Targeted at the DevSecOps practitioner or platform engineer, Kubescape, the open-source Kubernetes security platform has reached version 3.0.
Vulnerability scan results
Kubescape 3.0 features
Kubescape 3.0 adds new features that make it easier for organizations to secure their Kubernetes clusters, including:
Compliance and container scan results stored as Kubernetes resources inside API objects: This makes it easier to view and manage scan results and to integrate Kubescape with other Kubernetes tools and workflows.
Scanning container images for vulnerabilities from the CLI (command line interface): This makes it possible to shift security left by scanning images before they are deployed to production and to identify and fix vulnerabilities early on.
Reporting on the vulnerabilities of all the images in a cluster: This provides a comprehensive view of the security posture of all the images in a cluster and helps organizations prioritize remediation efforts.
New overview security scan, which helps you set a baseline for cluster security: This scan identifies key security risks in a cluster. It helps organizations to improve their overall security posture.
Highlighting high-risk workloads that could do the most damage if compromised: This helps organizations focus their security efforts on the workloads that pose the most significant risk.
Improved display output: Kubescape 3.0 features a new and improved display output that makes reading and understanding scan results easier.
A new capability-based Helm chart: This makes installing and configuring Kubescape with your needed features easier.
Per workload, per namespace, and per cluster Prometheus metrics: This makes it possible to monitor the security posture of workloads, namespaces, and clusters over time.
Alerting through Prometheus Alertmanager: This makes it possible to receive alerts when security problems exceed a configurable threshold.
Sending data outside of the cluster to Kubescape providers: This makes it possible to store security information outside of the cluster it is collected from so that it cannot be altered in the event of an attack. A well-documented API for operating a Kubescape-compatible service is available, in addition to native ARMO, Backstage, and Lens integrations.
“With the donation and launch of Kubescape 3.0, ARMO continues to play a vital role as a maintainer and steward of the Kubescape CNCF project. We are committed to bolstering the open-source security ecosystem by making Kubescape an easily accessible and complete solution for Kubernetes security. Through this donation, we pave the way for enhancing the security of Kubernetes installations and simplifying the management of this critical concern,” Shauli Rozen, CEO at ARMO, told Help Net Security.
Version 3.1, expected by the end of the year, will introduce an in-cluster web UI. Version 4.0, expected Q2 2024, will expand Kubescape into a full Kubernetes-native application protection platform (KNAPP) by adding further runtime features.
Kubescape is available for free on GitHub.
More open-source tools to consider: