Repository navigation
roadmap: Kubescape security stack → 100% and hold (posture · CVE · runtime) #2447
Description
🤖 Generated by the Agentic Engineer
Current problem
The original scanner and runtime-routing repairs have landed: PRs #2443, #2452 and #2445 are merged, and #2450, #2264 and #2149 are closed. The problem is now incomplete or untrustworthy result coverage and unproven durable alert delivery. An empty finding count still does not establish a clean platform.
Fresh production readback on 2026-10-05, using the denominator-aware checker, reports:
| Surface | Result | Remaining owner |
|---|---|---|
| Posture | 102 expected, 102 result-bearing current objects; no missing, empty or orphan results | #2855 owns per-control admission ratchets; coverage is not a compliance score |
| Vulnerability | 80 expected, 57 timely listed, 10 missing, 13 stale; 31 LIST/stored-version disagreements | #4263 and #3955 |
| Runtime | 82 expected, 74 current, 2 failing, 2 missing, 2 partial, 12 learning-pending; no stale results | #4264 |
The checker exits nonzero for these gaps. The 31 split records prevent treating the timely list as authoritative. Learning-pending records are identified separately and are not evidence that an alert reached its sink.
Goal and settled direction
Restore complete, attributable posture, vulnerability and runtime signals and hold them without reliability regressions. Keep full-image CVE scans separate from runtime relevance, and route runtime detections through the existing Kubescape-scoped Alertmanager to the reviewed downstream surfaces. Preserve the fix-before-exception discipline and never lower a gate to make a dashboard green.
Remaining delivery slices
- Restore complete Kubescape result coverage #3156 — complete coverage and actual durable alert-delivery proof.
- Reconcile Kubescape vulnerability summaries with the containers they describe #4263 / fix(kubescape): preserve large vulnerability scan writes #3955 — coherent, current vulnerability persistence and missing-image recovery.
- Complete Kubescape runtime profile pairs and prove runtime alert delivery #4264 — complete profile pairs and a due-date measurement of active learning.
- feat(security): continuously ingest Kubescape findings — SARIF→Code Scanning gate + CRD→issue bridge #2451 / feat(security): bridge live-only Kubescape findings into deduped backlog issues #2854 — deduplicated live finding ingestion.
- feat(security): graduate zeroed Kubescape controls to Kyverno Enforce so they cannot regress #2855 — one verified zero-finding control at a time, Audit evidence before Enforce.
The scanner/routing subproblems are delivered; this epic stays open until these remaining outcomes are observed. Static manifest validation cannot substitute for result coherence, admission refusal or notification delivery.
Activity
feat(agent): make the daily engineer drive Kubescape security to 100%…
devantler commentedon Jul 5, 2026
Status 2026-07-05: all three surfaces are LIVE again (verified on prod, ~11:30Z):
keepLocalfix)Remaining lanes to hold 100%: #2451 (findings→backlog ingestion, so this never rots silently again), #2441 (C-0015 residual), #2435 (C-0013 hardening), #2264 (CI ratchet), #2149 (reachable-CVE reduction, now unblocked with real data + VEX).
Reminder for anyone probing the data plane: storage LIST responses are payload-stripped skeletons — GET individual objects.
ci: gate the Kubescape scan with the documented ClusterSecurityExcept…