Limitations
Cluster scanning
Cloud vendor integrations
Kubescape reads cluster information from the cloud vendors' API. Each vendor has a list of authorizations they require (see the SDK of the given vendor). Kubescape uses SDKs to retrieve this information. This authentication information must be available in the running environment of Kubescape
- AWS IAM roles for EKS access, see more here Amazon Web Services integration
- GCP IAM roles for GKE access, see more here Google Cloud Services integration
- Azure AKS is not yet supported
- DigitalOcean API is not yet supported
Vulnerability scanning
Private registries support
- Private registries are supported via:
- ImagePullSecrets (in podSpec or serviceAccount)
- AWS IAM roles for ECR access, see more here Amazon Web Services integration
- GCP IAM roles for GCR access, see more here Google Cloud Services integration
- Azure ACR authentication is not yet supported
Scanning Troubleshooting
Issue / logs | Issue Description | Solution |
|---|---|---|
| The image may be deleted from the container registry, so the vulnerability scanner can't get the image manifest data and it's vulnerabilities | |
Failed to load vulnerability db: vulnerability database is corrupt | We reached the limit of the the process memory limited by the kubernetes deployment: "armo-vuln-scan" |
|
Updated about 1 month ago