Kubescape Integration Guide

Integrate Kubescape with Vulnetix. Scan Kubernetes clusters, manifests, and Helm charts against NSA, MITRE ATT&CK, and CIS frameworks.

Install & scan

$ curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | bash
$ kubescape scan --format sarif --output kubescape.sarif

Run Kubescape in CI

Scan on every push and upload the report as a workflow artifact:

- name: Install Kubescape
  run: curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | bash
- name: Run Kubescape
  run: kubescape scan --format sarif --format-version v2 --output kubescape.sarif
- name: Upload report
  uses: actions/upload-artifact@v6
  with:
    name: kubescape
    path: kubescape.sarif
    if-no-files-found: warn

Then one publish job hands every artifact in the run to Vulnetix, recorded under Kubescape's own name and version. Written once per workflow, however many scanners you run:

publish:
  name: Publish to Vulnetix
  runs-on: ubuntu-latest
  needs: [scan]        # every scanner job, or its report is never published
  if: always()         # or one failing scanner suppresses all the others
  permissions:
    contents: read
    actions: read      # required to list the run's artifacts
  env:
    VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
    VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
  steps:
    - uses: actions/checkout@v5
    - name: Install Vulnetix CLI
      run: |
        curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
        echo "$HOME/.local/bin" >> "$GITHUB_PATH"
    - name: Publish scanner reports
      env:
        GITHUB_TOKEN: ${{ github.token }}
      run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --json

After the run, vulnetix gha status reports what was actually recorded.

How Vulnetix compares: better together

Vulnetix does not replace Kubescape. Keep running it. Vulnetix sits on top of Kubescape (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.

Kubescape is strongest at its core category and also carries features in IaC & Cloud Configuration, SCA, SBOM Generation, just as Vulnetix spans categories.

✓ full · ~ partial · ✗ not covered

What Kubescape does well

• Best-in-class open-source Kubernetes posture: scans clusters, manifests and Helm charts against NSA-CISA, MITRE ATT&CK for Containers and CIS Kubernetes Benchmark out of the box
• Full k8s-native lifecycle coverage via a CNCF operator: IDE, CI/CD and in-cluster continuous scanning, admission control (CEL policies) and network-policy generation
• eBPF runtime 'relevancy' that filters image CVEs down to components actually loaded at runtime, cutting noise
• First open-source project to generate OpenVEX documents alongside image vulnerability reports, built on its CycloneDX SBOMs

Where Vulnetix adds to it: Kubescape is a scanner Vulnetix orchestrates rather than replaces: Vulnetix ingests its k8s misconfig, RBAC and image-CVE output and folds it into one cross-scanner deduplicated queue, then layers exploit-intel prioritisation (EPSS, CISA KEV, ESS, LEV), immutable versioned VEX + audit, EOL and SSVC policy, and Safe Harbour autofix that Kubescape does not provide. Vulnetix also broadens coverage beyond Kubernetes to 40+ SCA ecosystems, SAST, cloud/CSPM, secrets and the install-time package firewall.

No migration, no rip-and-replace. Kubescape keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.

Centralise Kubescape results in Vulnetix

Upload Kubescape SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.

Kubescape documentation ↗  ·  Source repository ↗

Wire Kubescape into your CI/CD pipeline →