kubescape

kubescape scan examines charts and kubernetes files for possible issues, best practices and security vulnerabilities.

kubescape documentation

Version in MegaLinter: 2.3.5
Visit Official Web Site

Configuration in MegaLinter

Enable kubescape by adding KUBERNETES_KUBESCAPE in ENABLE_LINTERS variable
Disable kubescape by adding KUBERNETES_KUBESCAPE in DISABLE_LINTERS variable

Variable	Description	Default value
KUBERNETES_KUBESCAPE_ARGUMENTS	User custom arguments to add in linter CLI call Ex: `-s --foo "bar"`
KUBERNETES_KUBESCAPE_FILE_EXTENSIONS	Allowed file extensions. `"*"` matches any extension, `""` matches empty extension. Empty list excludes all files Ex: `[".py", ""]`	`[".yml", ".yaml", ".json"]`
KUBERNETES_KUBESCAPE_FILE_NAMES_REGEX	File name regex filters. Regular expression list for filtering files by their base names using regex full match. Empty list includes all files Ex: `["Dockerfile(-.+)?", "Jenkinsfile"]`	Include every file
KUBERNETES_KUBESCAPE_PRE_COMMANDS	List of bash commands to run before the linter	None
KUBERNETES_KUBESCAPE_POST_COMMANDS	List of bash commands to run after the linter	None
KUBERNETES_KUBESCAPE_UNSECURED_ENV_VARIABLES	List of env variables explicitly not filtered before calling KUBERNETES_KUBESCAPE and its pre/post commands	None
KUBERNETES_KUBESCAPE_DISABLE_ERRORS	Run linter but consider errors as warnings	`false`
KUBERNETES_KUBESCAPE_DISABLE_ERRORS_IF_LESS_THAN	Maximum number of errors allowed	`0`
KUBERNETES_KUBESCAPE_CLI_EXECUTABLE	Override CLI executable	`['kubescape']`
KUBERNETES_DIRECTORY	Directory containing KUBERNETES files	``

IDE Integration

Use kubescape in your favorite IDE to catch errors before MegaLinter !

	IDE	Extension Name	Install
	Visual Studio Code	Kubescape

MegaLinter Flavours

This linter is available in the following flavours

Flavor	Description	Embedded linters
all	Default MegaLinter Flavor	113
cupcake	MegaLinter for the most commonly used languages	81
documentation	MegaLinter for documentation projects	47
dotnet	Optimized for C, C++, C# or VB based projects	59
go	Optimized for GO based projects	49
java	Optimized for JAVA based projects	51
javascript	Optimized for JAVASCRIPT or TYPESCRIPT based projects	56
php	Optimized for PHP based projects	50
python	Optimized for PYTHON based projects	58
ruby	Optimized for RUBY based projects	47
rust	Optimized for RUST based projects	47
salesforce	Optimized for Salesforce based projects	50
security	Optimized for security	21
swift	Optimized for SWIFT based projects	47
terraform	Optimized for TERRAFORM based projects	51

Behind the scenes

How are identified applicable files

Activated only if sub-directory ` is found. (directory name can be overridden withKUBERNETES_DIRECTORY`)
Activated only if one of these files is found: Chart.yml, Chart.yaml
File extensions: .yml, .yaml, .json
Detected file content (regex): apiVersion:, kustomize\.config\.k8s\.io, tekton

How the linting is performed

kubescape is called once on the whole project directory (project CLI lint mode)

filtering can not be done using MegaLinter configuration variables,it must be done using kubescape configuration or ignore file (if existing)
VALIDATE_ALL_CODEBASE: false doesn't make kubescape analyze only updated files

Example calls

kubescape scan .

Help content

Kubescape is a tool for testing Kubernetes security posture. Docs: https://hub.armosec.io/docs

Usage:
  kubescape [command]

Examples:

  # Scan command
  kubescape scan

  # List supported frameworks
  kubescape list frameworks

  # Download artifacts (air-gapped environment support)
  kubescape download artifacts

  # View cached configurations
  kubescape config view


Available Commands:
  completion  Generate autocompletion script
  config      Handle cached configurations
  delete      Delete configurations in Kubescape SaaS version
  download    Download controls-inputs,exceptions,control,framework,artifacts,attack-tracks
  fix         Fix misconfiguration in files
  help        Help about any command
  list        List frameworks/controls will list the supported frameworks and controls
  scan        Scan the current running cluster or yaml files
  submit      Submit an object to the Kubescape SaaS version
  update      Update your version
  version     Get current version

Flags:
      --cache-dir string   Cache directory [$KS_CACHE_DIR] (default "/root/.kubescape")
      --disable-color      Disable Color output for logging
      --enable-color       Force enable Color output for logging
  -h, --help               help for kubescape
  -l, --logger string      Logger level. Supported: debug/info/success/warning/error/fatal [$KS_LOGGER] (default "info")

Use "kubescape [command] --help" for more information about a command.

Installation on mega-linter Docker image

Dockerfile commands :

RUN ln -s /lib/libc.so.6 /usr/lib/libresolv.so.2 && \
    curl --retry 5 --retry-delay 5 -sLv https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash

APK packages (Linux):