How to Run Kubescape Scans in Kubernetes

DodaTech Updated 2026-06-24 3 min read

In this tutorial, you'll learn about How to Run Kubescape Scans in Kubernetes. We cover key concepts, practical examples, and best practices.

The Problem

Your Kubescape security scan either fails to run or returns confusing results. kubescape scan shows Error: failed to run scanner or reports hundreds of misconfigurations with no clear remediation. Without accurate scans, you cannot assess your cluster's security posture.

Quick Fix

Fix 1: Kubescape Not Installed

WRONG — running kubescape without installation:

kubescape scan framework nsa
# command not found: kubescape

RIGHT — install Kubescape:

# Linux (curl):
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash
# Verify:
kubescape version
# Kubescape version: v2.9.0

Fix 2: Scan Fails with Connection Error

kubescape scan framework nsa
# Error: failed to run scanner: failed to get Kubernetes version:
#   Get "https://kubernetes.docker.internal:6443/version": dial tcp 127.0.0.1:6443: connect: connection refused

RIGHT — verify kubeconfig context:

kubectl config current-context
# my-cluster

kubectl cluster-info
# Kubernetes control plane is running at https://192.168.1.100:6443

If the cluster is not accessible, check the kubeconfig path:

export KUBECONFIG=~/.kube/config
kubescape scan framework nsa --kubeconfig ~/.kube/config

Fix 3: Scan Returns Too Many Results

kubescape scan framework nsa
# Results: 245 controls failed, 1200 resources affected
# (overwhelming number of results)

RIGHT — filter by severity or specific control:

# Filter by severity:
kubescape scan framework nsa --severity high,critical

# Scan a specific control:
kubescape scan control C-0004  # Disallow anonymous access

# Scan specific resources:
kubescape scan framework nsa --include-namespaces production

Fix 4: False Positives

RIGHT — use exceptions or control exclusions:

# Create an exceptions file:
cat > exceptions.json <<EOF
{
  "apiVersion": "kubescape.io/v1",
  "kind": "Exceptions",
  "metadata": {
    "name": "my-exceptions"
  },
  "spec": {
    "exceptions": [
      {
        "policyType": "postureException",
        "actions": ["alertOnly"],
        "resources": [
          {
            "designatorType": "Attributes",
            "attributes": {
              "kind": "Deployment",
              "name": "kube-proxy",
              "namespace": "kube-system]
            }
          }
        ]
      }
    ]
  }
}
EOF

kubescape scan framework nsa --exceptions exceptions.json

Fix 5: Compliance Framework Not Found

kubescape scan framework custom-framework
# Error: framework 'custom-framework' not found

RIGHT — list available frameworks:

kubescape list frameworks
# Available frameworks:
# - nsa
# - mitre
# - devopsbest
# - armobest

# Use a valid framework:
kubescape scan framework nsa,mitre

Fix 6: Generate HTML or JSON Report

kubescape scan framework nsa --format json --output scan-results.json
kubescape scan framework nsa --format html --output scan-report.html

View the report:

open scan-report.html  # macOS
xdg-open scan-report.html  # Linux

Use DodaTech's Security Dashboard to centralize Kubescape results, track remediation progress, and set up automated scanning in CI/CD pipelines.

Prevention

Run Kubescape scans in CI/CD pipelines (GitHub Actions, GitLab CI).
Focus on high and critical severity findings first.
Create exception rules for known false positives.
Scan after every cluster change.
Track scan results over time to measure improvement.

Common Mistakes with kubescape scan

Using foldl instead of foldl' causing stack overflow on large lists
Forgetting deriving (Show, Eq) on custom data types needed for debugging
Placing the wildcard pattern first in case expressions, making all subsequent patterns unreachable

These mistakes appear frequently in real-world K8S code. DodaTech's contributors have identified these patterns through analysis of open-source projects and production systems.

Practice Exercise

Write a pure function that safely divides two integers using Maybe, then test it with edge cases like division by zero and negative numbers.

This exercise reinforces the concepts covered in this guide. Try implementing it before checking online solutions.

FAQ

### What frameworks does Kubescape support?

Kubescape supports NSA/Kubernetes Hardening Guide, MITRE ATT&CK, DevOps Best Practices, and ARMO Best Practices. Use kubescape list frameworks to see all available frameworks. You can also create custom frameworks.

Does Kubescape make any changes to the cluster?

No, Kubescape is a read-only scanner. It never modifies cluster resources. All scans use kubectl get, kubectl describe, and API read operations. Results are displayed in the CLI or saved to a file.

How often should I run Kubescape scans?

Run scans at least weekly, and after any significant cluster change (upgrades, new deployments, RBAC changes). For production clusters, integrate Kubescape into CI/CD to scan before every deployment.

← Previous How to Set Up Krew Plugin Manager for kubectl Next → How to Debug Kubernetes Mutating Webhooks

Built by the developers of DodaTech

Doda Browser, DodaZIP & Durga Antivirus Pro

Home Browse Quick Fix