Analyzing Kubescape

Kubescape Kubernetes Security Analysis Skill

Analyze Kubernetes cluster security posture using Kubescape frameworks and controls.

MANDATORY: Discovery-First Pattern

Always check cluster connectivity and available frameworks before scanning.

Phase 1: Discovery

#!/bin/bash

echo "=== Kubescape Version ==="
kubescape version 2>/dev/null

echo ""
echo "=== Available Frameworks ==="
kubescape list frameworks 2>/dev/null | head -15

echo ""
echo "=== Cluster Context ==="
kubectl config current-context 2>/dev/null

echo ""
echo "=== Cluster Summary ==="
echo "Namespaces: $(kubectl get ns --no-headers 2>/dev/null | wc -l)"
echo "Pods: $(kubectl get pods --all-namespaces --no-headers 2>/dev/null | wc -l)"
echo "Deployments: $(kubectl get deployments --all-namespaces --no-headers 2>/dev/null | wc -l)"

Core Helper Functions

#!/bin/bash

# Kubescape wrapper with JSON output
ks_cmd() {
    kubescape "$@" --format json --output /dev/stdout 2>/dev/null
}

# Scan with specific framework
ks_framework() {
    local framework="$1"
    shift
    kubescape scan framework "$framework" "$@" --format json --output /dev/stdout 2>/dev/null
}

# Summary extractor
ks_summary() {
    jq '{
        risk_score: .summaryDetails.complianceScore,
        total_controls: .summaryDetails.numberOf.allControls,
        passed: .summaryDetails.numberOf.passedControls,
        failed: .summaryDetails.numberOf.failedControls,
        skipped: .summaryDetails.numberOf.skippedControls
    }'
}

Output Rules

• TOKEN EFFICIENCY: Target <=50 lines per output
• Use --format json with jq for structured results
• Use --include-namespaces to scope scans
• Focus on failed controls and remediation guidance

Common Operations

NSA/CISA Framework Assessment

#!/bin/bash
echo "=== NSA/CISA Framework Scan ==="
kubescape scan framework nsa --format json --output /dev/stdout 2>/dev/null | jq '{
    compliance_score: .summaryDetails.complianceScore,
    controls: {
        total: .summaryDetails.numberOf.allControls,
        passed: .summaryDetails.numberOf.passedControls,
        failed: .summaryDetails.numberOf.failedControls
    },
    top_failures: [.results[] | select(.status == "failed") | {
        id: .controlID,
        name: .name,
        severity: .scoreFactor,
        failed_resources: (.resourceIDs | length)
    }] | sort_by(-.severity) | .[0:10]
}'

MITRE ATT&CK Mapping

#!/bin/bash
echo "=== MITRE ATT&CK Scan ==="
kubescape scan framework MITRE --format json --output /dev/stdout 2>/dev/null | jq '{
    compliance_score: .summaryDetails.complianceScore,
    attack_techniques: [.results[] | select(.status == "failed") | {
        control: .controlID,
        technique: .name,
        severity: .scoreFactor,
        affected_resources: (.resourceIDs | length)
    }] | sort_by(-.severity) | .[0:10]
}'

Workload Scanning

#!/bin/bash
NAMESPACE="${1:-default}"

echo "=== Workload Scan: $NAMESPACE ==="
kubescape scan --include-namespaces "$NAMESPACE" --format json --output /dev/stdout 2>/dev/null | jq '{
    namespace: "'"$NAMESPACE"'",
    score: .summaryDetails.complianceScore,
    failed_controls: [.results[] | select(.status == "failed") | {
        control: .controlID,
        name: .name,
        resources: [.resourceIDs[]? | split("/") | last][:5]
    }] | .[0:10]
}'

echo ""
echo "=== Resource Risk Summary ==="
kubescape scan --include-namespaces "$NAMESPACE" --format json --output /dev/stdout 2>/dev/null | jq '
    [.resources[]? | {
        kind: .kind,
        name: .name,
        failed_controls: ([.controls[]? | select(.status == "failed")] | length)
    }] | sort_by(-.failed_controls) | .[0:10]
'

RBAC Analysis

#!/bin/bash
echo "=== RBAC Security Scan ==="
kubescape scan control C-0035,C-0036,C-0037,C-0038,C-0039 --format json --output /dev/stdout 2>/dev/null | jq '{
    rbac_controls: [.results[] | {
        id: .controlID,
        name: .name,
        status: .status,
        affected: (.resourceIDs | length)
    }]
}'

echo ""
echo "=== Cluster Admin Bindings ==="
kubectl get clusterrolebindings -o json 2>/dev/null | jq -r '
    .items[] |
    select(.roleRef.name == "cluster-admin") |
    .subjects[]? | "\(.kind)\t\(.name)\t\(.namespace // "cluster-scoped")"
' | column -t

Compliance Comparison

#!/bin/bash
echo "=== Multi-Framework Compliance ==="
for fw in NSA MITRE CIS; do
    SCORE=$(kubescape scan framework "$fw" --format json --output /dev/stdout 2>/dev/null | jq '.summaryDetails.complianceScore')
    echo "$fw: ${SCORE}% compliance"
done

echo ""
echo "=== CIS Kubernetes Benchmark ==="
kubescape scan framework CIS --format json --output /dev/stdout 2>/dev/null | jq '{
    score: .summaryDetails.complianceScore,
    sections: [.results[] | select(.status == "failed") | .controlID[:4]] |
        group_by(.) | map({section: .[0], failures: length}) | sort_by(-.failures)
}'

Safety Rules

• Scans are read-only -- Kubescape uses list/get API calls only
• RBAC permissions required -- ensure service account has cluster-reader access
• Namespace scoping -- use --include-namespaces to limit blast radius of recommendations
• Custom frameworks should be reviewed before deployment
• Risk scores are relative -- use them for prioritization, not absolute compliance status

Output Format

Present results as a structured report:

Analyzing Kubescape Report
══════════════════════════
Resources discovered: [count]

Resource       Status    Key Metric    Issues
──────────────────────────────────────────────
[name]         [ok/warn] [value]       [findings]

Summary: [total] resources | [ok] healthy | [warn] warnings | [crit] critical
Action Items: [list of prioritized findings]

Target ≤50 lines of output. Use tables for multi-resource comparisons.

Anti-Hallucination Rules

1. NEVER assume resource names — always discover via CLI/API in Phase 1 before referencing in Phase 2.
2. NEVER fabricate metric names or dimensions — verify against the service documentation or --help output.
3. NEVER mix CLI commands between service versions — confirm which version/API you are targeting.
4. ALWAYS use the discovery → verify → analyze chain — every resource referenced must have been discovered first.
5. ALWAYS handle empty results gracefully — an empty response is valid data, not an error to retry.

Counter-Rationalizations

Common Pitfalls

• Kubeconfig context: Scans use current kubeconfig context -- verify you are scanning the intended cluster
• Namespace exclusions: System namespaces (kube-system) often have legitimate elevated privileges -- review context
• Score interpretation: 100% compliance score does not mean fully secure -- frameworks cover specific aspects
• Resource-heavy scans: Large clusters with many resources can produce huge JSON output -- use namespace filtering
• Control exceptions: Some controls may not apply to your environment -- use exception policies
• Offline scanning: Kubescape can scan YAML manifests without cluster access -- use for shift-left
• Version differences: Control IDs and names change between Kubescape versions -- pin version in CI
• Host scanning: Node-level controls (CIS benchmarks) require host access -- not available in managed K8s