gcloud container clusters get-credentials [CLUSTER_NAME] --region [REGION]
Azure (AKS)
az aks get-credentials --resource-group [RESOURCE_GROUP_NAME] --name [CLUSTER_NAME]
Related Resources
- 🛠️ Kubernetes YAML Generator — generate manifests for any resource type
- 🛠️ YAML Formatter & Validator — validate your kubeconfig before uploading it for analysis