Kubescape Scanning Pipeline

Kubescape Scanning Pipeline A workflow diagram generated by Archify. 01 / Input and framework 02 / Control evaluation 03 / Score aggregation 04 / Report output Kubescape CLI · Manifests · Helm · cluster · Input and framework Kubescape CLI Manifests · Helm · cluster Framework · NSA · CIS · MITRE · All · Input and framework Framework NSA · CIS · MITRE · All Parse Resources · Control evaluation Parse Resources Run Controls · Control evaluation Run Controls Check Rules · Control evaluation Check Rules Summarize Scores · Separate score fields · Score aggregation · Policy decision Summarize Scores Separate score fields Policy decision Classify Severity · Score aggregation Classify Severity Prioritize · Score aggregation Prioritize Console · Default output · Report output Console Default output JSON · --format json · Report output JSON --format json SARIF · --format sarif · Report output SARIF --format sarif HTML / PDF · --format html,pdf · Report output HTML / PDF --format html,pdf scan framework Legend Input Processing Policy Data Output/reference

Input scope

  • • Scan an explicit local YAML file for CI
  • • Render Helm/Kustomize before scanning
  • • No target file means a live-cluster scan

Scores and gates

  • • summaryDetails.score and complianceScore differ
  • • --compliance-threshold sets a minimum
  • • --severity-threshold gates failed controls

Output formats

  • • --format chooses the report type
  • • --output chooses the destination file
  • • JSON/SARIF/HTML/PDF are supported by4.0.14