Kubescape: one rule library, a CLI and an in-cluster operator

Scroll or pinch to zoom, drag to move, double-click to zoom in 100% SVG PNG Back to the post

Kubescape architecture: an engineer or CI job runs the Kubescape CLI, which loads frameworks and controls from the control library and exports reports in SARIF, JUnit or JSON. In the cluster, the operator triggers the scanner on a schedule; the scanner reads resources from the Kubernetes API with read-only access, evaluates them with the same rules from the control library, and writes results as Kubernetes custom resources served by an in-cluster API.