/kubescape

name: kubescape
description: Check Kubernetes manifests, Helm charts, Kustomize overlays and live clusters against NSA-CISA, MITRE ATT&CK, CIS (EKS, AKS, GKE, vanilla) and SOC2 with the Kubescape CLI. Covers framework choice, score and severity gates, PR gates that fail only on new findings (--baseline), exceptions that actually suppress, controls configuration, auto-fix, Kubescape's CEL admission policy library, and one-off image scans. Interactive when run without arguments. Use when asked to "scan my manifests", "how secure is my cluster", "run a CIS benchmark", "NSA hardening check", "add a Kubernetes security gate to CI", "accept this finding", "fix what Kubescape found", or "run kubescape". Continuous in-cluster scanning, runtime alerts, NetworkPolicies from traffic → /platform-skills:kubescape-operator. Image CVE gates → /platform-skills:trivy. Admission with Kyverno → /platform-skills:kyverno. Terraform → /platform-skills:checkov.
argument-hint: "[scan|cluster|ci|exceptions|fix|vap|image] [path, chart, framework or control]"
title: "Kubescape Command"
sidebar_label: "kubescape"
custom_edit_url: null

Find out how a Kubernetes change or cluster measures up against a security framework, in plain language, and stop new problems at the pull request.

Read `references/kubescape.md` before responding. It holds the verified install, the framework table, gate exit codes, the baseline recipe, how the two exception actions really behave, fix limits, the VAP rollout, and troubleshooting. The working files are in `examples/kubescape`.

The primary cloud for this organisation is `${user_config.primary_cloud}`. If that reads as a literal placeholder or is empty, it is not configured: detect the provider from the cluster, or ask.

Ownership boundary (enforced at the menu)

| Question | Authoritative command | |---|---| | "Does this manifest / chart / cluster meet NSA, MITRE, CIS or SOC2?" | **this command** | | "Block insecure Kubernetes changes in PRs" | **this command** (`ci`) | | "Scan continuously, see which CVEs actually load, alert on runtime behaviour, generate NetworkPolicies" | `/platform-skills:kubescape-operator` | | "Is this image safe to ship?" (CI gate) | `/platform-skills:trivy` | | "Will this pass admission?" (cluster runs Kyverno) | `/platform-skills:kyverno` | | "Is my Terraform misconfigured?" | `/platform-skills:checkov` | | "Is this production-ready overall?" | `/platform-skills:preflight` |

---

Mode dispatch

Parse the first word of `$ARGUMENTS` as the mode. When `$ARGUMENTS` is empty, or is a question in plain words, run the interactive wizard.

| Mode | What it does | |---|---| | `scan` | Score manifests, a Helm chart, a Kustomize overlay or a git URL against a framework | | `cluster` | Score the live cluster in the current kube context (or several contexts) | | `ci` | Add a GitHub Actions gate that fails a PR only on findings it introduces | | `exceptions` | Accept a risk properly: an exceptions entry that suppresses, with a review date | | `fix` | Preview and apply Kubescape's automatic fixes, then hand-fix the rest | | `vap` | Enforce a control at admission with Kubescape's CEL policy library (Warn → Deny) | | `image` | One-off image CVE check (CI image gates live in `/platform-skills:trivy`) | | _(empty)_ | Interactive wizard |

---

Step 0 — detect before asking (silent)

Run these quietly and use the answers to skip questions. Never ask what the repository or cluster already tells you.

command -v kubescape && kubescape version                     # installed? version?
kubectl config current-context 2>/dev/null                     # is there a cluster?
kubectl version -o json 2>/dev/null | jq -r .serverVersion.gitVersion       # -eks- / -gke. → managed distribution
kubectl get nodes -o jsonpath='{.items[0].metadata.labels.kubernetes\.azure\.com/cluster}' 2>/dev/null   # non-empty → AKS
kubectl get nodes -o jsonpath='{.items[0].spec.providerID}' 2>/dev/null   # aws:// azure:// gce:// — a hint only
git ls-files | grep -E '(^|/)(Chart\.yaml|kustomization\.ya?ml)$'          # charts, overlays
git ls-files '*.yaml' '*.yml' | xargs grep -l '^kind:' 2>/dev/null | head  # plain manifests
ls .github/workflows/ 2>/dev/null; ls .kubescape/ 2>/dev/null               # existing CI, exceptions

• Kubescape missing → offer the install (laptop: `brew install kubescape`; CI and servers: the verified download in the reference) before anything else.
• Version below 4 → say so: `--baseline`, `--kube-contexts` and the `disable` exception behaviour described here need v4.
• Current context looks like production (name contains `prod`) → confirm before a cluster scan; it is read-only but heavy on the API server for large clusters.

Interactive wizard

Ask with the `AskUserQuestion` tool when it is available (one question per call, the recommended option first); otherwise print the numbered menu and wait. Three layers; stop as soon as the mode is clear.

Layer 1 — What do you want to know? (intent, in their words)

What are you trying to find out?
  1. "Is this change / chart safe to deploy?"         → scan
  2. "How secure is my cluster right now?"            → cluster
  3. "Stop insecure Kubernetes changes in PRs"        → ci
  4. "We've accepted this risk — stop flagging it"    → exceptions
  5. "Fix what Kubescape found"                       → fix
  6. "Block this at admission"                        → vap  (Kyverno installed? → /platform-skills:kyverno)
  7. "Is this image vulnerable?"                      → image (CI gate? → /platform-skills:trivy)

  Watch the cluster continuously / runtime alerts / NetworkPolicies → /platform-skills:kubescape-operator

Pre-select from Step 0: no cluster but manifests → 1; cluster and no manifests → 2; a workflow directory and no Kubescape job → mention 3.

Layer 2 — Measured against what? (framework, in plain words)

What should it be measured against?
  a. General hardening (NSA-CISA)