Glossary

A quick-reference guide to essential Kubescape, Kubernetes, and cloud-native security concepts.

Jump to: A • B • C • D • E • F • G • H • I • K • M • N • O • P • R • S • V • W

A

Admission Controller

A Kubernetes security mechanism that intercepts requests to the Kubernetes API server before a resource is created or changed, allowing Kubescape to block insecure configurations before they reach your cluster.

Analogy: Like a security guard at a building's entrance checking visitor IDs and badges before allowing anyone through the front door.

Anomaly Detection Engine

A runtime component within the Kubescape Node Agent that learns what normal container behavior looks like and sounds an alarm if sudden, unexpected actions occur.

Analogy: Like a smart home security system that learns your daily routine and sounds an alarm if a door opens at 3 AM.

ApplicationProfile

A legacy Kubernetes Custom Resource (CRD) previously used by Kubescape to store the recorded runtime activity of a container. Starting in storage v0.0.303, this resource and Network Neighborhood were consolidated into the modern ContainerProfile.

Analogy: Like an older single-purpose medical chart that has been upgraded and merged into a unified electronic health record.

Assisted Remediation

A Kubescape CLI feature that points out the exact configuration field and value you need to update in your Kubernetes manifest to fix a failed security check.

Analogy: Like a word processor's spell-checker that not only highlights a typo, but suggests the exact replacement word with one click.

B

Behavioral Analysis Engine

A threat detection engine inside the Node Agent that matches live container events against known attack patterns, such as reverse shells or memory unpackers.

Analogy: Like an airport baggage scanner trained to immediately recognize the distinct silhouette of prohibited weapons or tools.

Bill of Behavior (BoB / SBOB)

A declarative specification describing what an application is intended and allowed to do at runtime. Any action outside this specification is treated as a software bug or an active attack.

Analogy: Like a strict employee job description—if an accountant suddenly starts trying to rewire the building's electrical breakers, it triggers an immediate investigation.

C

CEL (Common Expression Language)

A fast, lightweight expression language built into Kubernetes and used by Kubescape to evaluate admission policies and runtime rules without overhead.

Analogy: Like writing a formula in a spreadsheet (e.g., =IF(A1 > 10, ...)): simple, safe, and evaluated almost instantaneously.

CIS Benchmarks

A globally recognized catalog of vendor-neutral security guidelines and best practices published by the Center for Internet Security to harden Kubernetes clusters.

Analogy: Like an official municipal building code checklist that construction workers must satisfy before an occupancy permit is issued.

ContainerProfile

The current Kubernetes Custom Resource (CRD) generated by Kubescape that records both the baseline runtime activity (processes, system calls, file access) and network traffic (ingress and egress connections) for each container. It consolidates and replaces the older ApplicationProfile and Network Neighborhood resources.

Analogy: Like a comprehensive employee logbook that records both what office tools someone uses and who they communicate with throughout their workday.

Control

A configuration security test (such as C-0034: Automatic mapping of service account) that evaluates Kubernetes manifests and cluster resources against compliance baselines using underlying Rego policies. Multiple controls are grouped together into Frameworks.

Analogy: A single item on a vehicle safety inspection checklist (e.g., "Are the brake lights functioning properly?").

Copacetic (Copa)

An open-source container patching tool used by Kubescape to fix vulnerabilities in container images directly, without rebuilding the image from scratch.

Analogy: Like patching a small puncture on a bicycle tire with a patch kit instead of manufacturing a brand-new wheel.

Custom Resource Definition (CRD)

A Kubernetes extension mechanism that lets applications like Kubescape create their own custom object types directly inside the cluster's database.

Analogy: Like adding a customized folder template and tab system into an existing office filing cabinet.

CVE (Common Vulnerabilities and Exposures)

A standardized, publicly tracked identification number (such as CVE-2023-1234) assigned to known software security vulnerabilities.

Analogy: Like an official vehicle recall identifier issued by a highway safety administration.

D

DaemonSet

A Kubernetes workload controller that ensures an identical copy of a specific Pod runs on every single worker node across your cluster.

Analogy: Like placing one dedicated security officer on every floor of a multi-story building.

E

eBPF (Extended Berkeley Packet Filter)

A Linux kernel technology that allows Kubescape to safely and efficiently observe system calls, file access, and network events without modifying kernel code.

Analogy: Like high-definition security cameras quietly installed along hallways that let security teams monitor all activity without getting in anyone's way.

EPSS (Exploit Prediction Scoring System)

A daily updated scoring system (from 0% to 100%) estimating the probability that a software vulnerability will be actively exploited in the wild over the next 30 days.

Analogy: Like a daily weather forecast predicting an 80% chance of rain, helping you decide whether carrying an umbrella today is truly necessary.

Exceptions (Risk Acceptance)

Configurable rules that instruct Kubescape to ignore or accept specific security findings that you have reviewed and decided are safe, planned, or unavoidable.

Analogy: Like an authorized hall pass that excuses a student from class because they have a scheduled appointment.

F

Framework

A curated collection of related security Controls grouped together to satisfy an established compliance or security standard (such as NSA-CISA, MITRE ATT&CK, or CIS).

Analogy: Like a complete driver's license exam composed of dozens of individual road tests and written questions.

G

Grype

The open-source vulnerability scanner integrated into Kubescape that inspects container packages and matches them against public vulnerability databases.

Analogy: Like a barcode scanner at a store that instantly checks an inventory database to see if a product has an active safety warning.

H

Headlamp

An extensible open-source Kubernetes web dashboard that displays visual Kubescape compliance scores, scan results, and vulnerability summaries.

Analogy: Like a car's digital instrument panel displaying speed, fuel efficiency, and tire pressure in a clear visual layout.

Host Scanner

A Kubescape component that inspects the configuration and security state of the underlying node operating system (including kernel parameters, file permissions, and Kubelet settings).

Analogy: Like inspecting the foundation and load-bearing walls of an apartment building rather than just the interior furniture.

I

Image Patching

The process of updating vulnerable packages directly within an existing container image to eliminate security flaws without having to rebuild the application.

Analogy: Like swapping out a faulty bolt on an appliance rather than having to take the entire machine back to the factory.

Inspektor Gadget

An eBPF-based framework of tools used by the Kubescape Node Agent to extract kernel-level events and monitor container activity.

Analogy: Like a mechanic's electronic diagnostic scanner plugged into a car's computer port to read engine telemetry.

K

Kubelet

The primary node agent running on every Kubernetes worker node responsible for registering nodes and ensuring that requested containers are running.

Analogy: Like the on-site superintendent of an apartment complex who ensures all apartments are occupied as instructed and maintenance is up to date.

Kubescape CLI

The standalone command-line executable (kubescape) used by developers to scan Kubernetes YAML manifests, Helm charts, container images, and clusters on-demand.

Analogy: Like a handheld security scanner carried around by an inspector to perform immediate, on-the-spot safety checks.

Kubescape Operator

The in-cluster controller installed via Helm that continuously monitors Kubernetes clusters, runs automated scans on a schedule, and manages runtime security.

Analogy: Like a 24/7 automated security operations center permanently stationed inside a facility.

Kubevuln

The in-cluster microservice that runs container vulnerability scans, generates SBOMs, and stores vulnerability manifests.

Analogy: Like an in-house quality assurance laboratory testing incoming shipments for manufacturing defects.

M

Malware Scanner

A security capability inside the Node Agent that scans nodes, directories, and container volumes for viruses and malicious files using an optimized ClamAV engine.

Analogy: Like an antivirus program scanning a hard drive to catch trojans, worms, or infected files.

MCP Server (Model Context Protocol)

A feature in the Kubescape CLI that allows AI developer assistants (such as Cursor or Claude Desktop) to query cluster security reports and help you fix issues.

Analogy: Like a direct radio link connecting an on-site technician to an AI advisor who can review findings and suggest immediate fixes.

MITRE ATT&CK

A globally accessible knowledge base documenting real-world cyber adversary tactics and techniques, used by Kubescape to map threat-detection rules.

Analogy: Like a criminal investigation playbook detailing all the common tactics and entry methods used during burglaries.

N

Network Neighborhood

A legacy Kubernetes Custom Resource (CRD) previously generated by Kubescape to track observed container network traffic. Starting in storage v0.0.303, network traffic tracking was merged directly into ContainerProfile.

Analogy: Like an older separate paper phone log that has been replaced by an all-in-one digital communication record.

Network Policy Generation

A Kubescape feature that uses observed container network traffic to automatically generate minimal, secure Kubernetes NetworkPolicy rules that restrict unauthorized network paths.

Analogy: Like creating an approved contact list on a child's phone that automatically blocks calls to and from unknown strangers.

Node Agent

A lightweight DaemonSet running on every node that uses eBPF to monitor runtime events, detect security anomalies, and track package usage.

Analogy: Like posting a dedicated security guard on every street corner of a neighborhood.

NSA-CISA Guidance

A comprehensive Kubernetes security hardening guide jointly authored by the US National Security Agency (NSA) and Cybersecurity and Infrastructure Security Agency (CISA).

Analogy: Like government safety standards and building regulations for operating high-security facilities.

O

OPA (Open Policy Agent) & Rego

The open-source policy engine (OPA) and query language (Rego) used by Kubescape to write and execute configuration checks against Kubernetes resources.

Analogy: Rego is the rulebook, and OPA is the referee blowing the whistle whenever a player breaks a rule.

P

Pod

The smallest deployable computing unit in Kubernetes, containing one or more containers that share network and storage resources.

Analogy: Like a single shipping container holding one or more tightly packed boxes that travel together.

R

RBAC (Role-Based Access Control)

A Kubernetes authorization mechanism that regulates which users and service accounts are allowed to view, modify, or delete specific cluster resources.

Analogy: Like electronic keycards in an office—everyone can open the front door, but only system engineers can open the server room door.

Relevancy

A Kubescape runtime filtering capability that uses eBPF to determine which packages and libraries are actively loaded into memory, allowing you to deprioritize vulnerabilities in unused code.

Analogy: Like ignoring a warning about a broken seatbelt in a spare car parked in a garage that nobody ever drives.

Rule (Runtime Rule)

A threat detection rule (written in CEL) that monitors container behavior in real time via the Node Agent. Unlike configuration Controls, runtime rules are bound independently to specific workloads using a RuntimeRuleAlertBinding resource.

Analogy: A security alarm trigger that trips only when an unauthorized action (like an unexpected shell launch or abnormal file read) occurs inside a live container.

RuntimeRuleAlertBinding

A Kubernetes Custom Resource (CRD) used to bind specific runtime threat detection Rules to matching workloads or namespaces using pod selectors.

Analogy: Like assigning specific security patrol protocols to high-security rooms in a building while giving standard offices basic monitoring.

Runtime Threat Detection

Continuous, real-time monitoring of live containers and the API server to catch and alert on active security attacks—such as privilege escalation or reverse shells—as they happen.

Analogy: Like security officers watching live monitors ready to respond the second someone tries to pick a lock.

S

SBOM (Software Bill of Materials)

A formal, machine-readable inventory listing every software package, dependency, and library bundled inside a container image.

Analogy: Like the nutrition and ingredient list printed on the side of a food box.

Storage (kubescape/storage)

A lightweight in-cluster API server and storage engine where Kubescape persists scan results, SBOMs, and ContainerProfiles.

Analogy: Like a dedicated filing room inside an office where all completed safety audits and incident reports are archived.

W

WorkloadConfigurationScan

A Kubernetes Custom Resource that stores the results of configuration and compliance scans for a specific workload or deployment.

Analogy: Like an inspection report detailing every hazard found inside a specific office suite.