Kubescape — Kubernetes Security Platform from CNCF

What it is

Kubescape is a Kubernetes security platform that scans clusters, YAML manifests, and Helm charts against established security frameworks including NSA-CISA, CIS Benchmarks, and MITRE ATT&CK. It identifies misconfigurations, excessive permissions, missing network policies, and container vulnerabilities. Kubescape is a CNCF Sandbox project built by ARMO.

Kubescape targets DevOps engineers, security teams, and anyone responsible for Kubernetes cluster security. It catches security issues before they reach production by scanning both live clusters and local manifests during development.

How it saves time or tokens

Kubescape runs comprehensive security checks in a single command. Instead of manually reviewing each deployment against security benchmarks, Kubescape automates the entire audit. It scores your cluster against frameworks, highlights specific failed controls, and provides remediation guidance. CI/CD integration catches security regressions automatically on every commit.

How to use

1. Install Kubescape: curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | bash.
2. Scan a running cluster: kubescape scan --enable-host-scan --verbose.
3. Scan local manifests: kubescape scan *.yaml or scan Helm charts before deployment.

Example

# Install
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | bash

# Scan running cluster
kubescape scan --enable-host-scan --verbose

# Scan local manifests
kubescape scan deployment.yaml service.yaml

# Scan against specific framework
kubescape scan framework nsa --exclude-namespaces kube-system

# Scan Helm chart
kubescape scan helm-chart ./my-chart

# CI/CD mode with exit code
kubescape scan --fail-threshold 50

Related on TokRepo

• Security Tools — Security scanning and audit tools
• DevOps Tools — Kubernetes operations tools

Common pitfalls

• Not all failed controls require immediate action. Some security recommendations (like restricting root containers) may conflict with legitimate workload requirements. Prioritize based on risk.
• Host scanning (--enable-host-scan) requires access to cluster nodes. In managed Kubernetes (GKE, EKS), you may not have node-level access for all checks.
• Kubescape scans are point-in-time. For continuous security monitoring, integrate Kubescape into your CI/CD pipeline and use the ARMO platform for runtime monitoring.