Project: Kubescape (Provisioning / Security & Compliance)
File: getting-started.md

Kubescape can run as a command line tool on a client, as an operator inside a cluster, as part of your CI/CD process, or more. The best way to get started with Kubescape is to download it to the machine you use to manage your Kubernetes cluster. ```sh curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash ``` (We're a security product; please read the file before you run it!) You can also check ```sh kubescape scan --verbose ``` You will see output like this: <img src="img/summary.png"> Some documentation on using Kubescape is yet to move here from the . Scan a running Kubernetes cluster: ```sh kubescape scan --verbose ``` > Note > . Scan a running Kubernetes cluster with the : ```sh kubescape scan framework nsa ``` Scan a running Kubernetes cluster with the : ```sh kubescape scan framework mitre ``` Scan for a specific control, using the control name or control ID. . ```sh kubescape scan control "Privileged container" ``` Use an alternative kubeconfig file: ```sh kubescape scan --kubeconfig cluster.conf ``` Scan specific namespaces: ```sh kubescape scan --include-namespaces development,staging,production ``` Exclude certain namespaces: ```sh kubescape scan --exclude-namespaces kube-system,kube-public ``` Scan local YAML/JSON files before deploying: ```sh kubescape scan *.yaml ``` . Scan Kubernetes manifest files from a Git repository: ```sh kubescape scan https://github.com/kubescape/kubescape ``` Scan with exceptions ```sh kubescape scan --exceptions examples/exceptions/exclude-kube-namespaces.json ``` Objects with exceptions will be presented as `exclude` and not `fail`. Scan Helm charts ```sh kubescape scan </path/to/directory> ``` > Note > Kubescape will load the default VALUES file. Scan a Kustomize directory ```sh kubescape scan </path/to/directory> ``` > Note > Kubescape will generate Kubernetes YAML objects using a `kustomize` file and scan them for security. Trigger in cluster components for scanning your cluster: If kubescape helm chart is install in your cluster we can trigger scanning of the in cluster components from the kubescape

```sh kubescape operator scan config ``` ```sh kubescape operator scan vulnerabilities ``` Compliance Score We offer two important metrics to assess compliance: Control Compliance Score: This score measures the compliance of individual controls within a framework. It is calculated by evaluating the ratio of resources that passed to the total number of resources evaluated against that control. ```sh kubescape scan --compliance-threshold <SCORE_VALUE[float32]> ``` Framework Compliance Score: This score provides an overall assessment of your cluster's compliance with a specific framework. It is calculated by averaging the Control Compliance Scores of all controls within the framework. ```sh kubescape scan framework <FRAMEWORKNAME> --compliance-threshold <SCOREVALUE[float32]> ``` Kubescape scan with compliance score <img src="img/ks-scan-with-compliance.gif"> JSON: ```sh kubescape scan --format json --format-version v2 --output results.json ``` > Note > Add the `--format-version v2` flag for maximum compatibility. junit XML: ```sh kubescape scan --format junit --output results.xml ``` PDF: ```sh kubescape scan --format pdf --output results.pdf ``` Contributed by Prometheus metrics: ``` kubescape scan --format prometheus ``` Contributed by HTML ``` kubescape scan --format html --output results.html ``` Display all scanned resources (including the resources which passed): ```sh kubescape scan --verbose ``` It is possible to run Kubescape offline! Check out our . Download the controls and save them in the local directory. If no path is specified, they will be saved in `~/.kubescape`. ```sh kubescape download artifacts --output path/to/local/dir ``` Copy the downloaded artifacts to the offline system. Scan using the downloaded artifacts: ```sh kubescape scan --use-artifacts-from path/to/local/dir ``` You can also download a single artifact, and scan with the `--use-from` flag: Download and save in a file. If no file name is specified, the artifact will be saved as `~/.kubescape/<framework name>.json`. ```sh kubescape download framework nsa --output /path/nsa.json ``` Copy the downloaded artifacts to the offline system. Scan using the downloaded framework: ```sh kubescape scan framework nsa --use-from /path/nsa.json ``` We publish for our in-cluster components. Scan your YAML files while writing them using our . View Kubescape scan results directly in the using the . Experiment with Kubescape in the : this scenario will install a K3s cluster and Kubescape. You can start with any of the `kubescape scan` commands in the . Customize control configurations: -