domains / families / security / scanning-kubernetes-manifests-with-kubesec

scanning-kubernetes-manifests-with-kubesec

separate

Scores Kubernetes resource manifests with Kubesec to flag misconfiguration and privilege-escalation risk before deployment, mapping each finding back to the securityContext change that fixes it. Use when gating manifests in CI, reviewing YAML or a rendered chart before it reaches a cluster, or explaining why a manifest scored negatively. Keywords: Kubesec, manifest score, securityContext, readOnlyRootFilesystem, runAsNonRoot, CI gate. Do not use for scanning built images for CVEs - use scanning-docker-images-with-trivy; for admission-time enforcement use implementing-opa-gatekeeper-for-policy-enforcement.

When to use

• When conducting security assessments that involve scanning kubernetes manifests with kubesec
• When following incident response procedures for related security events
• When performing scheduled security testing or auditing activities
• When validating security controls through hands-on testing

When not to use

• scanning built images for CVEs
• admission-time enforcement

Skill page

Source