Your deployment applied cleanly, and kubectl get pods shows Running.
But that same pod might be running as root, have no memory limit, and hold a service account token it never needed.
Kubernetes accepts it because the API server mainly checks whether your YAML is valid.
Kubescape goes further, and it reads the same file, showing which security controls failed, and points out the lines that could give an attacker an advantage, even before the resource reaches the cluster.
Below, you’ll install Kubescape on Ubuntu and Rocky Linux, scan a manifest and the image it uses, understand the compliance score, let Kubescape write fixes back to your YAML, and set a threshold that fails a CI build instead of allowing a risky deployment to continue.
Tested on Ubuntu 26.04 and Rocky Linux 10 with Kubescape 4.0.9 against a Kubernetes 1.33 cluster.
The commands work on any modern Linux distribution.
Kubescape checks your Kubernetes resources using Open Policy Agent (OPA) and a library of security controls.
Each control is a specific security check with an ID such as C-0016 or C-0017.
These controls are grouped into frameworks, so you can scan your workloads against NSA-CISA hardening guidance, MITRE ATT&CK techniques, or a CIS benchmark for your Kubernetes environment.
Kubescape can check your workloads at three different points.
It can scan YAML files and Helm charts before you apply them, scan container images for CVEs using Grype, and scan a running Kubernetes cluster using your existing kubeconfig.
The last part is important.
Kubescape connects to the Kubernetes API server using your credentials, so it can see the resources and information your account has permission to access.
The install script downloads the latest Kubescape binary and places it in your PATH.
In most setups, you don’t need root privileges.
If it can’t write to the installation directory, it may ask for sudo.
Here, sudo simply runs that installation step with administrator privileges.
On Ubuntu and Debian, you can install Kubescape from its PPA:
On RHEL and Rocky Linux, use the installation script:
The script also works on Ubuntu and is useful if you want to install a specific Kubescape release instead of the version currently available through the PPA.
After installation, check that Kubescape is available:
You should see output similar to:
If you get command not found, the binary may have been installed under ~/.kubescape/bin but that directory is not yet in your PATH.
Open a new shell or reload your shell profile, then run the version command again.
This is the scan that can save you from deploying a security problem.
Point Kubescape at a directory of manifests, and it evaluates every resource inside without touching your Kubernetes cluster.
Throughout this article, anything in angle brackets like is a placeholder.
Replace it with your actual path, including the brackets only when they are part of the command syntax.
Start with the Allow privilege escalation row.
One resource failed this check, meaning a container in the manifest can gain more privileges than the process that started it.
If an attacker compromises that application, this can give them a path to greater privileges on the node.
The Automatic mapping of service account failure is another one worth paying attention to.
Kubernetes mounts a service account token into pods by default, so a container that never needs to talk to the Kubernetes API may still have a credential available.
The Compliance Score at the bottom is a weighted percentage across the controls, not simply the percentage of controls that passed.
A score of 58.33% with five failed controls is a clear sign that the manifest needs attention before you deploy it.
The summary tells you which control failed.
Add -v to see more details:
The verbose output shows the failing resource by kind and name, the relevant path inside the YAML, and the remediation guidance for that control.
This is the output you can use when explaining the required fix in a pull request.
A clean manifest that pulls an outdated base image can still leave you with a vulnerable deployment.
Kubescape can scan container images directly, so you don’t need a Kubernetes cluster for this check.
The number to pay attention to is Vulnerabilities with available fixes: 63.
These vulnerabilities already have patched package versions available, so rebuilding the image with a current base image may clear many of them without changing your application code.
The two Critical findings need more detail before you can decide what to do.
Run the same command with -v, and Kubescape shows the CVE, affected package, and version that contains the fix.
Kubescape can write security fixes back into your YAML.
It works in two steps because the fix command uses a results file instead of scanning the manifests again.
Here’s what each part does:
Always run the dry run first.
Kubescape can edit your source YAML in place, and a fix such as adding readOnlyRootFilesystem: true could pass the security check but break a container that genuinely needs to write to the filesystem.
Once you’ve reviewed the proposed changes and the diff looks correct, run:
Manifests show what you intended to deploy.
The running cluster shows what’s actually there, including anything a colleague applied at 6pm on a Friday.
Scanning a specific namespace matters.
A broad cluster scan can include kube-system, where control plane and system components may legitimately run with higher privileges.
That can produce findings you don’t own or can’t change.
If you need a report that is easier to share with someone who doesn’t live in a terminal, use the HTML output:
The scan becomes really useful when it runs automatically, without someone having to remember to run it.
Kubescape can exit with code 1 when the compliance score falls below your threshold, which is enough for a CI pipeline to stop the build.
Here’s what each part does:
Start the threshold close to your current score, then raise it gradually.
Setting it to 90% on day one will likely get the check disabled before the week is over.
Kubescape 4 includes an MCP server that lets AI assistants access vulnerability and configuration scan results.
Instead of searching through JSON manually, you can ask which workloads are affected by a specific CVE.
Start the MCP server with:
Kubescape checks Kubernetes configuration and package metadata.
It won’t tell you if your application is logging credentials, and it won’t catch a business logic flaw in your API.
The output format can also change between major versions.
A –format json parser written for Kubescape 2 may not work with Kubescape 4.
Pin the Kubescape version in CI, and check the release notes before upgrading.
You installed Kubescape, scanned a manifest before it reached the cluster, learned what the compliance score actually means, scanned the image your workload pulls, used kubescape fix to write corrections back into your YAML, and set a threshold that can fail a build instead of letting a security issue reach production.
Do this one thing right now: run kubescape scan / against the manifests you deployed most recently, and look at the high-severity findings first.
Anything listed there may have been running in your cluster since the day you applied it.
What did your first scan return, and which control surprised you the most? Drop your compliance score in the comments and tell us which finding you fixed first.
Rio Terminal for Linux: Speed Up Your Command-Line Workflow
Hyperswitch on Linux: A Self-Hosted Payment Switch for Multiple Processors
TiDB: Build a MySQL-Compatible Distributed SQL Database on Linux
lazygit: Manage Git Repositories from the Linux Terminal
Hister: Search Local Files Instantly in Linux
Prometheus TSDB: Manage Data Storage and Retention on Linux
Install OpenNMS Network Monitoring Tool in CentOS/RHEL 7
How to Add Linux Host to Nagios Monitoring Server Using NRPE Plugin
How to Install Nagios XI on Ubuntu 22.04
Mytop – A Useful Tool for Monitoring MySQL/MariaDB Performance in Linux
6 Open Source Tools to Monitor MySQL Performance in Linux
15 Useful Performance and Network Monitoring Tools for Linux
Find Top 15 Processes by Memory Usage with ‘top’ in Batch Mode
Wikit – A Command Line Tool to Search Wikipedia on Linux
An Easy Way to Hide Files and Directories in Linux
The Ultimate Guide to Handling Filenames with Special Characters in Linux
How to Convert From RPM to DEB and DEB to RPM Package Using Alien
5 Best Command Line HTTP Clients for Linux
Top 6 Linux Apps You Should Install This Week (Sept 15-21)
18 Must-Try Web Browsers for Linux Users in 2024
22 Best Free C/C++ IDEs and Editors for Linux in 2026
27 Best Tools for VMware Administrators in 2024
5 GUI Tools to Free Up Space on Debian, Ubuntu and Linux Mint
23 Best Open Source Text Editors for Linux in 2024
—
**📚 Original Source:**
[Kubescape: Kubernetes Security Scanning for Manifests, Images, and Clusters](https://www.tecmint.com/kubescape-security-scanner/)
About The Author
