Restore complete Kubescape result coverage #3156

Activity

1. devantler

   added the

   Bug

   issue type on Aug 15, 2026
2. github-project-automation

   added this to 🌊 Project Boardon Aug 15, 2026
3. coderabbitai commented on Aug 15, 2026

   

   coderabbitaibot

   on Aug 15, 2026 – with coderabbitai

   Contributor

   More actions

   🔗 Related PRs

   #3037 - fix(cilium): refuse a zero-count gate release and correct the runbook order [merged]
   #3080 - feat(observability): alert when a Crossplane managed resource stops reconciling [merged]
   #3103 - feat(security): assert the node image verifier can enforce at all [merged]
   #3109 - fix(deploy): avoid redundant GHCR node reboots [merged]
   #3142 - docs(kubescape): correct the controller-rbac migration guidance [merged]

   ---

   📝 Issue Planner

   _{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

   • Create Plan

   ---

   🧪 Issue enrichment is currently in open beta.

   You can configure auto-planning by selecting labels in the issue_enrichment configuration.

   To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

   issue_enrichment:
     auto_enrich:
       enabled: false

   💬 Have feedback or questions? Drop into our discord!
4. devantler

   added a parent issue on Aug 15, 2026

   • roadmap: Kubescape security stack → 100% and hold (posture · CVE · runtime) #2447
5. devantler

   moved this to 📥 Backlog in 🌊 Project Boardon Aug 15, 2026
6. devantler

   added a commit that references this issue on Aug 22, 2026

   chore: agent-claim #3156 nonce=b956fb714189400d1c8ae005bff65ac2

   9b9626c
7. devantler commented on Aug 22, 2026

   

   devantler

   on Aug 22, 2026

   ContributorAuthor

   More actions

   🤖 Generated by the Agentic Engineer

   Production coverage recheck — 2026-08-22

   The scanners are producing data, but complete coverage still cannot be established:

   • Posture: three fresh direct samples contain populated controls and non-zero failures, proving liveness. Only 49 of 2,405 summaries are under 24 hours, so no payload-complete cluster score or comparison with the repository's 95% CI floor is supportable.
   • CVE: sampled summaries and paired manifests carry current scanner metadata and coherent positive totals, but 286 active containers versus 138 summaries have not been identity-reconciled. Summary references also resolve their payloads only in the scanner namespace, so cluster-wide critical/high and reachable totals remain unavailable.
   • Runtime: 353 profile/network pairs are complete and 195 are partial. Alert routing is configured to the existing Slack-backed path rather than stdout-only, but downstream delivery was not proven.

   These are coverage gaps, not a clean or broken-scanner verdict. They remain within this issue's existing acceptance criteria; no duplicate tracker was created.
8. devantler

   added sub-issues on Sep 30, 2026

   • Define the expected Kubescape result set per surface and fail on missing or stale results #4262
   • Reconcile Kubescape vulnerability summaries with the containers they describe #4263
   • Complete Kubescape runtime profile pairs and prove runtime alert delivery #4264
9. devantler commented on Sep 30, 2026

   

   devantler

   on Sep 30, 2026

   ContributorAuthor

   More actions

   🤖 Generated by the Agentic Engineer

   Split into three sub-issues so each part can be picked up and finished on its own:

   1. Define the expected Kubescape result set per surface and fail on missing or stale results #4262: define the expected result set for each surface, and add a read-only check that fails on missing or stale results. This comes first, because the other two measure against it.
   2. Reconcile Kubescape vulnerability summaries with the containers they describe #4263: reconcile vulnerability summaries with the containers they describe, and derive cluster-wide totals. Blocked by Define the expected Kubescape result set per surface and fail on missing or stale results #4262.
   3. Complete Kubescape runtime profile pairs and prove runtime alert delivery #4264: complete the runtime profile pairs and prove that a runtime alert reaches its destination. Blocked by Define the expected Kubescape result set per surface and fail on missing or stale results #4262.

   This issue closes when all three are done and the check from #4262 reports full coverage on production.