Kubescape K8s

Purpose

Kubernetes-specific posture and compliance analysis: scores manifests, Helm charts and Kustomize against frameworks (NSA-CISA, CIS, MITRE ATT&CK, SOC2, PCI), and analyzes RBAC and privilege configuration.

Relation to Trivy (no needless overlap): Trivy already does basic K8s/IaC misconfiguration. Kubescape adds more on the K8s axis — framework-based compliance scoring and RBAC/cluster posture that Trivy does not provide. Use this skill only when the project actually contains Kubernetes resources; otherwise Trivy's misconfig scanner is enough.

Core Workflow (drive to zero)

1. Scan the directory containing manifests/charts:

   ~/.claude/skills/kubescape-k8s/scripts/scan.sh [TARGET_DIR]

2. Fix each failed control in the YAML: drop privileged/root, set readOnlyRootFilesystem, resource limits, securityContext, network policies, least-privilege RBAC, pinned image digests.
3. Re-run until controls pass.

Enforcing a gate

The hard gate is the severity threshold — fail if any failed control is at/above a severity (this is what the audit suite uses by default, high):

KUBESCAPE_SEVERITY=high ~/.claude/skills/kubescape-k8s/scripts/scan.sh [DIR]

Use medium to be stricter. This is the only reliable gate: the compliance-percentage flag (--compliance-threshold) does not fail the scan with the pinned CLI image (a manifest at 66% compliance still exits 0 even at threshold 100), so it was removed rather than expose a gate that does not gate.

The gate works by exit code: a failed control at/above the threshold makes kubescape exit 1, which the wrapper maps to RESULT: FAIL. kubescape logs that verdict as a level:fatal line ("... exceeds severity threshold ..."); the wrapper does not mistake that for an operational error — only a non-gate fatal (e.g. "no resources found to scan", a Docker/parse error) maps to RESULT: ERROR (exit 125).

Notes

• The container runs --rm with no persistent cache volume, so Kubescape re-downloads its frameworks on each run (a few seconds). The pinned CLI image runs as user nonroot, so mount a cache volume to /home/nonroot/.kubescape (not /home/ks, which does not exist in this image) if you want to persist them.
• JSON/SARIF output for parsing: KUBESCAPE_FORMAT=json scan.sh [DIR].
• Live-cluster scanning is possible but out of scope here — this skill targets manifests in the repo (the coding/refactoring workflow).

Resources

• scripts/scan.sh — runs kubescape scan against a manifest directory with an optional severity gate. Exit: 0 = pass, 1 = failed controls (FINDINGS), 125 = operational error (no resources / Docker / parse). Env: KUBESCAPE_FORMAT, KUBESCAPE_SEVERITY (the hard gate), KUBESCAPE_IMAGE.