Secure STACKIT with Mondoo
Continuously secure your STACKIT project with Mondoo.
Mondoo continuously scans your STACKIT project for misconfigurations and vulnerabilities. Create a STACKIT integration to give Mondoo the access it needs.
Mondoo discovers and assesses servers, SKE (Kubernetes) clusters, object storage buckets, the secrets manager, and managed database instances. The database types include PostgreSQL Flex, MariaDB, MongoDB Flex, SQL Server Flex, Redis, RabbitMQ, OpenSearch, and LogMe.
Prerequisites
- Editor or Owner access to the Mondoo space
- A STACKIT project
- A STACKIT service account with a service account key
Create a STACKIT service account key
Mondoo authenticates to STACKIT with a service account key.
-
Log in to the STACKIT Portal.
-
Select the project you want Mondoo to scan, and note its Project ID. You need it in the next section.
-
Go to Service Accounts and create a service account, or select an existing one. Assign it a read-capable role on the project: Mondoo only reads configuration, and a write-capable role grants more than the integration needs.
-
Create a Service Account Key for that service account and download the JSON key file.
Treat the service account key like a password. Don't commit it to source control, and rotate it periodically.
Add a STACKIT integration
In the Mondoo App, navigate to the space where you want to add the integration. In the side navigation bar, select Integrations. In the top right, select INSTALL. On the Install Integration page, find the integration you want by browsing a category or searching by name:
-
Under Cloud Security, select STACKIT.
-
Under Choose an integration name, enter a name that identifies the STACKIT project.
-
Under Provide your STACKIT project, enter the Project ID you noted in the STACKIT Portal.
-
(Optional) In the region box, enter a region, such as
eu01, to restrict scanning to one region. Leave it empty to use the provider default. -
Under Provide your service account key, select UPLOAD .JSON KEY FILE and choose the key file, or paste its contents into the box.
-
(Optional) Under Enable security policies (optional), enable the policies you want Mondoo to score the project against. You can change them at any time. To learn how policies work, read Manage Policies.
-
Select CREATE INTEGRATION.
Manage your integration
To open the integration, navigate to the space and select Integrations in the side navigation bar. Select the STACKIT card, then choose the integration.
The status appears on the integration page under Integration Details:
| Status | Meaning |
|---|---|
| active | The integration is healthy and scanning. |
| error | Mondoo detected an error during a scan attempt. |
At the top of the integration page, select RUN to request a fresh scan, or select the ... (more integration actions) button and then Pause to stop scheduled scans (Resume starts them again). To change the integration's settings, select the edit (pencil) icon.
To remove the integration, select the trash can icon, then select DELETE in the Remove Integration dialog. Mondoo stops scanning the STACKIT project.
Scan STACKIT from the command line
The integration scans continuously from the Mondoo Platform. To scan a STACKIT project from your workstation or a CI pipeline instead, see Scan STACKIT with cnspec.