Kubescape: Complete Guide to Kubernetes Security Scanning and Compliance Assessment Using Kali Linux

Kubescape, originally created by ARMO and now a CNCF project, is a comprehensive open-source Kubernetes security platform that unifies several security functions into a single tool: compliance scanning against recognized frameworks (CIS Kubernetes Benchmark, NSA/CISA Kubernetes Hardening Guidance, MITRE ATT&CK for Containers, PCI-DSS, SOC2), image vulnerability scanning, Kubernetes manifest/Helm-chart misconfiguration scanning, RBAC visualization, and a continuous risk-scoring engine.

Where kube-bench focuses purely on the CIS benchmark and kube-hunter focuses purely on active exploitation, kubescape aims to be the “single pane of glass” — it can scan a cluster, a set of YAML files, or a Helm chart, and produces a risk score (0–100%) alongside detailed, framework-mapped findings with remediation guidance. It can also generate a network policy recommendation based on observed traffic, and export results to popular formats (JSON, JUnit, SARIF, PDF, HTML) for integration into CI/CD and ticketing systems.

Key capabilities:

• Cluster scan – connects via kubeconfig and evaluates live cluster resources.
• Manifest/file scan – scans local YAML/Helm files before deployment (shift-left).
• Image scan – integrated vulnerability scanning (similar to Trivy) for container images referenced in the cluster.
• RBAC analysis – visualizes over-privileged service accounts and roles.
• Compliance frameworks – cis-v1.23-t1.0.1, nsa, mitre, soc2, and custom frameworks.
• Continuous monitoring – runs as an in-cluster operator with a scheduled scan and dashboard.

Installation

Method 1 – Install script (recommended):

curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash

Method 2 – Via Homebrew (if brew is set up on Kali):

brew install kubescape

Method 3 – Binary download:

curl -LO https://github.com/kubescape/kubescape/releases/latest/download/kubescape-ubuntu-latest
chmod +x kubescape-ubuntu-latest
sudo mv kubescape-ubuntu-latest /usr/local/bin/kubescape

Method 4 – Docker container:

docker run --rm -v "$(pwd):/results" -v "$HOME/.kube/config:/root/.kube/config" \
  quay.io/kubescape/kubescape:latest scan --format json --output /results/results.json

Verify installation:

kubescape version

Expected output:

Your current version is: v3.0.15

Syntax

kubescape <command> [flags]

Primary commands: scan, list, download, fix, patch, update.

Scan sub-forms:

kubescape scan
kubescape scan framework <framework-name>
kubescape scan control <control-name>
kubescape scan image <image-name>
kubescape scan manifest <path>

Command-Line Options

kubescape list options:

Basic Usage

kubescape scan

Expected output (truncated):

[INFO] Downloading configuration...
[INFO] Scanning cluster: my-cluster
[INFO] Done scanning namespace: default
[INFO] Done scanning namespace: kube-system

┌───────────────────────────────────────────┬────────┬───────────┐
│                  CONTROL NAME               │ STATUS │ % COMPLIANCE │
├───────────────────────────────────────────┼────────┼───────────┤
│ Privileged container                        │ failed │ 40%       │
│ Resource limits                             │ failed │ 25%       │
│ Host PID/IPC privileges                     │ passed │ 100%      │
│ Allowed hostPath                            │ failed │ 60%       │
│ Automatic mapping of service account        │ failed │ 30%       │
└───────────────────────────────────────────┴────────┴───────────┘

Resources Summary
+-------------------+--------+--------+
| Severity          | Resources | %   |
+-------------------+--------+--------+
| Critical          | 4         | -   |
| High              | 12        | -   |
| Medium            | 25        | -   |

Overall risk-score (0-100) -> 68

Practical Examples with Output

Example 1 – Scan the cluster against the NSA/CISA framework:

kubescape scan framework nsa

[INFO] Scanning with framework: NSA-1.2
┌───────────────────────────────┬────────┬────────────┐
│         CONTROL NAME           │ STATUS │ % COMPLIANCE │
├───────────────────────────────┼────────┼────────────┤
│ Non-root containers            │ failed │ 45%        │
│ Immutable container filesystem │ failed │ 20%        │
│ Network policies                │ passed │ 100%       │
└───────────────────────────────┴────────┴────────────┘
Overall risk-score (0-100) -> 71

Example 2 – Scan local Kubernetes manifests before deployment:

kubescape scan manifest ./k8s/deployment.yaml

[INFO] Scanning file: ./k8s/deployment.yaml
┌───────────────────────────────┬────────┐
│         CONTROL NAME           │ STATUS │
├───────────────────────────────┼────────┤
│ Privileged container            │ failed │
│ Run as non-root                 │ failed │
└───────────────────────────────┴────────┘

Example 3 – Scan a specific control by ID:

kubescape scan control C-0057

[INFO] Scanning control C-0057: Privileged container
┌────────────────────┬────────┐
│      RESOURCE       │ STATUS │
├────────────────────┼────────┤
│ Deployment/web-app  │ failed │
│ Pod/redis-master    │ passed │
└────────────────────┴────────┘

Example 4 – Scan an image for vulnerabilities:

kubescape scan image nginx:1.21

[INFO] Scanning image: nginx:1.21
┌──────────┬────────────────┬──────────┬────────────────────┐
│ SEVERITY │ VULNERABILITY  │ PACKAGE  │ FIXED IN             │
├──────────┼────────────────┼──────────┼────────────────────┤
│ CRITICAL │ CVE-2022-3602  │ libssl3  │ 3.0.7-r0            │
│ HIGH     │ CVE-2022-3786  │ libssl3  │ 3.0.7-r0            │
└──────────┴────────────────┴──────────┴────────────────────┘
Summary: 2 Critical, 5 High, 12 Medium

Example 5 – Restrict scan to a single namespace with JSON output:

kubescape scan --include-namespaces production --format json --output prod-scan.json
cat prod-scan.json | python3 -m json.tool | head -12

{
    "summaryDetails": {
        "score": 64.2,
        "controlsCount": 52,
        "failedControls": 19
    }
}

Example 6 – Fail the pipeline if compliance drops below 70%:

kubescape scan --compliance-threshold 70
echo "Exit code: $?"

Overall risk-score (0-100) -> 64
[ERROR] Compliance score 64% is below threshold of 70%
Exit code: 1

Example 7 – Generate an HTML report for a management review:

kubescape scan --format html --output report.html

[INFO] Scanning cluster: my-cluster
[INFO] HTML report written to report.html

Example 8 – List all available compliance frameworks:

kubescape list frameworks

NAME                     DESCRIPTION
cis-v1.23-t1.0.1         CIS Kubernetes Benchmark v1.23
nsa                      NSA/CISA Kubernetes Hardening Guidance
mitre                    MITRE ATT&CK for Containers
soc2                     SOC2 readiness controls
armobest                 ARMO's curated best-practice framework

Example 9 – Scan with an exceptions file to suppress accepted risks:

kubescape scan --exceptions exceptions.json

[INFO] Loaded 3 exceptions from exceptions.json
[INFO] Excluding Deployment/legacy-app from control C-0057 (accepted risk, ticket JIRA-4521)
Overall risk-score (0-100) -> 76

Example 10 – Scan with host-level sensors enabled (kernel/node hardening checks):

kubescape scan --enable-host-scan

[INFO] Deploying host-scanner DaemonSet...
[INFO] Collecting host sensor data from 3 nodes...
┌───────────────────────────────┬────────┐
│         CONTROL NAME           │ STATUS │
├───────────────────────────────┼────────┤
│ Kernel hardening                │ failed │
│ Audit log path exists           │ passed │
└───────────────────────────────┴────────┘

Example 11 – Scan the MITRE ATT&CK framework and view technique mapping:

kubescape scan framework mitre --format pretty-printer

[INFO] Scanning with framework: MITRE ATT&CK for Containers
┌────────────────────────┬───────────────────────────┬────────┐
│ TACTIC                  │ TECHNIQUE                  │ STATUS │
├────────────────────────┼───────────────────────────┼────────┤
│ Initial Access           │ Exposed sensitive interfaces│ failed │
│ Privilege Escalation     │ hostPath mount              │ failed │
│ Credential Access        │ Access container service account│ passed │
└────────────────────────┴───────────────────────────┴────────┘

Example 12 – Use kubescape “fix” to auto-remediate a manifest:

kubescape fix ./k8s/deployment.yaml

[INFO] Analyzing ./k8s/deployment.yaml
[INFO] Applying fix: add 'runAsNonRoot: true' to securityContext
[INFO] Applying fix: add resource limits (cpu/memory)
[INFO] Fixed file written to ./k8s/deployment.fixed.yaml

Common Use Cases

• Unified security posture dashboard combining compliance, vulnerabilities, and RBAC risk in one score.
• Shift-left scanning of Helm charts and raw manifests in CI/CD before they ever reach a cluster.
• Multi-framework compliance for organizations that must simultaneously demonstrate CIS, NSA, and MITRE ATT&CK alignment.
• RBAC least-privilege review to find over-permissioned service accounts and cluster-role bindings.
• Executive reporting via HTML/PDF export for non-technical stakeholders and auditors.
• Continuous in-cluster monitoring using the Kubescape Operator for scheduled scans and drift alerts.

Automation with Bash

#!/usr/bin/env bash
# kubescape-ci-gate.sh - Scan manifests in CI and block merge on low compliance
set -euo pipefail

MANIFEST_DIR="$1"
THRESHOLD=75
REPORT="kubescape-report-$(date +%F).json"

echo "[*] Scanning manifests in $MANIFEST_DIR ..."
kubescape scan manifest "$MANIFEST_DIR" \
  --format json \
  --output "$REPORT" \
  --compliance-threshold "$THRESHOLD"

STATUS=$?
SCORE=$(python3 -c "
import json
data = json.load(open('$REPORT'))
print(data.get('summaryDetails', {}).get('score', 'N/A'))
")

echo "[*] Compliance score: $SCORE%"

if [ "$STATUS" -ne 0 ]; then
  echo "[!] Manifests failed the compliance gate (threshold: ${THRESHOLD}%)."
  exit 1
fi

echo "[+] Manifests passed the compliance gate."

Run it:

chmod +x kubescape-ci-gate.sh
./kubescape-ci-gate.sh ./k8s/

Tips and Best Practices

• Start with the nsa or armobest framework for a practical, actionable baseline before attempting full CIS compliance, which can be extensive.
• Use kubescape scan manifest in pull-request CI checks so misconfigurations are caught before merge, not after deployment.
• Maintain an exceptions.json file in version control (with ticket references) for accepted risks rather than silently ignoring failed controls.
• Combine the risk score trend over time (not a single snapshot) as your real KPI — a rising score indicates genuine security debt reduction.
• Use kubescape scan image as a complementary check alongside Trivy; results are usually consistent since both draw from similar vulnerability databases, but cross-verification catches DB staleness.
• Enable --enable-host-scan periodically (not on every CI run, since it deploys a DaemonSet) to capture node-level kernel/OS hardening gaps that manifest-only scans miss.
• Review RBAC findings carefully — overly broad ClusterRoleBindings to cluster-admin are consistently among the highest-risk findings in real clusters.

Troubleshooting

References

• Official documentation: https://kubescape.io/docs/
• GitHub repository: https://github.com/kubescape/kubescape
• CNCF project page: https://www.cncf.io/projects/kubescape/
• MITRE ATT&CK for Containers: https://attack.mitre.org/matrices/enterprise/containers/