{"id":13521351,"url":"https://github.com/octarinesec/kube-scan","last_synced_at":"2026-01-18T04:02:32.167Z","repository":{"id":36271361,"uuid":"220984454","full_name":"octarinesec/kube-scan","owner":"octarinesec","description":"kube-scan: Octarine k8s cluster risk assessment tool","archived":false,"fork":false,"pushed_at":"2023-01-06T02:27:16.000Z","size":1249,"stargazers_count":802,"open_issues_count":40,"forks_count":105,"subscribers_count":29,"default_branch":"master","last_synced_at":"2025-03-31T20:37:58.280Z","etag":null,"topics":["cloud-native","devops","devsecops","k8s","kubernetes","security","security-audit","security-scanner","security-scanners","security-tools"],"latest_commit_sha":null,"homepage":"https://www.octarinesec.com/","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/octarinesec.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2019-11-11T13:12:44.000Z","updated_at":"2025-03-28T00:23:11.000Z","dependencies_parsed_at":"2023-01-17T00:00:38.289Z","dependency_job_id":null,"html_url":"https://github.com/octarinesec/kube-scan","commit_stats":null,"previous_names":[],"tags_count":3,"template":false,"template_full_name":null,"purl":"pkg:github/octarinesec/kube-scan","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/octarinesec%2Fkube-scan","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/octarinesec%2Fkube-scan/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/octarinesec%2Fkube-scan/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/octarinesec%2Fkube-scan/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/octarinesec","download_url":"https://codeload.github.com/octarinesec/kube-scan/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/octarinesec%2Fkube-scan/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28529455,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-18T00:39:45.795Z","status":"online","status_checked_at":"2026-01-18T02:00:07.578Z","response_time":98,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cloud-native","devops","devsecops","k8s","kubernetes","security","security-audit","security-scanner","security-scanners","security-tools"],"created_at":"2024-08-01T06:00:33.102Z","updated_at":"2026-01-18T04:02:32.149Z","avatar_url":"https://github.com/octarinesec.png","language":"Go","funding_links":[],"categories":["Kubernetes","Go","Tools","Tools and Libraries","Security","Kubernetes cluster security","Open Source Projects"],"sub_categories":["Kubernetes","Security and Compliance"],"readme":"\n\u003cp align=\"center\"\u003e\n  \u003cimg src=\"./images/octarine_logo.png\"\u003e\n\u003c/p\u003e\n\n# Kube-Scan\nTry our free Kubernetes risk assessment tool today.  \nRun it on any cluster at any time. No data leaves your cluster. We do not collect any information.  \nFor more information on Octarine see https://www.octarinesec.com. \n\n# Get the risk score of your workloads\n\nKube-Scan gives a risk score, from 0 (no risk) to 10 (high risk) for each workload. The risk is based on the runtime configuration of each workload (currently 20+ settings). The exact rules and scoring formula are part of the open-source framework [KCCSS](https://github.com/octarinesec/kccss), the Kubernetes Common Configuration Scoring System. \n\nKCCSS is similar to the Common Vulnerability Scoring System (CVSS), the industry-standard for rating vulnerabilities, but instead focuses on the configurations and security settings themselves. Vulnerabilities are always detrimental, but configuration settings can be insecure, neutral, or critical for protection or remediation. KCCSS scores both risks and remediations as separate rules, and allows users to calculate a risk for every runtime setting of a workload and then to calculate the total risk of the workload.\n\n**Please notice** that kube-scan currently scans the cluster when starting and will re-scan it every 24 hours. Thus, if you want to get an up-to-date risk score (e.g. after installing a new app), you should restart the kube-scan pod.\n\n## Quickstart\n```bash\nkubectl apply -f https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan.yaml\nkubectl port-forward --namespace kube-scan svc/kube-scan-ui 8080:80\n```\n\nThen set your browser to `http://localhost:8080`.\n\n## Using a load-balancer service\n* This method assumes you are using a cloud provider that provides load balancers.\n```bash\nkubectl apply -f https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan-lb.yaml\n```\nThen get the load-balancer address by\n```bash\nkubectl -n kube-scan get service kube-scan-ui -o jsonpath={..ip}\n```\nor\n```bash\nkubectl -n kube-scan get service kube-scan-ui -o jsonpath={..hostname}\n```\ndepending on the load-balancer type.\n\nThen set your browser to that address.\n\n## Using the API\nIf you applied kube-scan to your cluster with the load balancer service:\n\n\"HOST\" refers to the external ip of the service.\n\nIf you used port-forward:\n\n\"HOST\" refers to \"localhost:8080\" \n\nGetting all of the risks in your cluster:\n```\nGET http://HOST/api/risks\n```\n\nRequesting the kube-scan service to calculate again the risks (in case a resource was changed):\n```\nPOST http://HOST/api/refresh\n```\n\nThis might be a long operation - depending on the cluster size, so you can pull the refresh operation status:\n```\nGET http://HOST/api/refreshing_status\n```\n\n## Building from source code\nBuild the server image (from root folder)\n```bash\ncd server\ndocker build -t SERVER_TAG_NAME .\ndocker push SERVER_TAG_NAME\n```\n\nBuild the client image (from root folder)\n```bash\ncd client\ndocker build -t CLIENT_TAG_NAME .\ndocker push CLIENT_TAG_NAME\n```\n\nSet kube-scan containers images on the desired yaml (from root folder)\nkube-scan container with SERVER_TAG_NAME\nkube-scan-ui container with CLIENT_TAG_NAME\n\nApply the desired yaml and use \"quick start\" or \"using load-balancer\" instructions \n\n## Uninstall\n```bash\nkubectl delete -f https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan.yaml\n```\n\nIn case of using a load-balancer:\n```bash\nkubectl delete -f https://raw.githubusercontent.com/octarinesec/kube-scan/master/kube-scan-lb.yaml\n```\n\n# Screenshots\n\n![Risk score](https://info.octarinesec.com/hubfs/home-1.png)\n\n![Risk details](https://info.octarinesec.com/hubfs/risk-expanded.png)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foctarinesec%2Fkube-scan","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Foctarinesec%2Fkube-scan","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Foctarinesec%2Fkube-scan/lists"}