Project: Sonobuoy (Provisioning / Security & Compliance)
File: sonobuoy_run.md

Starts a Sonobuoy run by launching the Sonobuoy aggregator and plugin pods. ``` sonobuoy run [flags] ``` ``` --aggregator-node-selector nodeSelectors Node selectors to add to the aggregator. Values can be given multiple times and are in the form key:value (default map[]) --aggregator-permissions string Type of aggregator permission to use in the cluster. Allowable values are [namespaceAdmin, clusterRead, clusterAdmin] (default "clusterAdmin") --config Sonobuoy config Path to a sonobuoy configuration JSON file. --context string Context in the kubeconfig to use. --dns-namespace string The namespace to check for DNS pods during preflight checks. (default "kube-system") --dns-pod-labels strings The label selectors to use for locating DNS pods during preflight checks. Can be specified multiple times or as a comma-separated list. (default [k8s-app=kube-dns,k8s-app=coredns]) --e2e-docker-config-file json-filepath A docker credentials configuration file used which contains authorization token that can be used to pull images from certain private registries provided by the users --e2e-focus envModifier Specify the E2EFOCUS value for the e2e plugin, specifying which tests to run. Shorthand for --plugin-env=e2e.E2EFOCUS=<string> (default \[Conformance\]) --e2e-repo envModifier Specify a registry to use as the default for pulling Kubernetes test images. Same as providing --e2e-repo-config but specifying the same repo repeatedly. --e2e-repo-config yaml-filepath Specify a yaml file acting as KUBETESTREPO_LIST, overriding registries for test images. --e2e-skip envModifier Specify the E2ESKIP value for the e2e plugin, specifying which tests to skip. Shorthand for --plugin-env=e2e.E2ESKIP=<string> (default \[Disruptive\]|NoExecuteTaintManager) --existing-service-account If true, use an existing service account, else attempt to create one. -f, --file - If set, loads the file as if it were the output from sonobuoy gen. Set to - to read from stdin. --force-image-pull-policy Force plugins' imagePullPolicy to match the value for the Sonobuoy pod -h, --help help for run --image-pull-policy string Set the ImagePullPolicy for the Sonobuoy image and all plugins (if --force-image-pull-policy is set). Valid options are Always, IfNotPresent, Never. (default "IfNotPresent") --kube-conformance-image image Container image override for the e2e plugin. Shorthand for --plugin-image=e2e:<string> (default map[]) --kubeconfig Kubeconfig Path to explicit kubeconfig file. --kubernetes-version string Use default E2E image, but override the version. Default is 'auto', which will be set to your cluster's version if detected, erroring otherwise. 'ignore' will try version resolution but ignore errors. 'latest' will find the latest dev image/version upstream. -m, --mode Mode What mode to run the e2e plugin in. Valid modes are [certified-conformance conformance-lite non-disruptive-conformance

(default non-disruptive-conformance) -n, --namespace string The namespace to run Sonobuoy in. Only one Sonobuoy run can exist per namespace simultaneously. (default "sonobuoy") --namespace-psa-enforce-level string The PSA enforce level for the namespace. (default "privileged") -p, --plugin pluginList Which plugins to run. Can either point to a URL, local file/directory, or be one of the known plugins (e2e or systemd-logs). Can be specified multiple times to run multiple plugins. --plugin-env pluginenvvar Set env vars on plugins. Values can be given multiple times and are in the form plugin.env=value (default map[]) --plugin-image plugin:image Override a plugins image from what is in its definition (e.g. myPlugin:testimage) (default map[]) --rbac RBACMode Whether to enable RBAC on Sonobuoy. Valid modes are Enable, Disable, and Detect (query the server to see whether to enable RBAC). (default Detect) --rerun-failed tar.gz file Read the given tarball and set the E2E_FOCUS to target all the failed tests --security-context-mode string Type of security context to use for the aggregator pod. Allowable values are [none, nonroot] (default "nonroot") --service-account-name string Name of the service account to be used by sonobuoy. (default "sonobuoy-serviceaccount") --show-default-podspec If true, include the default pod spec used for plugins in the output. --skip-preflight strings[=true] Skips the specified preflight checks. Valid values are [dnscheck, versioncheck, existingnamespace] or true to skip all of the checks. --sonobuoy-image string Container image override for the sonobuoy worker and aggregator. (default "sonobuoy/sonobuoy:v0.57.0-4-g87baecab") --ssh-key yamlFile Path to the private key enabling SSH to cluster nodes. May be required by some tests from the e2e plugin. --ssh-user envModifier SSH user for ssh-key. Required if running e2e plugin with certain tests that require SSH access to nodes. --systemd-logs-image image Container image override for the systemd-logs plugin. Shorthand for --plugin-image=systemd-logs:<string> (default map[]) --timeout int How long (in seconds) Sonobuoy aggregator will wait for plugins to complete before exiting. 0 indicates no timeout. (default 21600) --wait int[=1440] How long (in minutes) for the CLI to wait for sonobuoy run to be completed or fail, where 0 indicates do not wait. If specified, the default wait time is 1 day. --wait-output string Specify the type of output Sonobuoy should produce when --wait is used. Valid modes are silent, spinner, or progress (default "Progress") ``` ``` --level level Log level. One of {panic, fatal, error, warn, info, debug, trace} (default info) ``` - Generate reports on your Kubernetes cluster by running plugins