devton/agentic-workflow-blueprint/scanning-kubernetes-manifests-with-kubesec

agentic-workflows-blueprint.workflow.scanning-kubernetes-manifests-with-kubesec

Goal

Assess Kubernetes manifests with Kubesec to detect insecure pod/workload configurations and enforce policy thresholds before deployment.

Scope

• Applies to: Kubernetes YAML/JSON manifests, including workloads and related deployment artifacts.
• Does not cover: live runtime behavioral threat detection after workloads are deployed.

Triggers

• "Scan Kubernetes manifests with Kubesec"
• "Block insecure K8s manifests in CI"
• "Validate pod security controls before deploy"
• "Add static manifest security gate"

Inputs

• manifestPaths: files/directories containing Kubernetes manifests
• scorePolicy: numeric/qualitative threshold policy (for example reject score < 0)
• executionMode: CLI binary, Docker, plugin, or HTTP API
• pipelineContext (optional): CI platform and artifact/reporting requirements
• namespaceContext (optional): target namespaces or environment tiers

Invariants

• Every scanned resource must emit an explicit score and advisory list.
• Gate policy must be deterministic and documented.
• Critical insecure patterns (privileged, host PID/network, dangerous capabilities) are non-negotiable blockers.
• Results must be retained for review and remediation tracking.

Procedure

1. Prepare scan environment

• Select execution mode (local CLI, container, plugin, or API endpoint).
• Validate tool availability and version.

1. Define scoring and fail policy

• Set scorePolicy and advisory severity interpretation.
• Define fail-fast behavior for critical controls.

1. Scan manifests

• Run Kubesec on each target manifest.
• Capture structured output (JSON preferred for automation).

1. Evaluate key control categories

• Privilege and root controls.
• Capabilities and host namespace usage.
• Volume mount and filesystem hardening controls.
• Resource limits/requests and service account hygiene.
• Seccomp/AppArmor/SELinux posture where applicable.

1. Enforce CI/CD gate

• Integrate scan step into PR/build pipeline.
• Fail pipeline on score/policy breach.

1. Optional admission enforcement

• Where required, integrate as validating webhook to enforce policy at admission.
• Ensure fail-closed behavior is intentional and staged by environment.

1. Report and remediation

• Produce actionable findings with manifest path and control IDs.
• Generate prioritized remediation plan for blocked resources.

Outputs

• Kubesec scan report for all manifest targets.
• Gate decision summary with score threshold outcome.
• Findings list mapped to manifest resources and remediation actions.
• Optional admission policy integration notes.

Review gate

• [ ] All manifest targets are scanned with auditable output.
• [ ] Critical policy violations trigger blocking outcome.
• [ ] Score/advisory thresholds are clearly enforced.
• [ ] Findings include direct remediation guidance.
• [ ] Pipeline/admission integration behavior is documented.

References

• ../../SKILL.md
• ../implementing-network-policies-for-kubernetes/SKILL.md
• ../review/SKILL.md