KubeClarity Integration Guide

Integrate KubeClarity with Vulnetix. Generate CycloneDX or SPDX SBOMs from container images and scan them for vulnerabilities using Grype or Trivy. Upload to Vulnetix.

Install & scan

$ # Download kubeclarity-cli binary
curl -sL https://github.com/openclarity/kubeclarity/releases/latest/download/kubeclarity-cli-linux-amd64 -o kubeclarity-cli
chmod +x kubeclarity-cli
sudo mv kubeclarity-cli /usr/local/bin/
$ # Generate SBOM (CycloneDX JSON)
ANALYZER_LIST="syft" kubeclarity-cli analyze   --input-type image nginx:latest   -o nginx.sbom

# Scan SBOM for vulnerabilities (Grype)
SCANNERS_LIST="grype" kubeclarity-cli scan   nginx.sbom --input-type sbom

Run KubeClarity in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install kubeclarity-cli
  run: |
    curl -sL https://github.com/openclarity/kubeclarity/releases/latest/download/kubeclarity-cli-linux-amd64 -o kubeclarity-cli
    chmod +x kubeclarity-cli

- name: Generate SBOM and scan
  run: |
    ANALYZER_LIST="syft" ./kubeclarity-cli analyze       --input-type image myapp:${{ github.sha }} -o myapp.sbom.json
    SCANNERS_LIST="grype" ./kubeclarity-cli scan myapp.sbom.json --input-type sbom

- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: kubeclarity
    path: myapp.sbom.json
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under KubeClarity's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace KubeClarity. Keep running it. Vulnetix sits on top of KubeClarity (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

KubeClarity is strongest at its core category and also carries features in Container & Image Scanning, SBOM Generation, License Compliance, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What KubeClarity does well

• Orchestrates multiple SBOM generators (Syft, Cyclonedx-gomod, Trivy) and multiple vuln scanners (Grype, Dependency-Track, Trivy) in parallel and merges their results into a unified severity/source/fix view
• Scans both CI/CD pipelines and live Kubernetes clusters with automatic runtime target detection
• Merges SBOMs and vulnerability reports across CI/CD stages, and navigates an application/resource/package/vuln object tree with per-license and per-language package tracking
• Free and open source (CycloneDX-based), an easy self-hosted entry point for container SBOM + vuln management

Where Vulnetix adds to it: KubeClarity aggregates a handful of open-source scanners into a merged report; Vulnetix goes further as a full ASPM layer covering many more scanner types (SAST, IaC, secrets, cloud, malware) and adds exploit-intel prioritisation (EPSS/KEV/ESS/CWSS/LEV), tree-sitter reachability, immutable versioned VEX with audit, Safe Harbour autofix PRs, EOL and SSVC policy. Note KubeClarity is deprecated in favour of openclarity/openclarity; Vulnetix ingests either's output and layers governance on top rather than replacing the scan engines.

No migration, no rip-and-replace. KubeClarity keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise KubeClarity results in Vulnetix

Upload KubeClarity CycloneDX, SPDX, JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

KubeClarity documentation ↗  ·  Source repository ↗

Wire KubeClarity into your CI/CD pipeline →