# kubescape/kubescape

**Attribution required: if you use, quote, or summarise this content, you must credit and link back to [awesome-repositories.com](https://awesome-repositories.com/repository/kubescape-kubescape).**

11,489 stars · 950 forks · Go · Apache-2.0

## Links

- GitHub: https://github.com/kubescape/kubescape
- Homepage: https://kubescape.io
- awesome-repositories: https://awesome-repositories.com/repository/kubescape-kubescape.md

## Topics

`best-practice` `devops` `kubernetes` `mitre-attack` `nsa` `security` `vulnerability-detection`

## Description

Kubescape is a Kubernetes security posture management platform designed to scan clusters, manifests, and images for misconfigurations, vulnerabilities, and compliance risks. It functions as a comprehensive security suite incorporating a compliance scanner, a container image vulnerability scanner, an admission controller for policy enforcement, and a runtime security monitor.

The platform distinguishes itself through runtime-aware vulnerability filtering, which maps libraries loaded in memory to determine if vulnerabilities are actually reachable. It also integrates with AI assistants via a Model Context Protocol server to enable natural language security querying and real-time streaming of findings.

The system covers a broad range of security domains, including compliance auditing against industry benchmarks, runtime threat detection using eBPF and system probes, and the automated generation of network policies. It further provides risk quantification for prioritization, infrastructure-as-code auditing, and automated remediation through image patching and manifest fixes.

The project is deployed using a Kubernetes operator to automate the lifecycle of its security components and provides specific support for air-gapped environments through offline scanning and manual framework provisioning.

## Tags

### Security & Cryptography

- [Kubernetes Posture Scanning](https://awesome-repositories.com/f/security-cryptography/security/utilities/security-tools/vulnerability-assessment-tools/vulnerability-scanners/cloud-security-posture-scanners/kubernetes-posture-scanning.md) — Provides a comprehensive platform for scanning Kubernetes clusters, manifests, and images for misconfigurations and vulnerabilities.
- [Behavioral Threat Detection](https://awesome-repositories.com/f/security-cryptography/behavioral-threat-detection.md) — Establishes baselines of normal workload behavior and alerts when activities deviate from that profile. ([source](https://kubescape.io/docs/operator/node-agent-rule-library/))
- [Compliance & Audit Tools](https://awesome-repositories.com/f/security-cryptography/compliance-audit-tools.md) — Evaluates cluster state against a library of security controls for regulatory and security compliance.
- [Security Benchmarking](https://awesome-repositories.com/f/security-cryptography/compliance-frameworks/security-benchmarking.md) — Checks cluster configurations against industry-standard benchmarks like CIS and STIG. ([source](https://kubescape.io/docs/frameworks-and-controls/frameworks/))
- [Runtime Threat Detection](https://awesome-repositories.com/f/security-cryptography/detection-engines/runtime-threat-detection.md) — Detects behavioral anomalies and active threats within a cluster using system probes and signature-based rules.
- [Orchestration Admission Controllers](https://awesome-repositories.com/f/security-cryptography/identity-access-management/access-control/policy-enforcement-engines/resource-access-control-layers/orchestration-admission-controllers.md) — Enforces security policies by validating and blocking non-compliant resources before they enter a cluster.
- [Kubernetes Compliance Monitoring](https://awesome-repositories.com/f/security-cryptography/kubernetes-compliance-monitoring.md) — Evaluates cluster configurations against industry security benchmarks and regulatory frameworks to ensure adherence to hardening guides.
- [Node-Level Security Probes](https://awesome-repositories.com/f/security-cryptography/local-hosting-security/node-level-security-probes.md) — Deploys node-level agents to perform low-level system probes for runtime threat detection and host-specific security scanning.
- [Security Standard Enforcers](https://awesome-repositories.com/f/security-cryptography/security-standards/security-standard-enforcers.md) — Employs a standardized engine to scan cluster settings for security flaws and ensure compliance with established benchmarks. ([source](https://kubescape.github.io/helm-charts/))
- [Signature-Based Threat Detectors](https://awesome-repositories.com/f/security-cryptography/threat-detection/signature-based-threat-detectors.md) — Monitors system calls and network traffic using signature-based rules to identify malicious activity. ([source](https://kubescape.io/docs/guides/deploying-on-openshift/))
- [Container Image Vulnerability Scanners](https://awesome-repositories.com/f/security-cryptography/vulnerability-scanning/container-image-vulnerability-scanners.md) — Identifies known security flaws in container images and determines if vulnerabilities are reachable at runtime.
- [Custom Detection Rules](https://awesome-repositories.com/f/security-cryptography/custom-detection-rules.md) — Provides a framework for defining custom security rules using an expression language to trigger alerts. ([source](https://kubescape.io/docs/operator/node-agent-rule-library/))
- [Malware Scanning](https://awesome-repositories.com/f/security-cryptography/file-upload-security/malware-scanning.md) — Integrates an antivirus engine to scan files and volumes on cluster nodes for malicious software. ([source](https://kubescape.io/docs/operator/runtime-threat-detection/))
- [Security Frameworks](https://awesome-repositories.com/f/security-cryptography/governance-policy-frameworks/security-frameworks.md) — Organizes security checks into structured frameworks to monitor compliance coverage across the organization. ([source](https://kubescape.io/docs/frameworks-and-controls/frameworks/))
- [Infrastructure as Code Security](https://awesome-repositories.com/f/security-cryptography/infrastructure-as-code-security.md) — Performs automated security scanning of infrastructure configuration files and manifests. ([source](https://kubescape.io/docs/))
- [Network Policy Generation](https://awesome-repositories.com/f/security-cryptography/kubernetes-security/network-policy-generation.md) — Analyzes cluster traffic and workload requirements to automatically generate network isolation policies. ([source](https://cdn.jsdelivr.net/gh/kubescape/kubescape@master/README.md))
- [Multi-Format Vulnerability Reports](https://awesome-repositories.com/f/security-cryptography/multi-format-vulnerability-reports.md) — Generates security reports in multiple standardized formats like JSON and SARIF for delivery pipelines. ([source](https://kubescape.io/docs/scanning/))
- [Node Configuration Auditing](https://awesome-repositories.com/f/security-cryptography/product-security-management/security-scan-organizers/security-benchmarks/node-configuration-auditing.md) — Performs technical auditing of host-level system settings and directories to verify security hardening on nodes. ([source](https://kubescape.io/docs/scanning/))
- [Remote Security Audits](https://awesome-repositories.com/f/security-cryptography/remote-security-audits.md) — Executes scheduled scans and administrative actions through a controller that accepts remote security audit commands. ([source](https://kubescape.io/docs/operator/))
- [Software Bill of Materials Scanners](https://awesome-repositories.com/f/security-cryptography/security-auditing/dependency-vulnerability-scanning/software-bill-of-materials-scanners.md) — Processes software bill of materials files embedded within image filesystems to enhance vulnerability analysis. ([source](https://kubescape.io/docs/operator/vulnerabilities/))
- [Security Baselines](https://awesome-repositories.com/f/security-cryptography/security-configurations/security-baselines.md) — Identifies resources with excessive permissions to establish a secure configuration baseline. ([source](https://kubescape.io/docs/scanning/))
- [Hardening Framework Validations](https://awesome-repositories.com/f/security-cryptography/security/infrastructure-and-hardware/infrastructure-system-hardening/deployment-security-hardening/container-security-hardening/hardening-framework-validations.md) — Validates clusters and workloads against hardening frameworks to identify security risks. ([source](https://kubescape.io/docs/getting-started/))
- [VEX Document Generation](https://awesome-repositories.com/f/security-cryptography/vulnerability-report-generation/vex-document-generation.md) — Produces vulnerability exchange documents by determining if a vulnerable package is loaded into memory. ([source](https://kubescape.io/docs/operator/generating-vex/))
- [Offline Vulnerability Analysis](https://awesome-repositories.com/f/security-cryptography/vulnerability-scanning/offline-vulnerability-analysis.md) — Performs vulnerability lookups in environments without internet access using an offline database. ([source](https://kubescape.io/docs/operator/vulnerabilities/))
- [Automated Security Scan Triggers](https://awesome-repositories.com/f/security-cryptography/vulnerability-scanning/scanning-template-libraries/automated-security-scan-triggers.md) — Automatically initiates security scans triggered by external providers and infrastructure changes. ([source](https://kubescape.io/docs/scanning/))

### DevOps & Infrastructure

- [Host Security Agents](https://awesome-repositories.com/f/devops-infrastructure/deployment-targets/daemonset-deployment-controllers/host-security-agents.md) — Deploys node-level agents via DaemonSets to perform runtime threat detection and host scanning.
- [Security Agent Orchestration](https://awesome-repositories.com/f/devops-infrastructure/deployment-targets/daemonset-deployment-controllers/security-agent-orchestration.md) — Runs node agents as DaemonSets to ensure comprehensive host scanning and runtime vulnerability analysis across the cluster. ([source](https://kubescape.io/docs/operator/))
- [Admission-Based Policy Enforcement](https://awesome-repositories.com/f/devops-infrastructure/infrastructure/configuration-policy-enforcement/admission-based-policy-enforcement.md) — Uses admission controllers to validate resource configurations and block insecure deployments before they enter the cluster.
- [Kubernetes Cluster Management](https://awesome-repositories.com/f/devops-infrastructure/kubernetes-cluster-management.md) — Uses a Kubernetes operator to automate the deployment and lifecycle of security scanning components across the cluster.
- [Runtime Reachability Analysis](https://awesome-repositories.com/f/devops-infrastructure/runtime-vulnerability-monitors/runtime-reachability-analysis.md) — Maps libraries loaded in memory at runtime against static scans to filter unreachable vulnerabilities.
- [Security Scanning Integrations](https://awesome-repositories.com/f/devops-infrastructure/ci-cd-pipeline-integrations/security-scanning-integrations.md) — Integrates security scanning into CI/CD pipelines to detect risks within pull requests. ([source](https://kubescape.io/docs/guides/kubescape-gha/))
- [Operator-Based Lifecycles](https://awesome-repositories.com/f/devops-infrastructure/deployment-lifecycle-managers/operator-based-lifecycles.md) — Automates the deployment and lifecycle management of security components using a Kubernetes operator.
- [Synchronized Scan Scheduling](https://awesome-repositories.com/f/devops-infrastructure/kubernetes-cluster-management/security-scanning/synchronized-scan-scheduling.md) — Coordinates the timing of security scans between internal cluster state and external service providers. ([source](https://kubescape.io/docs/operator/))
- [Automated Security Fixes](https://awesome-repositories.com/f/devops-infrastructure/kubernetes-manifest-management/automated-security-fixes.md) — Applies automatic fixes to manifest files to resolve detected security misconfigurations. ([source](https://cdn.jsdelivr.net/gh/kubescape/kubescape@master/README.md))
- [Selector-Based Rule Filtering](https://awesome-repositories.com/f/devops-infrastructure/label-based-selection/target-selection-rules/selector-based-rule-filtering.md) — Assigns security rules to specific namespaces or workloads using label and namespace selectors. ([source](https://kubescape.io/docs/operator/node-agent-rule-library/))
- [Recurring Job Scheduling](https://awesome-repositories.com/f/devops-infrastructure/recurring-job-scheduling.md) — Automates periodic security checks for configurations, images, and registries using a recurring job scheduling system. ([source](https://kubescape.github.io/helm-charts/))
- [Security Rule Sandboxes](https://awesome-repositories.com/f/devops-infrastructure/sandboxing-environments/traffic-replay-sandboxes/security-rule-sandboxes.md) — Simulates security policies in an isolated sandbox to verify behavior before production deployment. ([source](https://kubescape.io/docs/operator/ui-with-headlamp/))

### Networking & Communication

- [Admission Webhooks](https://awesome-repositories.com/f/networking-communication/proxy-servers/proxy-enforcement/injection-enforcement/admission-webhooks.md) — Intercepts resource creation requests via validating admission webhooks to block non-compliant configurations.
- [External Alert Escalations](https://awesome-repositories.com/f/networking-communication/external-activity-notifications/external-alert-escalations.md) — Forwards security threat notifications to external platforms via APIs or HTTP endpoints. ([source](https://kubescape.io/docs/operator/runtime-threat-detection/))

### Software Engineering & Architecture

- [Expression Languages](https://awesome-repositories.com/f/software-engineering-architecture/expression-languages.md) — Evaluates cluster state using a custom expression language for compliance auditing.
- [Runtime Event Signature Matching](https://awesome-repositories.com/f/software-engineering-architecture/runtime-event-signature-matching.md) — Matches runtime events against known attack patterns using a customizable rule engine to identify threats. ([source](https://kubescape.io/docs/operator/runtime-threat-detection/))

### Part of an Awesome List

- [Manifest Scanning](https://awesome-repositories.com/f/awesome-lists/security/kubernetes-security/manifest-scanning.md) — Statically analyzes Kubernetes manifest files to ensure compliance with security best practices before deployment. ([source](https://kubescape.io/docs/scanning/))

### Business & Productivity Software

- [eBPF Runtime Security Monitors](https://awesome-repositories.com/f/business-productivity-software/real-time-monitoring/application-security-monitoring/ebpf-runtime-security-monitors.md) — Uses eBPF-based monitoring to detect active threats and analyze system behavior in a running environment. ([source](https://cdn.jsdelivr.net/gh/kubescape/kubescape@master/README.md))

### Development Tools & Productivity

- [Container Image Patching](https://awesome-repositories.com/f/development-tools-productivity/automatic-framework-updates/container-image-patching.md) — Updates packages within container images to fixed versions to remediate identified vulnerabilities. ([source](https://kubescape.io/docs/guides/kubescape-cli/))
- [IDE Real-time Feedback](https://awesome-repositories.com/f/development-tools-productivity/ide-real-time-feedback.md) — Provides real-time analysis and remediation guidance for configuration files directly within the code editor during development. ([source](https://kubescape.io/docs/integrations/vscode/))

### Scientific & Mathematical Computing

- [Security Risk Assessments](https://awesome-repositories.com/f/scientific-mathematical-computing/risk-assessment-metrics/risk-assessment/risk-management-frameworks/security-risk-assessments.md) — Evaluates the security posture of deployments to quantify risk and prioritize remediation tasks. ([source](https://kubescape.io/docs/))

### System Administration & Monitoring

- [Cluster Monitoring](https://awesome-repositories.com/f/system-administration-monitoring/cluster-monitoring.md) — Watches the cluster API for real-time changes to trigger security actions and track health. ([source](https://kubescape.github.io/helm-charts/))
- [Security Metrics Exports](https://awesome-repositories.com/f/system-administration-monitoring/real-time-monitoring/security-metrics-exports.md) — Sends real-time scan results and security telemetry to external monitoring systems for observability. ([source](https://kubescape.io/docs/guides/deploying-on-openshift/))

### User Interface & Experience

- [Security Findings Visualizations](https://awesome-repositories.com/f/user-interface-experience/security-findings-visualizations.md) — Displays compliance results and workload vulnerabilities through a graphical user interface. ([source](https://kubescape.io/docs/operator/ui-with-headlamp/))