Skip to content

The Kubescape operator

When installed in your cluster, Kubescape runs as a set of microservices. These allow you to continually monitor the security posture of the cluster the operator is installed in.

The Kubescape operator includes:

  • scanning for misconfigurations
  • scanning all deployed images for vulnerabilties (CVEs)
  • exposing in-cluster data as Kubernetes API objects
  • exporting data to a configured provider
  • allowing secure control by a configured provider


The Kubescape operator is installed using Helm. Here you can find the installation instructions for the Kubescape operator.

Misconfiguration scanning

The kubescape service uses the same engine as the Kubescape CLI to scan the cluster for misconfigurations.

Vulnerability scanning

The kubevuln microservice scans container images for vulnerabilities.

In-cluster storage

The storage microservice provides an aggregated API server to expose Kubescape scan data inside the cluster.

In-cluster scan results are considered ephemeral, as they are regularly updated and can be fully regenerated. If you want a history we recommend you use Kubescape's provider interface to send the data out of the cluster when scans are complete.

To see a list of the types that are added to your cluster, use kubectl api-resources:

$ kubectl api-resources | grep kubescape
applicationactivities                              true         ApplicationActivity
applicationprofiles                                true         ApplicationProfile
configurationscansummaries                         false        ConfigurationScanSummary
generatednetworkpolicies                           true         GeneratedNetworkPolicy
knownservers                                       false        KnownServer
networkneighborses                                 true         NetworkNeighbors
openvulnerabilityexchangecontainers                true         OpenVulnerabilityExchangeContainer
sbomsyftfiltereds                                  true         SBOMSyftFiltered
sbomsyfts                                          true         SBOMSyft
vulnerabilitymanifests                             true         VulnerabilityManifest
vulnerabilitymanifestsummaries                     true         VulnerabilityManifestSummary
vulnerabilitysummaries                             false        VulnerabilitySummary
workloadconfigurationscans                         true         WorkloadConfigurationScan
workloadconfigurationscansummaries                 true         WorkloadConfigurationScanSummary
  1. Custom Resource Definitions, a common approach for adding new types to the Kubernetes API.
  2. Software Bill of Materials


Several of our in-cluster components implement telemetry data using OpenTelemetry (OTel). You can optionally install an OTel collector in your cluster to aggregate these metrics and send them to your own tracing tool.

Automation and control

  • The operator and gateway microservices interact to start or schedule scans.
  • The kollector service sends information about the state of the cluster to a configured provider.

For information on how these services interact, check out their documentation on GitHub.

Node agent

Some functions of Kubescape require access to every node. These include controls which require host scanning, and calculating runtime vulnerability relevancy.

The optional Kubescape node agent runs as a DaemonSet, deployed to every node in your cluster.