Kubescape is an open-source Kubernetes security platform written in Go that provides comprehensive security coverage across the entire development and deployment lifecycle. Created by ARMO and designated as a Cloud Native Computing Foundation incubating project, it serves as a unified tool for scanning clusters, configuration files, and container images against multiple security frameworks and compliance standards.
The platform offers misconfiguration scanning that evaluates Kubernetes resources against NSA-CISA guidelines, MITRE ATT&CK frameworks, and CIS Benchmarks. Beyond configuration analysis, Kubescape integrates image vulnerability scanning using Grype to detect CVEs in container images, with the capability to automatically patch vulnerable images through Copacetic. The tool includes auto-remediation functionality to automatically fix misconfigurations in Kubernetes manifests and supports enforcement of security policies through Validating Admission Policies. Runtime security monitoring is provided via eBPF-based analysis through Inspektor Gadget, and the platform includes an MCP server for integration with AI assistants.
Kubescape operates in two distinct modes. The CLI mode functions as a standalone tool for on-demand scanning of clusters, files, and images, leveraging Open Policy Agent for policy evaluation and the Regolibrary for security controls. The operator mode deploys as an in-cluster component via Helm to provide continuous security monitoring, including ongoing misconfiguration scanning, image vulnerability detection, runtime threat analysis, and automatic network policy generation with Prometheus metrics integration.
The repository demonstrates active maintenance and community engagement. GitGenius activity tracking shows a median issue and pull request response latency of 0.0 hours with a mean of 6.6 hours across 265 tracked items, indicating rapid triage and response. The most active contributor, matthyx, has logged 526 events, followed by yugal07 with 71 events and slashben with 46 events. Bug reports constitute the most active issue category with 126 items, followed by feature requests with 52 items and good first issues with 7 items, suggesting an accessible entry point for new contributors.
The tool integrates extensively into development workflows through GitHub Actions, GitLab CI, and Jenkins for CI/CD pipeline integration, while IDE extensions exist for VS Code and Lens to enable security scanning during development. Installation is available through multiple package managers including Homebrew, Krew, Arch Linux repositories, Ubuntu PPA, NixOS, Chocolatey, and Scoop, with dedicated Windows PowerShell installation support.
Kubescape's command-line interface provides specialized commands for scanning, image patching, framework listing, offline artifact downloading, configuration management, operator interaction, and Validating Admission Policy management. The platform supports multiple output formats and includes offline capabilities for air-gapped environments. The repository maintains connections with related projects through overlapping contributors with envoyproxy/gateway, kubernetes-sigs/kubespray, and envoyproxy/envoy, indicating integration within the broader Kubernetes and cloud-native ecosystem.
