HackBlue

Tools · Containers and Kubernetes security · 19 / 20

Scanning a Kubernetes cluster’s posture with Kubescape and Trivy

Run Kubescape and trivy k8s against a lab cluster, read framework scores such as NSA-CISA and MITRE, and prioritize the controls that fail across many workloads.

9 min read · practice only with authorization

What cluster scanners do

Where kube-bench checks node configuration, posture scanners read objects through the API: workloads, RBAC, network policies, and services. Kubescape maps results to frameworks such as the NSA-CISA Kubernetes Hardening Guide, MITRE ATT&CK for containers, and CIS. trivy k8s combines vulnerability scanning of running images with misconfiguration checks.

Running scans

Both tools use your kubeconfig, so run them with a read-only identity where possible. Kubescape prints a control table with failed resources per control and an overall compliance score.

Snippet
kubescape scan framework nsa --exclude-namespaces kube-system
kubescape scan control C-0057 -v   # privileged containers
trivy k8s --report summary
trivy k8s --include-namespaces shop --report all --format json -o shop.json

Lab: deploy something bad, then fix it

In a kind cluster, deploy a workload with privileged: true, no limits, and a LoadBalancer service. Scan and note the failing controls. Apply fixes from the previous lessons, such as a restricted securityContext, limits, and a ClusterIP service, then scan again and compare the control results. Write down which single change cleared the most failed resources.

Prioritizing

Fix controls that grant host access or cluster-wide privilege first: privileged containers, hostPath, cluster-admin bindings, and exposed dashboards. Then network policies and limits. Score improvements are motivating, but the goal is removing paths to the node and to cluster-wide credentials.

Diagram

Which scanner for which question

Use them together.

  • kube-bench

    Are the node and control-plane components configured per CIS?

  • Kubescape

    Do workloads and RBAC meet NSA-CISA, MITRE, or CIS controls?

  • trivy k8s

    Which running images have vulnerabilities, and which objects are misconfigured?

  • Audit logs and Falco

    What is actually happening right now?

Check yourself

1. How does Kubescape gather most of its data?

2. Which failing control should usually be fixed first?

3. Which framework is published jointly by the NSA and CISA?