Kubescape Kubernetes Security Scan

# Install
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | bash

# Scan the cluster
kubescape scan

# Results
Controls: 85 (Passed: 62, Failed: 18, Skipped: 5)
Risk score: 32%

Failed controls:
  CRITICAL: C-0086 - Ensure that pods run as non-root
  HIGH:     C-0034 - Ensure network policies are configured
  HIGH:     C-0057 - Privileged containers detected
  MEDIUM:   C-0018 - Ensure CPU limits are set

# NSA Kubernetes Hardening Guide
kubescape scan framework nsa

# MITRE ATT&CK
kubescape scan framework mitre

# CIS Kubernetes Benchmark
kubescape scan framework cis-v1.23-t1.0.1

# All frameworks
kubescape scan framework all

# Scan a namespace
kubescape scan --include-namespaces production

# Scan a specific workload
kubescape scan workload deployment/order-api -n production

# Scan YAML before deploying
kubescape scan *.yaml

FAILED: C-0086 - Ensure that pods run as non-root
Affected: deployment/order-api (production)

spec:
  containers:
    - name: order-api
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true

FAILED: C-0034 - Ensure network policies are configured
Affected: namespace/production (no NetworkPolicy found)

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

FAILED: C-0018 - Ensure CPU/memory limits are set
Affected: deployment/order-api (production)

resources:
  requests:
    cpu: 100m
    memory: 128Mi
  limits:
    cpu: 500m
    memory: 512Mi

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Kubescape scan
        uses: kubescape/github-action@main
        with:
          files: "k8s/*.yaml"
          frameworks: "nsa,mitre"
          severityThreshold: high
          failedThreshold: 0

helm install kubescape kubescape/kubescape-operator \
  --namespace kubescape --create-namespace

kubectl get workloadconfigurationscans -A
kubectl get vulnerabilitymanifests -A

# JSON for CI parsing
kubescape scan --format json -o results.json

# SARIF for GitHub Security tab
kubescape scan --format sarif -o results.sarif

# HTML report
kubescape scan --format html -o report.html

# Prometheus metrics
kubescape scan --submit --account=<account-id>

# kubescape-exceptions.yaml
apiVersion: kubescape.io/v1
kind: ExceptionPolicy
metadata:
  name: allow-kube-system-privileged
spec:
  exceptions:
    - name: "kube-system privileged"
      policyType: posturePolicy
      actions: ["alertOnly"]
      resources:
        - designators:
            - attributes:
                namespace: kube-system
      posturePolicies:
        - controlID: C-0057  # Privileged containers