Installation

Spotter can be installed using multiple methods to suit different environments and preferences. Choose the method that works best for your setup.

Installation Methods

1. Go Install (Recommended)

If you have Go installed, this is the quickest way to get the latest version:

go install github.com/madhuakula/spotter@latest

Verify the installation:

spotter version

2. Download Binary

Download pre-compiled binaries from the GitHub Releases page.

Linux (x86_64)

# Download the latest release
wget https://github.com/madhuakula/spotter/releases/latest/download/spotter-linux-amd64.tar.gz

# Extract and install
tar -xzf spotter-linux-amd64.tar.gz
sudo mv spotter /usr/local/bin/

# Verify installation
spotter version

macOS (Intel)

# Download the latest release
wget https://github.com/madhuakula/spotter/releases/latest/download/spotter-darwin-amd64.tar.gz

# Extract and install
tar -xzf spotter-darwin-amd64.tar.gz
sudo mv spotter /usr/local/bin/

# Verify installation
spotter version

macOS (Apple Silicon)

# Download the latest release
wget https://github.com/madhuakula/spotter/releases/latest/download/spotter-darwin-arm64.tar.gz

# Extract and install
tar -xzf spotter-darwin-arm64.tar.gz
sudo mv spotter /usr/local/bin/

# Verify installation
spotter version

Windows

1. Download spotter-windows-amd64.zip from the releases page
2. Extract the ZIP file
3. Add the extracted directory to your PATH environment variable
4. Open a new command prompt and verify: spotter version

3. Docker

Run Spotter using Docker without installing it locally:

# Pull the latest image
docker pull madhuakula/spotter:latest

# Run Spotter (example: scan manifests)
docker run --rm -v $(pwd):/workspace madhuakula/spotter:latest scan manifests /workspace

# For cluster scanning, mount kubeconfig
docker run --rm -v ~/.kube:/root/.kube madhuakula/spotter:latest scan cluster

Docker Compose

Create a docker-compose.yml file:

version: '3.8'
services:
  spotter:
    image: madhuakula/spotter:latest
    volumes:
      - ~/.kube:/root/.kube:ro
      - ./manifests:/workspace:ro
    command: ["scan", "manifests", "/workspace"]

Run with:

docker-compose run --rm spotter

4. Build from Source

For the latest development version or custom builds:

# Clone the repository
git clone https://github.com/madhuakula/spotter.git
cd spotter

# Build the binary
make build

# Install to system PATH
sudo cp bin/spotter /usr/local/bin/

# Verify installation
spotter version

Kubernetes RBAC Setup

For cluster scanning, Spotter needs appropriate permissions. Create the following RBAC resources:

apiVersion: v1
kind: ServiceAccount
metadata:
  name: spotter
  namespace: default
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: spotter-reader
rules:
- apiGroups: [""]
  resources: ["*"]
  verbs: ["get", "list"]
- apiGroups: ["apps"]
  resources: ["*"]
  verbs: ["get", "list"]
- apiGroups: ["networking.k8s.io"]
  resources: ["*"]
  verbs: ["get", "list"]
- apiGroups: ["policy"]
  resources: ["*"]
  verbs: ["get", "list"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources: ["*"]
  verbs: ["get", "list"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: spotter-binding
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: ClusterRole
  name: spotter-reader
subjects:
- kind: ServiceAccount
  name: spotter
  namespace: default

Apply the RBAC configuration:

kubectl apply -f spotter-rbac.yaml

Configuration

Spotter can be configured using:

1. Command-line flags: Override specific settings
2. Configuration file: Use spotter.yaml for persistent settings
3. Environment variables: Set SPOTTER_* variables

Basic Configuration File

Create a spotter.yaml file:

# Spotter Configuration
logging:
  level: info
  format: text

scanner:
  workers: 10
  timeout: 30s

rules:
  builtin:
    enabled: true
  custom:
    paths:
      - "./custom-rules"

output:
  format: table
  file: ""
  no-color: false

kubernetes:
  kubeconfig: ""
  context: ""
  namespace: ""

performance:
  max-concurrent-scans: 50
  rule-cache-size: 1000

Verification

After installation, verify Spotter is working correctly:

# Check version
spotter version

# List available commands
spotter --help

# Test with a simple manifest scan
echo 'apiVersion: v1
kind: Pod
metadata:
  name: test-pod
spec:
  containers:
  - name: test
    image: nginx
    securityContext:
      privileged: true' | spotter scan manifests -

You should see security findings related to the privileged container.

Next Steps

• Quick Start: Try the Quick Start Guide for hands-on examples
• Configuration: Learn about Configuration Options
• CLI Usage: Explore CLI Commands
• Security Rules: Understand Built-in Rules

Troubleshooting

Common Issues

Permission Denied (Cluster Scanning)

# Check your kubeconfig
kubectl config current-context

# Test cluster access
kubectl get nodes

Binary Not Found

# Check if binary is in PATH
which spotter

# Add to PATH if needed (Linux/macOS)
export PATH=$PATH:/usr/local/bin

Docker Permission Issues

# Add user to docker group (Linux)
sudo usermod -aG docker $USER

# Restart shell or logout/login

For more help, check the GitHub Issues or create a new issue.