---
title: Kubernetes Manifest
slug: docs/kubernetes-manifest
icon: {"faIcon":"fa-solid fa-dharmachakra"}
docTags: 
createdAt: 2024-04-17T16:40:56.871Z
---

## Deploying to Kubernetes via manifest

The following instructions will help you setup a basic deployment of the TruffleHog scanner in Kubernetes via manifest.

For Kubernetes we recommend using the [Helm Chart](docId\:trouGZoQv1uVzresZg4vh) instead if possible. The helm chart makes it easier to customize the deployment and also includes options like a VerticalPodAutoscaler to right-size the resource requests for the deployment.


Kubernetes will ensure that TruffleHog stays running, manage your configuration secrets, and collect the logs.

:::::WorkflowBlock
:::WorkflowBlockItem
Create the namespace

```shell
$ kubectl create namespace trufflehog
namespace/trufflehog created
```
:::

::::WorkflowBlockItem
Create the configuration secret

:::hint{type="warning"}
Important: The config file must be named `config.yaml` for the field name in the secret to be correctly named and match what the Deployment is looking for.
:::



```shell
$ kubectl create secret --namespace trufflehog generic --from-file config.yaml config
secret/config created
```
::::

:::WorkflowBlockItem
Create the deployment.yaml file

```yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: trufflehog
  labels:
    app: trufflehog
spec:
  replicas: 1
  selector:
    matchLabels:
      app: trufflehog
  template:
    metadata:
      labels:
        app: trufflehog
    spec:
      volumes:
      - name: config-secret-volume
        secret:
          secretName: config
      containers:
      - name: trufflehog
        image: us-docker.pkg.dev/thog-artifacts/public/scanner:latest
        terminationMessagePolicy: FallbackToLogsOnError
        command: ["/usr/local/bin/scanner", "scan", "--config=/secret/config.yaml", "--port=8080"]
        livenessProbe:
          httpGet:
            path: /healthz
            port: 8080
          initialDelaySeconds: 3
          periodSeconds: 3
        volumeMounts:
        - name: config-secret-volume
          mountPath: /secret/
```
:::

:::WorkflowBlockItem
Apply the manifest

```shell
$ kubectl apply -f /tmp/thog.yaml --namespace trufflehog
deployment.apps/trufflehog configured
```
:::

:::WorkflowBlockItem
Wait for TruffleHog to be running

```shell
$ kubectl get pods --namespace trufflehog --watch
NAME                          READY   STATUS    RESTARTS   AGE
trufflehog-7f76dc4c49-szxwv   1/1     Running   0          0m22s
```
:::

:::WorkflowBlockItem
Follow the logs

```shell
$ kubectl logs --namespace trufflehog -f -l app=trufflehog 
🐷🔑🐷 TruffleHog. Unearth your secrets. 🐷🔑🐷
version:  v1.50.22

INFO[0000] starting scanner service client               scanner_group=On-prem
```
:::
:::::