/kubescape-operator

name: kubescape-operator
description: Install, tune and troubleshoot the Kubescape operator for continuous in-cluster security — posture scans on every change, vulnerabilities filtered to packages that actually load (relevancy), eBPF runtime threat detection against learned container profiles, NetworkPolicies generated from observed traffic, SecurityException resources with an expiry, and Prometheus metrics and alerts. Flux or Argo CD install with a capability matrix, preflight for kernel and overlap with Falco or Trivy Operator, upgrade and rollback. Interactive when run without arguments. Use when asked to "install kubescape in the cluster", "continuous kubernetes security scanning", "which CVEs actually run", "runtime alerts for containers", "generate network policies from traffic", "kubescape operator not working", or "node-agent crashloop". One-off scans, CIS audits and the PR gate → /platform-skills:kubescape. Falco rules → /platform-skills:runtime-security. Trivy Operator → /platform-skills:trivy.
argument-hint: "[install|vulns|runtime|netpol|exceptions|metrics|debug] [namespace or workload]"
title: "Kubescape Operator Command"
sidebar_label: "kubescape-operator"
custom_edit_url: null

Run Kubescape inside the cluster: posture that updates itself, CVEs ranked by whether they load, alerts on behaviour a container never showed, and NetworkPolicies drafted from real traffic.

Read `references/kubescape-operator.md` before responding. It holds the preflight, the capability matrix and install profiles, the scanner image override, result commands, runtime and NetworkPolicy details, exceptions, metrics and troubleshooting. The working files are in `examples/kubescape-operator`.

The GitOps engine for this organisation is `${user_config.gitops_engine}`. If that reads as a literal placeholder or is empty, it is not configured: detect Flux (`kubectl get crd helmreleases.helm.toolkit.fluxcd.io`) or Argo CD (`kubectl get crd applications.argoproj.io`), or ask.

Ownership boundary (enforced at the menu)

| Question | Authoritative command | |---|---| | "Scan continuously, keep results in the cluster" | **this command** | | "Which CVEs are in code that actually runs?" | **this command** (`vulns`) | | "Alert on unexpected container behaviour" | **this command** (`runtime`), or `/platform-skills:runtime-security` where Falco runs | | "Draft NetworkPolicies from traffic" | **this command** (`netpol`) | | "Score the cluster now / CIS audit / PR gate" | `/platform-skills:kubescape` | | "CVE reports with Trivy Operator" | `/platform-skills:trivy k8s` | | "Dashboards and alert routing" | `/platform-skills:observability` |

---

Mode dispatch

Parse the first word of `$ARGUMENTS` as the mode. When `$ARGUMENTS` is empty, or is a question in plain words, run the interactive wizard.

| Mode | What it does | |---|---| | `install` | Preflight, pick a profile, write the Flux (or Argo CD) manifests, install, verify, upgrade or roll back | | `vulns` | Read and rank vulnerability results; on-demand scan; private registries | | `runtime` | Enable detection, check learning progress, bind rules, route alerts, test an alert | | `netpol` | Turn a generated policy into a reviewed NetworkPolicy in Git | | `exceptions` | Accept a risk in the cluster: `SecurityException` with reason, author, expiry | | `metrics` | Exporter, ServiceMonitor, alert rules | | `debug` | Diagnose an operator that installs but misbehaves | | _(empty)_ | Interactive wizard |

---

Step 0 — detect before asking (silent)

kubectl config current-context
kubectl version -o json | jq -r .serverVersion.gitVersion            # >= 1.28
kubectl get nodes -o jsonpath='{range .items[*]}{.status.nodeInfo.kernelVersion}{"  "}{.spec.providerID}{"\n"}{end}' | sort -u
kubectl -n kubescape get helmrelease,deploy,ds 2>/dev/null           # already installed? which profile?
kubectl get crd | grep -E 'helm.toolkit.fluxcd.io|argoproj.io|monitoring.coreos.com|kyverno'
kubectl get ds -A | grep -iE 'falco|tetragon'                       # another eBPF agent
kubectl get deploy -A | grep -i trivy-operator                      # another CVE operator

Then, only if a node-agent profile is in play, run the kernel preflight from the reference on one node per node image (`CONFIG_FANOTIFY_ACCESS_PERMISSIONS`, `CONFIG_DEBUG_INFO_BTF`). Tell the user what you found in one short block before the first question, for example:

Cluster: prod-eu-west-1 (EKS, Kubernetes 1.33, 3 node images)
Flux: yes · Prometheus Operator: yes · Falco: yes (daemonset falco) · Trivy Operator: no
Kernel: fanotify permissions ✔ on all node images
Kubescape: not installed

Interactive wizard

Ask with the `AskUserQuestion` tool when it is available (one question per call, recommended option first); otherwise print the numbered menu and wait.

Layer 1 — What do you want?

What do you want Kubescape to do in this cluster?
  1. "Install it" / "change what it does"                  → install
  2. "Show me which vulnerabilities actually matter"       → vulns
  3. "Alert me when a container does something odd"       → runtime
  4. "Write NetworkPolicies from real traffic"             → netpol
  5. "We accept this risk in the cluster"                  → exceptions
  6. "Get it into Prometheus / Grafana"                    → metrics
  7. "It's installed but something is wrong"               → debug

  Just a score or a CIS audit right now → /platform-skills:kubescape cluster

Not installed and the user picked 2–6 → say it needs `install` first and offer it.

Layer 2 — Install profile (install only)

Offer the profiles from the reference, pre-selected from Step 0:

Which profile?
  a. Full — posture, relevancy-ranked CVEs, runtime alerts, NetworkPolicies    [recommended: supported kernel, no Falco]
  b. Full without runtime alerts — keep Falco for alerting                     [recommended: Falco detected]
  c. Posture + CVEs, no node-agent — any kernel,