| Index | index by Group | index by Distribution | index by Vendor | index by creation date | index by Name | Mirrors | Help | Search |
| Name: kubescape | Distribution: openSUSE Tumbleweed |
| Version: 4.0.11 | Vendor: openSUSE |
| Release: 1.2 | Build date: Thu Jul 23 07:59:31 2026 |
| Group: Unspecified | Build host: reproducible |
| Size: 288703777 | Source RPM: kubescape-4.0.11-1.2.src.rpm |
| Packager: https://bugs.opensuse.org | |
| Url: https://github.com/armosec/kubescape | |
| Summary: Tool providing a multi-cloud K8s single pane of glass | |
Kubescape is a K8s open-source tool providing a multi-cloud K8s single pane of glass, including risk analysis, security compliance, RBAC visualizer and image vulnerabilities scanning. Kubescape scans K8s clusters, YAML files, and HELM charts, detecting misconfigurations according to multiple frameworks (such as the NSA-CISA , MITRE ATT&CK®), software vulnerabilities, and RBAC (role-based-access-control) violations at early stages of the CI/CD pipeline, calculates risk score instantly and shows risk trends over time. It became one of the fastest-growing Kubernetes tools among developers due to its easy-to-use CLI interface, flexible output formats, and automated scanning capabilities, saving Kubernetes users and admins’ precious time, effort, and resources. Kubescape integrates natively with other DevOps tools, including Jenkins, CircleCI, Github workflows, Prometheus, and Slack, and supports multi-cloud K8s deployments like EKS, GKE, and AKS.
Apache-2.0
* Thu Jul 23 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 4.0.11:
* fix(scan): don't let
- -exceptions/--controls-config/--attack-tracks trigger
air-gapped mode (#2532)
* fix(scan): restore root PersistentPreRun for kubescape scan
invocations (#2530)
* feat: run CEL controls as part of the scan (#2525)
* [Fix] : severity-based image exceptions in JSON, SARIF, and
patch output -- use filtered Matches instead of
RemainingMatches (#2522)
* rbac file todo to check api version is resolved (#2523)
* fix(imagescan): preserve matches on metadata lookup errors
(#2519)
* Fix control-inputs fallback to return real local getter instead
of unloaded store (#2515)
* docs: fix stale KS_CACHE TODO comment in customerloader.go
(#2516)
* fix(vap): deploy-library serves the embedded bundle, downloads
only via --from-release (#2507) (#2514)
* docs(cli): improve report protection help and examples (#2510)
* feat(mcp): Add headless OPAProcessor for low-latency Network
Policy s… (#2512)
* Fix/helm templates plain yaml warnings (#2509)
* docs(cli): document report protection workflow (#2508)
* feat(printer): add GitLab SAST report output format (#2505)
* fix(mcp): add double-checked mutex locking to k8sClient lazy
init (#2506)
* Cache compiled CEL programs across scanned objects (#2503)
* feat(mcp): implement headless OPAProcessor rbac scanner (#2492)
* fix(sarif): don't os.Exit on unencodable fix, avoid empty SARIF
file (#2499)
* fix(printer): don't append .txt to /dev/null in
PrettyPrinter.SetWriter (#2502)
* feat(reportcrypto): add decryption support for encrypted
resource metadata (#2493)
* docs: add ICS/OT workload scanning guide (#2475)
* fix(sarif): surface PrettyWrite errors instead of silently
writing empty file (#2497)
* fix: preserve explicit exceptions/inputs with
use-artifacts-from (#2490)
* feat: implement AWS ECR vulnerability adaptor (#2488)
* add unit tests for GetPreReqCmd and kubeconfig flag (#2486)
* Derive cmd/vap policy metadata from the embedded VAP bundle
(#2485)
* fix(httphandler): populate report in synchronous scan response
(#2483)
* feat: introduce Container Image Vulnerability (CIV) Adaptor
interfaces (#2482)
* Embed and load VAP YAML from the vendored bundle (#2474)
* feat(anonymizer): support reversible container metadata
transformation (#2473)
* refactor: decompose monolithic Results API handler (#2477)
* feat: add container profile tools and resources to MCP server
(#2479)
* [ LFX 2026] feat(exceptions): honor
objectSelector.matchExpressions via
PostureExceptionPolicy.ObjectSelector (#2480)
* feat(patch): add support for OCI and Local exports (#2471)
* test(core): cover Kubescape.Download unknown-target error path
(#2468)
* Fix local control cache (#2463)
* core: Add test coverage for Kubescape.Diff pretty-printer
output path (#2467)
* fix(httphandler): add missing panic recovery to Metrics handler
(#2465)
* feat(operator): add quarantine action to remediate CLI
subcommand (#2461)
* fix: support namespace/kind/name workload format (#2459)
(#2460)
* Fix air-gapped mode -- thread explicit offline flag to policy
getters instead of relying on nil (#2458)
* Vendor the CEL admission policy bundle (#2455)
* Expand encryption and decryption coverage for resource metadata
(#2442)
* fix(httphandler): decouple prometheus metrics scan from request
context (#2451)
* Wed Jul 01 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 4.0.10:
* feat(httphandler): add SSRF-hardened scan-completion webhook
callback (#2447)
* feat(operator): add `operator remediate` CLI subcommand
(annotate + dry-run) (#2448)
* Add CEL evaluator (#2443)
* feat(reportcrypto): decrypt resource source metadata in reports
(#2440)
* fix(coverage) : penalise silent failed GVR pulls in coverage
score (#2420)
* Add offline request stub for the CEL engine (#2439)
* fix(diff): validate format input and clean up status handling
(#2438)
* test: add missing unit tests for cautils session initialization
and scan scope (#2436)
* feat(report): add encrypted report decryption (#2425)
* fix(diff): move --fail-on-new exit to cmd layer so output
writer is closed (#2434)
* Sat May 30 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 4.0.9:
* fix: populate generationTime in JSON report and invocations in
SARIF (#2331)
* fix(cautils): make SetTopWorkloads idempotent (#2330)
* feat(getter): resolve namespaceSelector for cluster exceptions
(#2322)
* anonymizer: hide git repository context metadata (#2327)
* fix(opaprocessor): isolate rego dependency control inputs
(#2329)
* fix(imagescan): repair interleaved type definitions in test
file (#2328)
* test: add fixhandler and report conversion coverage (#2248)
* test: add containerscan unmarshal coverage (#2246)
* test(imagescan): cover severity threshold (#2211)
* anonymize resource source metadata in hidden output (#2326)
* test(imagescan): cover severity filtering (#2210)
* fix(cache): canonicalise framework/control cache filenames
(#2313)
* Add image command RunE tests (#2182)
* test(opaprocessor): cover mapControlToInfo (#2208)
* chore(deps): bump dependencies to fix security advisories
(#2324)
* fix(opaprocessor): preserve cluster-scoped paths across
namespace iterations (#2311)
* fix: propagate context through cosign OPA built-in functions
(#2191)
* chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to
5.19.1 (#2318)
* chore(deps): bump github.com/containerd/containerd/v2 (#2319)
* docs: add Gitlab CI/CD Integartion Guide with gitlab-ci.yml
example (#2310)
* fix: nil pointer panic in SARIF, HTML, and JUnit printers when
control is missing from summary details (#2315)
* fix(anonymizer): anonymize annotation values for hidden scans
(#2316)
* fix: restore kubescape_resource_* metrics in prometheus output
(#2256)
* fix: close output file after each printer finishes to prevent
file descriptor leak (#2259)
* fix(printer): bucket failed controls by their own category, not
a hardcoded ID allowlist (#2306)
* fix: add --scan-timeout flag and fix context propagation in K8s
resource collection (#2305)
* Emit SecurityException events for posture exception matches
(#2291)
* Feat/vap enforcement reconcile (#2307)
* Prevent PR scanner checkout from failing on stale submodule
metadata (#2309)
* fix(anonymizer): extend --hide coverage for container config
references (#2300)
* ci(workflows): pin Go via go.mod instead of undefined
GO_VERSION input (#2302)
* fix: validate threshold ranges in scan image and patch commands
(#2274)
* fix: resolve TOCTOU race in TimedCache.invalidateTask() (#2295)
* fix: normalize mixed-case manifest extension detection (#2293)
* feat(diff): add kubescape diff command to compare two scan
reports (#2245)
* feat(fix): emit values.yaml guidance for Helm-rendered
resources (#2083)
* clarification for score threshold scope (#2290)
* fix: prevent panic from double-close of stopChan in (#2288)
* docs: add Jenkins CI/CD integration guide with Jenkinsfile
example (#2278)
* chore: refresh branch mergeability
* fix(imagescan): harden custom DB URL validation
* chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to
5.19.0
* fix(bugs): clearning blockers
* fixing lint errors
* fix(fixhandler): reconcile unfixed controls against planned
YAML edits
* fix: add bounds check before accessing container index in
addContainerNameToAssistedRemediation
* fix: add bounds check before accessing container index in
addContainerNameToAssistedRemediation
* fix: deduplicate # HELP and # TYPE headers across multiple
metric famolies
* fix(prometheus): add # HELP and # TYPE metadata lines to
prometheus output
* fix: add # HELP and # TYPE headers to kubescape_score metric
Fixes #2237
* test: cover newline replacement without trailing newline
* test: cover yml extension detection
* test: add request and resource handler coverage
* chore: refresh branch mergeability
* test: add hostsensor CRD coverage
* test: add metrics and ksinit coverage
* test: add v1 printer coverage
* Nil guard for kubernetes client initialisation
* fix(tests): correct import statement placement in setup_test.go
* test(rootutils): remove redundant logger name tests and update
BoolPtrFlag error handling
* fix(opaprocessor): sanitize namespace split parsing
* test(imagescan): fix DB load validation tests damaged after
rebase
* fix(crd): add optionalOldSelf to CEL rule so it fires on CREATE
* test(cautils): handle os.WriteFile error in TestIsFileAndIsDir
* fix(crd): use oldSelf in CEL rule for expiresAt to support
GitOps reconcilers
* test(cautils): add TestIsFileAndIsDir unit test
* test(cautils): expand floatutils tests
* test(cautils): expand normalize image name tests
* test(cautils): add unit tests for BoolPtrFlag, isHTTPURL,
unique, GetInputFiles, Cleanup and helpers
* test(cmd): cover KS_LOGGER_NAME env
* test(cmd): cover initLogger name precedence
* test(cautils): assert operator scan request fields
* test(metrics): assert Init registers counters
* fix(coderabbit): Coderabbit findings
* fix(patch): use ExporterDocker + docker load for no-push path
* vap: resolve CEL control IDs for policy bindings
* test(cmd): cover KS_LOGGER_NAME env
* ci: fix indentation in dependabot.yaml
* test(imagescan): cover default matcher config
* test(httphandler): add unit tests for RecoverFunc panic handler
* ci: fix indentation in dependabot.yaml
* test(cautils): add unit tests for YAML separator, mergeMaps,
and splitYAMLDocuments
* ci: fix indentation in dependabot.yaml
* test(fixhandler): add unit tests for YAML handler helpers
* test(cautils): add unit tests for datastructures helpers
* test(cautils): add unit tests for operator scan info validation
* ci: fix indentation in dependabot.yaml for httphandler gomod
entry
* test(metrics): add unit tests for Init and Update functions
* test(imagescan): cover DB load validation
* ci: add gomod Dependabot entry for httphandler module
* fix: propagate context through httphandler storage API calls
* ci: pin Codium-ai/pr-agent to full commit SHA in comments.yaml
* ci : add github-actions ecosystem to dependabot config
* test(opaprocessor): cover manual review summary
* test(listener): cover TLS key loading
* test(listener): cover env config helpers
* fix: add error log when ProcessRulesListener fails in scan.go
* test(imagescan): cover default DB config
* refactor: replace unstructured Warning(err.Error()) with
helpers.Error(err) in fix.go
* refactor: replace unstructured Warning(err.Error()) with
helpers.Error(err) in customerloader.go
* Fix lint baseline issues
* fix(patch): use canonical image reference for buildkit export
name
* fix(printer): never fall back to stdout for pdf/html on
file-create errors
* test(anonymizer): reorganize and expand unit coverage
* test(imagescan): cover default db config
* unit tests for user push opt in
* fix(printer): wire PartialGVRPulls into report serialization
and CLI output
* fix(resourcehandler): surface partial GVR collection failures
instead of silently suppressing them
* fix: User must opt in to push, default behaviour is now false
* fix(httphandler): set response.Type on successful GET /results
* test: keep BoolPtrFlag state on unknown
* refactor: replace fmt.Sprintf with structured helpers.Error in
getHostSensorHandler
* fix(coderabbit): coderabbit findings
* fix(printer): default pdf/html output to file instead of stdout
* fix: filter empty and whitespace-only --format entries
* test: cover patch default tags
* perf: parallelize K8s resource collection in pullResources
* test: cover requiresResourceMatch designator constraints
* Add BoolPtrFlag unit tests
* test(httphandler): assert wantType in offline fallback table
test
* Use deduplicated unfixed control count in summary
* Add threshold bounds unit tests
* Add workload identifier parsing tests
* Fix control scan validator error
* fix(anonymizer): support unstructured container metadata
anonymization
* test: expand scan validators coverage
* test: expand workload scan unit tests
* fix: route PrometheusPrinter.Score() output to pp.writer
instead of stdout Fixes #2176
* fix: honor namespace argument in list_vulnerability_manifests
MCP tool
* Fix inverted keepResults cleanup logic
* test(httphandler): cover Results endpoint state and
offline-fallback branches
* fix: validate --format flag value in patch command before
running
* fix: replace read-all with explicit permissions for fork PRs
* fix: explicit --account and --access-key flags take precedence
over env vars
* fix: use flag.Changed to detect explicit --cache-dir,
preventing KS_CACHE_DIR override
* test(resourcehandler): add edge case coverage for empty and
malformed namespace inputs
* Fix field selector state carryover across resource queries
* fix(resourcehandler): dedupe cluster-scoped LISTs under
- -include-namespaces
* fix: trim whitespace in Formats() to normalize comma-separated
tokens
* Use deduplicated unfixed control count in summary
* Fix false-positive master node taint classification
* Avoid nil source dereference in report marshal logging
* docs: fix misleading Short and Long description in patch
command
* fix: anonymize labels-to-copy values when --hide flag is set
* fix: propagate request context through CallTool to Kubernetes
API calls (fixes #2145)
* test: add regression test for anonymizeEphemeralContainerList
with runtime []interface{} shape
* add account id validation tests
* fix: always propagate f.Close() error in writeScanErrorToFile
* add scan info policy tests
* fix: resolve variable shadowing in writeScanErrorToFile
* add attack track printer tests
* add rbac report tests
* fix: handle error from defer f.Close() in writeScanErrorToFile
* fix: handle error from defer f.Close() in writeScanErrorToFile
* fix: use JSON marshal/unmarshal in anonymizeContainerList to
replace broken type assertion (fixes #2132)
* fix: correct typo 'arguement' to 'argument' in
completion_test.go
* fix: clear Env[].ValueFrom in removeContainersData and
removeEphemeralContainersData (fixes #2131)
* fix: correct typo 'arguement' to 'argument' in completion.go
* refactor: replace log.Printf with logger.L().Info() in
mcpserver.go
* feat(scan): anonymize container names and images for --hide
* Improve validation and error handling for config set
* add core patch os tests
* fix(coderabbit): extract dedup helper, add partial-control
regression test, strip UTF-8 BOM
* fix(review): phase-aware unfixed summary and per-rule fix
tracking
* test: add coverage for Status handler and serverState lifecycle
* Respect CLI logger flag precedence over KS_LOGGER
* fix: preserve delete-all behavior for results endpoint
* Preserve RelatedResourcesIDs in scanned control rules
* fix(coderabbit): Exorcising the bugs coderabbit caught
* fix: report controls that did not auto-remediate
* test: seed and assert ResourceAttackTracks remap in ID
consistency test
* fix: clear EnvFrom in removeContainersData to prevent secret
name leakage
* test: expand ID consistency test to cover all remapped
collections
* test: add unit tests for anonymizer package
* fix: add request context to score calculation warning log
* fix: handle error returned by scorewrapper.Calculate() in
processorhandler.go
* fix: handle json.Marshal errors in mcpserver CallTool (fixes
[#2111])
* fix: harden /v1/results IDOR remediation
* fix(test): assert flag inheritance on control subcommand
* fix(scan): validate --fail-coverage-below is in range 0-100
* fix(scan): enforce coverage threshold in scan control
subcommand
* test(junit): table-driven test for skip message across all
sub-statuses
* fix: point krew-release-bot at goreleaser-generated manifest
* fix(scan): remap control summary resource IDs during
anonymization
* refactor: replace all context.TODO() with context.Background()
* refactor: replace context.TODO() with context.Background() in
downloader/main.go
* fix(scan): remap control summary resource identifiers during
anonymization
* test(junit): Coderabbit - cover Errors aggregation
independently of Failures/Tests
* test(junit): add multi-framework regression for
parent-vs-children counts(Matthias reported bug)
* fix(scan): anonymize orphan resource references in hidden scan
output
* refactor: replace context.TODO() with context.Background() in
initutils_test.go
* fix(junit): make --format junit output spec-compliant
* fix(scan): anonymize resource references across scan results
* feat(scan): add --fail-coverage-below flag for CI coverage gate
* test: use valid download target in RunE happy-path test
* fix: remove unreachable args check and fix arguements typo
* fix(list): correct missing policy type error
* Accept advertised base URI format in vulnerability manifest
parser
* fix: use StopError on exception/config loading failure
* fix: strip URI prefix before splitting in ReadResource
* fix(list): correct typo 'requeued' -> 'required' in error
message (#2092)
* fix: correct typo 'requeued' to 'required' in list error
message
* fix: avoid malformed skip message when subStatus is empty
* fix(resourcehandler): build ScanCoverage before GetResources
error return
* fix(scan): align hide flag behavior and remove debug traces
* feat(junit): populate skip message from StatusInfo
* feat(scan): anonymize resource names and namespaces in scan
results
* fix: align mockCounters.All() with real ICounters
implementations
* fix(resourcehandler): record failed GVR statuses before
all-failed early return
* test: add unit tests for findFile early-exit path
* docs: add missing supported format values for patch --format
flag
* fix(opaprocessor): remove synthetic resource results for
not-evaluated controls
* fix:deduplicate pretty-printer fallback and scanType
* feat(scan): add hide flag and anonymization pipeline scaffold
* test: address review comments on gotree tests
* test: add compliance results baseline tests across four
packages
* chore(deps): bump github.com/in-toto/in-toto-golang in
/httphandler
* chore(deps): bump github.com/in-toto/in-toto-golang
* typo fixed
* multiple pretty-printer handled
* chore(deps): bump k8s-interface to v0.0.209 for multi-group fix
* multiple format output example added
* printer validation added
* fix(policyhandler): close load spinners with StopError on
failure instead of always StopSuccess
* test: add coverage for compliance and risk score accessors in
ResultsHandler
* fix: handle walk errors and stop early in findFile
* fix: remove unread buildChannel to prevent goroutine leak in
patchWithContext
* fix(resourcehandler): build ScanCoverage before no-resources
early return
* feat: report scan coverage gaps and not-evaluated controls
* docs: fix grammatically incorrect Short description in operator
vulnerabilities scan command
* security(ci): pin GHA using SHAs not tags
* Sun May 10 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 4.0.8:
* Fix: back-propagate connector URLs to configObj in
initializeCloudAPI
* Initial plan
* Coderabbit findings
* suppress spurious interrupt signal log on graceful exit
* docs: fix TOC nesting and heading capitalization
* docs: add PDF output format and fix heading inconsistencies in
getting-started.md
* fix(vap): create parent directories in writeOutput
* fix(vap): use K8s upstream validation helpers for names and
namespaces
* fix(vap): use DNS label validation for namespace names
* fix(vap): build MatchLabels from parsed requirements, not raw
split
* fix(vap): reject DoubleEquals, downstream split on = would
break
* fix(vap): restrict label validation to equality selectors only
* fix(vap): use k8s labels.Parse for label selector validation
* fix(vap): fix K8s name and label selector validation
* feat(vap): add --timeout flag to deploy-library command
* Fri May 08 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 4.0.7:
* fix(scan): gate CRD to live cluster scan mode only
* fix: remove out-of-scope ReportID check from fixhandler
* fix: scope empty-name guard to framework and control targets
only
* fix(initutils): gate CRD control inputs to live cluster scans
only
* fix(crdcontrolinputs): remove protobuf content type, probe CRD
before selecting
* feat: add ControlInput CRD for in-cluster control configuration
* fix: return error when empty name passed to download framework
or control
* feat(opaprocessor): filter expired exceptions before applying
results
* fix: use ReportID as sentinel to detect invalid report JSON
* fix: return clear error when wrong JSON structure passed to
kubescape fix
* test: address review comments on opaprocessor baseline tests
* test: add baseline tests for compliance-critical functions in
opaprocessor
* refactor(vap): drop --output flag, test real command paths
* fix: return clear error when directory passed to fix command
* docs: add Git-repository and Kustomize-directory to scan Long
description
* test: update TestGetScanCommand to match new Long description
* docs: replace placeholder Long description in scan command
* fix: only reject empty format when flag is explicitly set
* fix: validate empty format flag before running scan subcommands
* fix: atomically check idle state and delete results under mutex
* fix initializeSaaSEnv: restore file fallback, add timeout,
degrade gracefully on network errors
* get services from API, removing sidecar requirement
* fix: guard delete-all against concurrent scans
* docs: improve docstring for validateThresholdsOnly
* fix: address code review - preserve scanInfo.View and use
threshold-only validator
* fix: validate compliance-threshold and fail-threshold in scan
and scan workload subcommands
* fix: log errors from os.RemoveAll in removeResultDirs
* fix: replace os.ReadDir with os.RemoveAll in removeResultDirs
* fix(core): reword warning logs for unknown objects and include
IDs
* fix: raise scanner buffer limit and surface scanner errors
* fix: replace byte-split with line scanner for YAML document
separation
* fix: address error handling warnings for OpenSSF compliance
* fix: add early severity-threshold validation in control and
framework subcommands
* fix: add early severity-threshold validation in scan workload
command
* fix: validate severity-threshold flag before running scan
* fix: address review comments on YAML document splitting
* fix: surface YAML parse errors instead of silently dropping
documents
* fix(core): add warning logs for dropped workloads in local file
scans
* fix(cautils): preserve base path when K8SConfig.Host is a full
URL
* fix(httphandler): add error on partial TLS configuration
* feat(httphandler): support TLS key configuration via env vars
* test(vap): add tests for --output flag file writing and
writeOutput helper
* test(vap): add comprehensive test coverage for VAP commands
including HTTP mocking, YAML marshalling, and flag validation
* fix(cautils): use TrimPrefix to strip URL scheme in
CreatePortForwarder
* Mon May 04 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 4.0.6:
* test: validate RawQuery in mockTransport
* fix: prevent goroutine leak in copaPatch on timeout
* test: validate mocked host in repositoryscanner_test
* test: handle json.Marshal error in mockTransport
* fix: address PR reviews for defaultHTTPClient timeout and test
mocking
* test: mock github api to restore repositoryscanner tests
* fix(portforwarder): surface ForwardPorts error and unblock
waitForPortForwardReadiness
* feat(cautils): populate scanMetadata excluded/include
namespaces
* fix(scan): make Helm value flags Helm-faithful and fail-fast on
bad overrides
* test: add test for partial resource pull failures
* fix(scan): make Helm value flags Helm-faithful and fail-fast on
bad overrides
* fix(test): add missing values.yaml fixture for kustomize+helm
test
* test(resourcehandler): address review — assert successful pod
survives, drive InfoMap tests through extracted helper
* feat(scan): plumb Helm value overrides throug kubescape scan
* test(resourcehandler): add tests for partial GVR collection
failure and InfoMap propagation
* fix(httphandler,cautils): clean up exceptions temp file after
scan
* test(httphandler): collect concurrent worker errors via channel
- Coderabbit suggested
* CodeRabbit Suggestions
* fix(httphandler): use unique temp file for per-request
exceptions
* fix(resourcehandler): guard InfoMap write on empty GVR data,
document query-granular limitation
* fix(resourcehandler): track pull failures at query granularity
to avoid suppressing partial GVR errors
* feat: Upgrade opa-utils dependency from v0.0.288 to v0.0.293
* fix(opaprocessor): remove redundant string comparison in
exception matching
* fix(opaprocessor): refine exception matching for manual
controls
* chore(deps): bump k8s-interface to v0.0.208 and adopt renamed
symbols
* Adding Cloud unavailable message
* fix(opaprocessor): add cluster matching to manual control
exceptions
* fix(resourcehandler): address reviewer feedback on GVR skip
guard and raw GVR key recording
* fix(opaprocessor): propagate OPA eval errors instead of
silently dropping resources
* fix: panic on nil map assignment in APIServerStore
* fix(resourcehandler): include rule.Match in
ResourceToControlsMap so failing K8s GVRs surface as skipped
controls
* fix(resourcehandler): surface partial resource collection
failures via InfoMap
* fix(opaprocessor): mark manual controls as passed when
exceptions apply
* remove leftover helm_chart_mapping_node example
* remove dead helm-template source-mapping code
* test: also assert InnerStatus is StatusSkipped after exception
is applied
* test: strengthen non-manual control subtest to isolate
manual-only guard
* fix(opaprocessor): replace processor dependency with explicit
control matching
* stop logging raw scan request bodies
* fix(opaprocessor): simplify applyExceptionsToManualControls
signature
* fix(opaprocessor): apply exceptions to manual controls in
summary
* docs: fix code block formatting and add all kustomize filenames
* docs: clarify Helm and Kustomize directory auto-detection
* fix host scans with data retrieved from the CRDs
* fix(opaprocessor): apply namespace filter in failedIDs
pre-seed and surface rule eval errors
* fix(opaprocessor): eliminate false negatives when OPA rule
evaluation fails
* fix: use 'helm' instead of kustomize's hardcoded 'helmV3'
binary name
* test: add kustomize+helm regression coverage
* fix: enable helm support when rendering kustomize directories
* Fix namespace filter for cluster-scoped resources
* chore: remove accidental generated test artifact
* Remove accidentally committed test artifact
* Plan for namespace filter fix
* chore: plan support for kustomize with helm
* Initial plan
* Initial plan
* build(deps): Bump github.com/go-git/go-git/v5 from 5.17.1 to
5.18.0
* test(image-scan): add all-lowercase CVE ID test case
* fix(image-scan): normalize vulnerability exceptions across
casings
* Fri Apr 17 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 4.0.5:
* build(deps): update Go version and bump dependencies
- Update to version 4.0.4:
* build(deps): Bump github.com/moby/spdystream from 0.5.0 to
0.5.1
* use go-logger v0.0.28
* build(deps): Bump
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
* build(deps): Bump github.com/moby/buildkit from 0.26.1 to
0.28.1
* build(deps): Bump
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp
* build(deps): Bump go.opentelemetry.io/otel/sdk from 1.42.0 to
1.43.0
* build(deps): Bump github.com/aws/aws-sdk-go-v2/service/s3
* build(deps): Bump go.opentelemetry.io/otel/sdk from 1.40.0 to
1.43.0
* build(deps): Bump github.com/sigstore/timestamp-authority/v2
* build(deps): Bump github.com/hashicorp/go-getter from 1.7.9 to
1.8.6
* build(deps): Bump helm.sh/helm/v3 from 3.18.5 to 3.20.2
* build(deps): Bump github.com/go-jose/go-jose/v4 from 4.1.3 to
4.1.4
* error handling improved
* fix: duplicate flags removed from image.go
* build(deps): Bump github.com/cloudflare/circl from 1.6.1 to
1.6.3
* build(deps): Bump github.com/cilium/cilium from 1.16.17 to
1.17.14
* build(deps): Bump github.com/go-git/go-git/v5 from 5.16.5 to
5.17.1
* build(deps): Bump golang.org/x/image from 0.25.0 to 0.38.0
* build(deps): Bump google.golang.org/grpc from 1.78.0 to 1.79.3
* Wed Mar 18 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 4.0.3:
* README.md updated
* log added in scanImage(): value of scanInfo.ListingURL for
reference
* fix: missing host do not return nil error
* feat: new falg --grype-db-url added to overload the url in
kubescape scan command
* build(deps): Bump go.opentelemetry.io/otel/sdk from 1.39.0 to
1.40.0
* Thu Feb 19 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 4.0.2:
* build(deps): Bump github.com/go-git/go-git/v5 from 5.16.2 to
5.16.5
* Pass tag for the runtime version
* Fri Feb 13 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 4.0.1:
* Enhance version testing in smoke tests to extract and validate
output version
* fix isRuleKubescapeVersionCompatible bug with version 4.0.0
* Thu Feb 05 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 4.0.0:
* Use TagName directly in .krew.yaml templates
* Make version smoke test accept bytes and v-prefix
* force overridden ldflags in goreleaser
* remove invalid build flag
* fix version handling and injection
* feat: optimize CPU and memory usage for resource-intensive
scans
* Add krew plugin manifest
* build(deps): Bump github.com/theupdateframework/go-tuf/v2
* Sort CVEs by severity then ID
* feat: add image column to vulnerability scanning table output
* update policy.json testdata
* add verbose option to scan-images
* fix all linter errors
* run system test from private repo
* run system test from private repo
* Replace host sensor with node agent sensing (#1916)
* Fix broken README anchors
* build(deps): Bump github.com/sigstore/rekor from 1.4.3 to 1.5.0
* build(deps): Bump github.com/theupdateframework/go-tuf/v2
* Final verification - all changes complete
* Fix indentation in test file
* Add test for CheckShortTerminalWidth with non-string values
* Fix unsafe interface to string type assertions to prevent panic
* Initial plan
* build(deps): Bump github.com/sigstore/fulcio from 1.8.4 to
1.8.5
* Complete fix for workload scan missing controls
* Fix workload scan to include allcontrols framework
* Initial plan
* Update golangci-lint action to version 9
* Update build number retrieval and permissions in workflow
* Fix workflow YAML formatting and permissions
* build(deps): Bump github.com/sigstore/cosign/v3
* update test lists (#1919)
* ci: update scorecard action version
* Add SkipPersistence flag to MetricsQueryParams in metrics
endpoint
* Update README to include GoReleaser installation and usage
instructions
* feat: add labels-to-copy flag to copy workload labels to
reports
* fix: enable kustomize overlays to load base configurations
* Fix typos in documentation
* Fri Jan 23 2026 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.47:
* Enhance installation scripts for cross-platform support and
improve error handling
* Refactor release workflow to simplify tagging and remove
unnecessary inputs
* Update release workflow to include tagging in arguments
* Refactor GitHub Actions workflow for system tests and update
smoke test logging
* Add debug listing and adjust JUnit report options
* Add skip flag and collect system test results
* Add production secrets to release workflow
* Require Python 3.9 for system tests
* Use python3-dev in release workflow
* Install system dependencies in release workflow
* Remove pip cache from release workflow
* Require Python 3.11 for system tests
* fix go mod tidy
* fix: prefer Python 3.11 for system-tests and update environment
setup
* fix: update post-build hook to conditionally execute script for
amd64 architecture
* fix: add k8s Kind cluster creation step and clean up post-e2e
script
* fix: update test_command and test_scan to remove deprecated
scan commands and adjust file paths
* fix: correct post-build hook syntax for setting GOARCH
environment variable
* fix: update post-build hook to set GOARCH environment variable
* fix: enable end-to-end tests in release workflow
* fix: enhance release workflow with optional skip publish input
and add system tests execution
* fix: enhance release workflow with optional skip publish input
and add system tests execution
* Update go-git-url to v0.0.31 for improved URL parsing
* fix: update e2e script to enforce fatal failures and improve
artifact detection
* Address code review feedback: Extract helper function and
improve comments
* Fix: Prevent URLs from being treated as local file paths
* Initial plan
* fix: update kubescape krew configuration to skip upload
* fix: add commit author information to goreleaser configuration
* fix: update krew index pull request configuration to specify
owner and name
* fix: correct kubescape repository owner in goreleaser
configuration
* fix: update GITHUB_TOKEN handling and correct kubescape
repository owner in configuration
* fix: update kubescape krew configuration to use repository
field
* feat: add kubescape krew index to goreleaser configuration
* feat: add QEMU and Docker Buildx setup steps in release
workflow
* feat: add Syft setup step in release workflow
* fix: update runner to ubuntu-large in release configuration
* fix: add cosign.key to .gitignore
* fix: remove unnecessary secrets inheritance in release
configuration
* cleaning up release action
* use goreleaser for all builds and release publication
* fix: log added and minor fixes applied
* fix go mod tidy
* Bump github.com/containerd/containerd/v2 from 2.1.4 to 2.1.5
* Update cosign package to v3 and adjust go.mod dependencies
* Update cosign package to v3 and adjust go.mod dependencies
* Bump github.com/sigstore/fulcio from 1.6.6 to 1.8.3
* feature: skipPersistence request parameter added
* Fri Dec 05 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.46:
* Remove KS_METRICS_FRAMEWORKS environment variable support
* Fix typo in comment: fom -> from
* Add frameworks query parameter to /v1/metrics endpoint
* Fix incorrect comment about default output format
* Add KS_METRICS_FRAMEWORKS env var to allow selecting specific
frameworks
* Fix: properly handle nil downloadReleasedPolicy in getters
* Address code review feedback
* Add test for isAirGappedMode function
* Refactor: Extract isAirGappedMode helper function
* Fix air-gapped mode to prevent network access
* Initial plan
* Address code review feedback: nil check and trailing whitespace
* Add tests for results enrichment with severity
* Add severity to controls in results section as well
* Enable ScanAll for prometheus metrics to include all frameworks
including CIS
* Remove test output files and update gitignore
* Add severity field to controls in JSON output
* Initial plan
* Initial plan
* Bump github.com/cilium/cilium from 1.16.9 to 1.16.17
* Revamp documentation and reduce host sensor workers
* always save WorkloadConfigurationScanResultSummaries
* feat(security): update golang to debian trixie
* feat(security): update to Debian 13
* feat(security): update to Debian 13
* Bump golang.org/x/crypto from 0.41.0 to 0.45.0
* Wed Nov 12 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.45:
* fix go mod tidy
* Allow artifact-metadata read in release workflow
* Allow artifact-metadata read in release workflow
* fix workflow permissions
* Bump github.com/opencontainers/selinux from 1.12.0 to 1.13.0
* Fri Nov 07 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.44:
* Bump github.com/containerd/containerd from 1.7.28 to 1.7.29
* Bump github.com/containerd/containerd/v2 from 2.0.5 to 2.0.7
* Wed Nov 05 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.43:
* fix: --format sarif logs as expected
* removed 'procMount: Unmasked' from host-scanner daemonset
definition (refs kubescape/helm-charts#711) (#1886)
* fix: update documentation links to include 'controls' path
* Test file updated
* fixed 404 url issue in kubescape scan
* Bump github.com/nwaples/rardecode/v2 from 2.1.1 to 2.2.0
* Fri Oct 17 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.42:
* chore: update runners to use ubuntu-large for improved
performance
* fix: improve error handling in hostscanner pod validation
* chore: update syft action to use latest version
* fix: post release action does not take tag from GITHUB_REF env
var
* Thu Sep 18 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.41:
* fix post-release workflow by @amirmalka in #1873
* Fixed issue #1800 : Added parameterNotFoundAction in
spec.paramRef while creating policy binding by @cx-anjali-deore
in #1876
* fix: Don't run scan in installation script by @kkrypt0nn in
[#1875]
* migrate to grype v0.99.1 by @matthyx in #1877
* Sun Sep 14 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.40:
* Bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 by
@dependabot[bot] in #1868
* Issue 1817 fix: Show container name in Assisted remediation by
@cx-anjali-deore in #1867
* fix(imagescan): use all targets in exceptions by @htsr in #1869
* replace olekukonko/tablewriter with jedib0t/go-pretty by
@matthyx in #1866
* feat: add default matchers option to image scanning by
@aadarsh-nagrath in #1857
* Tue Sep 02 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.39:
* don't read services from configmap, use file
* Bump github.com/hashicorp/go-getter from 1.7.8 to 1.7.9
* new approach of fix implemented
* Mon Aug 18 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.38:
* refactor output formatting in prettyprinter and related files
* bump helm.sh/helm/v3 to 3.18.5
* return error on image when severity threshold exceeded
* Fri Aug 01 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.37:
* Fix/update links by @yehudahtor in #1846
* added urls hub.armo --> kubescape.io by @yehudahtor in #1849
* Bump github.com/open-policy-agent/opa from 1.3.0 to 1.4.0 by
@dependabot[bot] in #1833
* Bump github.com/go-viper/mapstructure/v2 from 2.2.1 to 2.3.0 in
/httphandler by @dependabot[bot] in #1850
* Bump github.com/cloudflare/circl from 1.5.0 to 1.6.1 by
@dependabot[bot] in #1851
* Bump helm.sh/helm/v3 from 3.17.3 to 3.17.4 by @dependabot[bot]
in #1852
* Bump github.com/containerd/containerd/v2 from 2.0.4 to 2.0.5 by
@dependabot[bot] in #1853
* fix docs URL in tests by @matthyx in #1854
* Mon Jul 28 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.36:
* fix buildnumber test
* close grype DB at the very end of processing
* do not fail version if update info cannot be fetched
* fix: control-plane node taints check (#1843)
* check scanInfo.Submit in HandleResults to not submit by default
* Wed Jun 25 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- Update to version 3.0.35:
* check for nil map in merge methods by @matthyx in #1813
* test: increase test coverage by @pixel365 in #1814
* upgrade open-policy-agent to 1.x by @matthyx in #1820
* merge labels and annotations in RetryOnConflict by @matthyx in
[#1822]
* Bump helm.sh/helm/v3 from 3.14.4 to 3.17.3 by @dependabot in
[#1824]
* Bump golang.org/x/net from 0.37.0 to 0.38.0 by @dependabot in
[#1829]
* fix: Fix stdin restoration in TestUserConfirmed by
@shangchengbabaiban in #1827
* Update dir.go by @rash1411 in #1828
* Ensure context cancellation on command execution failure by
@pixel365 in #1835
* Make a second sigint terminate kubescape immediately by
@ian-fox in #1837
* Feature/mcpserver v1 by @slashben in #1836
* Fri Mar 28 2025 opensuse_buildservice@ojkastl.de
- Update to version 3.0.34:
* Bump github.com/golang-jwt/jwt/v5 from 5.2.1 to 5.2.2
* Mon Mar 24 2025 opensuse_buildservice@ojkastl.de
- Update to version 3.0.33:
* feat: enhance prerequisites UI with new review-values and
improved prerequisites report
* Bump github.com/containerd/containerd to 1.7.27
* Bump golang.org/x/net from 0.33.0 to 0.36.0
* Wed Mar 19 2025 Johannes Kastl <opensuse_buildservice@ojkastl.de>
- update to 3.0.32:
* What's Changed
- updating prerequisites to support custom kubeconfig bys
@matthyx in #1808
* Mon Mar 10 2025 opensuse_buildservice@ojkastl.de
- Update to version 3.0.31:
* What's Changed
- fix score calculation for framework with all controls in
status irrelevant by @amirmalka in #1802
- Bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4 by
@dependabot in #1803
- Update README.md by @amitschendel in #1807
- generate checksums for all artifacts by @matthyx in #1806
* Wed Feb 26 2025 opensuse_buildservice@ojkastl.de
- Update to version 3.0.30:
* update prerequisites command
* Bump github.com/go-jose/go-jose/v4 from 4.0.2 to 4.0.5
* Sat Feb 22 2025 andrea.manzini@suse.com
- Update to version 3.0.29:
* deprecate control name in exception policies (#1795)
* removing enable/disable colors, as not compatible with all
loggers
- Update to version 3.0.28:
* Refactor: propagate context from main to avoid redundant
context creation by @pixel365 in #1789
* fix: add error handling and context propagation by @pixel365 in
[#1790]
* update prerequisites by @matthyx in #1791
- Update to version 3.0.27:
* Refactor: maroto version v2 by @Fernando-hub527 in #1786
* bump all CI actions by @matthyx in #1787
* Feature: Added exceptions flag in scan image cmd by
@VaibhavMalik4187 in #1568
* added support for exception rules in Scan API ( As a HTTP
request) by @Sanskarzz in #1591
* do not skip on location resolver error by @matthyx in #1788
- (version 3.0.26 does not exist)
- Update to version 3.0.25:
* bump actions/download-artifact@v4
- Update to version 3.0.24:
* add prerequisites command by @matthyx in #1782
- Update to version 3.0.23:
* Update maintainers in SECURITY-INSIGHTS.yml by @slashben in
[#1774]
* Bump golang.org/x/crypto from 0.27.0 to 0.31.0 in /httphandler
by @dependabot in #1775
* Bump golang.org/x/crypto from 0.27.0 to 0.31.0 by @dependabot
in #1776
* Update of README by @Oshratn in #1766
* bump vulnerable deps by @matthyx in #1778
* Deprecation of the roadmap.md in this repo by @slashben in
[#1779]
* Airgap support by @matthyx in #1780
* Update b-binary-build-and-e2e-tests.yaml by @amitschendel in
[#1761]
* add trigger by indication in posture report by @amirmalka in
[#1781]
- Update to version 3.0.22:
* Implementing capability to print out the "print" statements of
the rego by @slashben in #1760
* Update governance files by @slashben in #1763
* use distroless static for kubescape-cli image by @matthyx in
[#1767]
* chore: fix some function name in comment by @needsure in #1769
* add debug log on resource fetch with count by @matthyx in #1773
- Update to version 3.0.21:
* fix the repo scan got stuck bug by @jnathangreeg in #1758
- Update to version 3.0.20:
* some easy doc fixes by @craigbox in #1749
* bump krew publish action by @matthyx in #1757
* bump opa-utils version to fix apiVersion check by @jnathangreeg
in #1756
- Update to version 3.0.19:
* Bump github.com/containers/common from 0.59.0 to 0.60.4 in
/httphandler by @dependabot in #1742
* Bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 by
@dependabot in #1753
* Add a second condition in getFilesFromTree to ensure we are
scanning the correct path by @jnathangreeg in #1752
* Bump github.com/golang-jwt/jwt/v4 from 4.5.0 to 4.5.1 in
/httphandler by @dependabot in #1754
- Update to version 3.0.18:
* EKS Support error: failed to get cloud data by @comrumino in
[#1736]
* bump opa by @matthyx in #1741
- Update to version 3.0.17:
* also bump workflows to 1.23 by @matthyx in #1730
* force grpc by @matthyx in #1732
- Update to version 3.0.16:
* chore: improve the publishing workflows for krew by @maanugh in
[#1719]
* Bump github.com/docker/docker from 26.1.0+incompatible to
26.1.4+incompatible by @dependabot in #1723
* Bump github.com/docker/docker from 26.1.0+incompatible to
26.1.4+incompatible in /httphandler by @dependabot in #1722
* Bump github.com/docker/docker from 26.1.4+incompatible to
26.1.5+incompatible by @dependabot in #1726
* Bump github.com/docker/docker from 26.1.4+incompatible to
26.1.5+incompatible in /httphandler by @dependabot in #1728
* update to go 1.23 and base image to debian12 by @matthyx in
[#1729]
- Update to version 3.0.15:
* fix include/exclude NS for SA discovered via CRB by @matthyx in
[#1718]
- Update to version 3.0.14:
* Simplify the concurrency in http handler for scan. by @ttimonen
in #1710
* use proper params in pager call by @matthyx in #1713
* update docs by @dwertent in #1450
* fix generated ValidatingAdmissionPolicyBinding by @matthyx in
[#1716]
* Documentation ugrades by @idohuber in #1717
- Update to version 3.0.13:
* use pager.EachListItem to filter parented resources by @matthyx
in #1709
- Update to version 3.0.12:
* Adding two helper functions for VAP and CEL admission library
by @slashben in #1682
* Bump github.com/aquasecurity/trivy from 0.44.1 to 0.51.2 in
/httphandler by @dependabot in #1689
* update exceptions docs - ruleName not supported by
@YiscahLevySilas1 in #1695
* Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from
1.5.1 to 1.6.0 by @dependabot in #1696
* Bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from
1.5.1 to 1.6.0 in /httphandler by @dependabot in #1697
* change reference from anubhav06 to project-copacetic by
@anubhav06 in #1440
* Bump
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
from 0.40.0 to 0.44.0 by @dependabot in #1699
* Bump
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
from 0.40.0 to 0.44.0 in /httphandler by @dependabot in #1700
* Bump github.com/hashicorp/go-retryablehttp from 0.7.5 to 0.7.7
by @dependabot in #1701
* Bump github.com/hashicorp/go-retryablehttp from 0.7.5 to 0.7.7
in /httphandler by @dependabot in #1702
* Bump github.com/hashicorp/go-getter from 1.7.4 to 1.7.5 by
@dependabot in #1703
* Bump github.com/hashicorp/go-getter from 1.7.4 to 1.7.5 in
/httphandler by @dependabot in #1704
* Bump github.com/gorilla/schema from 1.2.0 to 1.4.1 in
/httphandler by @dependabot in #1705
* Add disk space checks to binary-build job by @yonatanamz in
[#1706]
* Use large runners for binary-build job by @yonatanamz in #1707
* Changed large-runner type for binary-build job by @yonatanamz
in #1708
- Update to version 3.0.11:
* Fixed issues
- Mask all container data by @dwertent in #1683
- fix yaml handler deleting too many lines during fix by
@matthyx in #1685
- Fix scanning unsupported clouds by @dwertent in #1688
- Update to version 3.0.10:
* Fixed issues
- Fix scanning repo by @dwertent in #1680
- Update to version 3.0.9:
* Enhancements
- Bump syft version by @matthyx in #1669
- Improve memory usage by @matthyx
* Fixed issues
- Remove API calls from scan repo by @matthyx in #1657
- Add control id to pdf output by @maxgio92 in #1662
- re-enable checksum generation for releases by @matthyx in
[#1665]
- Fixed kubescape operator scan returned status code by
@dwertent in #1673
- Update to version 3.0.8:
* bump deps for vulnerabilities
- Update to version 3.0.7:
* Fixed issues
- Fix panic when error is returned from SubmitReport by
@amirmalka in #1640
- Fix gitlab by @matthyx in #1639
* Fri Mar 15 2024 opensuse_buildservice@ojkastl.de
- Update to version 3.0.6:
* remove scan_with_exception_to_backend from CI
* httphandler go mod tidy
* bump go-git-url to fix private gitlab scans
* add riscv64 files to release step
* Fri Mar 15 2024 opensuse_buildservice@ojkastl.de
- Update to version 3.0.5:
* get KubernetesClient only if k8s is not nil
* speedup golangci-lint-action by skipping caches
* set BuildNumber and Client from env
* add risc v build target
* remove repeating fixes
* Fix bug for no matches of yalib in one file mapping
* move versioncheck to kubescape/backend
* bump go-git-url for self-hosted gitlab
* Fixed link (#1624)
* fix(cmd/scan/framework.go): remove redundant code
* Fri Mar 15 2024 opensuse_buildservice@ojkastl.de
- Update to version 3.0.4:
* go sum
* fixed release artifacts
* Add Vulnerability scanning report to the summaryDetails section
(#1615)
* feat: Add the debugging ability for scanning Helm chart (#1215)
* add github action actor check for pr-scanner
* fix goreleaser
* Fixing exceptions for regovector objects
* image scan add schema v1 support
* Fix/backlog (#1613)
* Revert "add PR template for adopters"
* add PR template for adopters
* Bump helm.sh/helm/v3 from 3.12.1 to 3.14.2 in /httphandler
* Bump helm.sh/helm/v3 from 3.12.1 to 3.14.2
* Bump k8s-interface version
* Handle unknown fw
* Remove "%" from the print
* Bump github.com/moby/buildkit from 0.12.1 to 0.12.5
* Bump github.com/moby/buildkit from 0.12.1 to 0.12.5 in
/httphandler
* correct kubescape path in run-tests
* remove libgit files and dependencies
* Bump github.com/cloudflare/circl from 1.3.3 to 1.3.7
* fix backslashes
* fetch Rekor before cosign validation
* Bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 in
/httphandler
* Fix markdown syntax
* checking for compatible policy rules before pulling k8s
resources; failing to pull some k8s resource should not fail
the entire scan (#1578)
* use goreleaser for builds
* Mon Jan 08 2024 opensuse_buildservice@ojkastl.de
- Update to version 3.0.3:
* Fixed issues
- Refactor and Improve Code for Kubescape Version Compatibility
Check by @cbrom in #1494
- fix install.sh when sudo is required to delete
/usr/local/bin/kubescape by @matthyx in #1474
- Hotfix gitlab url by @dwertent in #1572
* Wed Nov 01 2023 kastl@b1-systems.de
- Update to version 3.0.1:
* bump logger version
* Pretty up the pretty-printer. (#1451)
* Update flags (#1462)
* bump pkg
* avoid adding duplicate related resource IDs
* Mon Oct 23 2023 kastl@b1-systems.de
- Update to version 3.0.0:
* Bump v3 (#1449)
* Cloud provider detection (#1448)
* Preparing Kubescape for v3 (#1403)
* Support backend access key (#1404)
* Restructure img cmd (#1398)
* add env-dependencies-policy to security insights
* print result to stdout when format argument specified (#1438)
* Thu Oct 19 2023 kastl@b1-systems.de
- Update to version 2.9.2:
* add more missing permissions for actions
* set log to error
* rm if statement
* replace driver name
* actions needs write on id-token in pr-scanner
* bump deps for vulnerabilities
* fixing GH actions permissions
* use distroless debug as entrypoint.sh requires a shell
* remove extra permissions on GH action
* add ArtifactHub to README
* add FOSSA badge to README
* build windows exec without libgit
* use go-gitlog as an alternative to git2go (#1393)
* use ControlConfigInputs, deprecate ConfigInputs (#1419)
* add top level permissions: read-all for openssf
* correct security-insights stage -> status
* Fix in the README for changelog name
* Adding project security and governance as per maintainer
decision
* Update README.md
* Create scorecard.yml
* Bump golang.org/x/net from 0.14.0 to 0.17.0 in /httphandler
* use correct variable for IMAGE_TAG
* drop build tags for tests (will soon deprecate them)
* add missing dependency on retag in binary-build
* Removed the Codesee workflow
* force docker-build in absence of release label
* Adding check-secret to build image wf
* Bump github.com/cyphar/filepath-securejoin from 0.2.3 to 0.2.4
* split failedPath to deletePaths and reviewPaths (#1402)
* add Openssf badge (#1400)
* Support control cluster from cli (#1391)
* disable rate limiting for storage client
* Separate docker builds for kubescape and kubescape-cli (#1390)
* Save scan results in storage and support scanning a deleted
resource (#1376)
* add new line (#1389)
* fix: format headers (#1383)
* remove ARMO server url
* feat: darken table borders
* fix setting context name in httphandler
* revert e2e test branch (#1373)
* print up until 4 imgs
* Update installation.md to add instructions to install a
previous version via SH
* Wed Sep 06 2023 kastl@b1-systems.de
- Update to version 2.9.1:
* Fix scan command (#1369)
* validate sarif format
* bump version (#1368)
* move context flag to root (#1367)
* Error Fixed when downloading on azure cloud vm environment
(#720)
* Logger fixes (#1362)
* Service discovery (#1359)
* core(cmd): adding corrections to cmd (#1357)
* Beautify install.sh script logs (#1356)
* Refactor backend integration (#1355)
* fix panic & provide msg (#1353)
* Improve cluster scan cli (#1352)
* support paths from related resources (#1351)
* Improve logs (#1349)
* improve cli output (#1347)
* fix panic and improve logs (#1344)
* fix: icons formatting (#1343)
* bump k8s-interface version (#1345)
* Support unified configuration (#1304)
* Create dependabot.yaml
* Wed Sep 06 2023 kastl@b1-systems.de
- there were no releases betweeen 2.3.9 and 2.9.0
- Update to version 2.9.0:
* feat: migrate fatih/color to gchalk
* Update logs (#1340)
* feat: add table heading colors (#1321)
* use distroless base image (#1338)
* feat: improve pretty logger (#1311)
* feat: add short table (#1292)
* feat: change colors library (#1316)
* chore: update docs build.ps1 (#1299)
* feat: add unicode table (#1285)
* scan per namespace (#1337)
* Implementing container image name normalization built-in
function for Rego (#1334)
* Support scanning scope (#1293)
* Hotfix for version 2.3.8 (#1333)
* Code refactor (follow up to PR #1300) (#1323)
* fix(httphandler): pin breaking anchore dependency
* Update PR workflow (#1330)
* Update codesee-arch-diagram.yml
* Update 00-pr-scanner.yaml
* fix submit time
* New output (#1320)
* Adding pr-agent
* Install the CodeSee workflow. Learn more at
https://docs.codesee.io
* add prints to smoketest
* docs(imagescan): provide package-level docs
* chore(imagescan): create vuln db with dedicated function
* chore(imagescan): add dependencies to httphandler
* chore(imagescan): include dependencies
* feat(imagescan): add an image scanning command
* remove scan workload command
* Scanning a single resource (#1300)
* reset head (#1306)
* bump opa-utils
* bump opa-utils, k8s-interface and armoapi-go
* fix: negative compliance score
* linter correction
* review corrections
* update armo docs
* git recognition for empty directory for test
* add error handle when there are no scan to trigger since the
directory not contain any relevant scanning files
* fix: kubescape list controls
* Wed Jul 26 2023 kastl@b1-systems.de
- Update to version 2.3.8:
* add print in the cli to which version the kubescape was update
(#1295)
* feat: add build.ps1
* fix: yamlhandler error handling
* tests(fixhandler): remove tests of an unexported sanitization
method
* docs(fixhandler): follow Go Doc comments convention in
sanitization func
* refactor(fixhandler): sanitize YAML inside ApplyFixToContent
* tests(fixhandler): fail test if unable to open test data file
* style(fixhandler): newlines and spacing
* support related objects (#1272)
* allow adding a fw name when running all (#1286)
* fix: --- kubescape fix
* cache control inputs
* Remove website folder
* fix: stuck spinner
* initial implementation of OpenTelemetry metrics collection
(#1269)
* time-based cached policies
* Thu Jul 06 2023 kastl@b1-systems.de
- Update to version 2.3.7:
* submit file scanning
* Update grafana-kubescape-dashboard.json
* update messaging based on Oshrats comments
* update submit message
* deprecate the login flags
* ignore adaptors if credentials are not set
* deprecate host-scan-yaml flag
* remove unused file
* Changed Assistance Remediation to Assited Remediation
* Deprecated host-scanner
* fxi test jsons
* update regolibrary to v1.0.286-rc.0
* Update docs/providers/armo.md
* Updating overview
* fixed wording
* Split the installation command from scanning
* update installation steps
* initialize ns in case we don't have one in YAML
* Fri Jun 16 2023 kastl@b1-systems.de
- Update to version 2.3.6:
* chore: remove refs to deprecated io/ioutil
* fix: CVE-2023-28840 CVE-2023-28841 CVE-2023-28842
CVE-2022-41723 etc. (#1221)
* Fix statuses - Manual review and Requires configuration (#1251)
* Mon Jun 12 2023 kastl@b1-systems.de
- Update to version 2.3.5:
* correcting the formating of the table in pdf output (#1244)
* core(metrics api): Update API default behavior (#1250)
* fix: update host-scanner version
* fix: remove deprecated endpoint
* wip: remove secretKey and clientID from list cmd
* wip: add example for exclude-namespaces flag
* Sun May 28 2023 kastl@b1-systems.de
- Update to version 2.3.4:
* update kubescape/go-git-url version
* feat: add log coupling for hostsensorutils
* fix(hostsensorutils): add finalizers deletion
* fix(hostsensorutils): reduce periods of readiness probe
* fix: move host-scanner to kubescape namespace
* update opa-utils
* bump opa-utils version for memory optimizations
* Add back new line at the end of the file
* Removed instructions and added the wiki link
* Added instructions to setup kubescape locally
* Fix downloading arm64 binary for kubescape
* Tue May 16 2023 kastl@b1-systems.de
- Update to version 2.3.3:
* Revert "Deprecate kubescape-windows-latest"
* start with a new context, extracting span from request
* updating readme file to support compliance
* Deprecate kubescape-windows-latest
* Mon May 15 2023 kastl@b1-systems.de
- Update to version 2.3.2:
* Control parallelism of opa rule processing by env var (#1230)
* update go version 1.19->1.20
* add compliance score system test
* Add ref to workflow dispatch
* Wed May 03 2023 kastl@b1-systems.de
- Update to version 2.3.1:
* add test
* if the response is empty, return an empty string
* Make powershell Windows installation user path available
immediately
* Update installation script
* Tue May 02 2023 kastl@b1-systems.de
- Update to version 2.3.0:
* invoke only if the repository owner is kubescape
* Revert install.ps1 change, to update after release
* Add kubescape.exe to the release assets
* change basic auth username to x-token-auth
* rerun workflows
* ci: update before install packages
* add compliance score to new field in controls for backward
compatibility
* fix(hostsensorutils): fix indentation of probe attributes
* add compliance-threshold, deprecate fail-threshold (#1197)
* wip: fixed github actions
* wip: update fix command example
* fix: remove outdated enpoints
* Revert change to install.sh
* update opa-utils version for fix in compliance score
* Update snap installation
* update opa-utils version
* add compliance-threshold, deprecate fail-threshold
* Move Building to wiki and installation back to docs
* Move installation instructions to wiki
* nit
* Add more error check
* Add unit testcase
* S1023: redundant break statement (gosimple)
* feat(sarif): add fix object in generated reports
* Invoke workflow to update github action
* Fix: Empty Frameworks Column when listing controls
* fix: broken link
* fix: broken link
* Change wf (#1190)
* set default report time
* Invoke workflow to update after release
* fix(fix): mixed up change list
* Add ARM64 binary installation
* Resume test core pkg under ubuntu arm64
* Disable multi-platform test with commits
* merge pr scanner build into binary-build-and-e2e-tests
* Fix naming
* Disable core pkg test for ubuntu arm64
* add cross compilation for ubuntu arm64
* add cross compilation for mac m1
* adding compliance score updates (#1181)
* comment failing test because of many requests
* update version k8s-interface for cloud resources
* update version k8s-interface for cloud resources
* Mon Apr 03 2023 kastl@b1-systems.de
- Update to version 2.2.6:
* delete BUILD_AND_TEST_LOCAL_KUBESCAPE_CLI input for
b-binary-build-and-e2e-tests wf
* Add new meeting location
* test: fix test with new function argument
* feat: add progress bar during cloud resources download
* clean code
* load account details
* update host scanner image tag
* updated createTenant path (#1166)
* refact(hostsensorutils): unexported fields that don't need to
be exposed
* fix shellcheck warning and info
* test(utils): introduced internal/testutils package to factorize
testing utilities
* addressed review from David: reverted on unconditional loop
exit
* refact(host-sensor): refactors the host sensor
* perf(opaprocessor): run OPA rule compilation and evaluation in
parallel
* refact(getter): refactor the KS Cloud client
* Revert "added validation for if ORIGIN_TAG=null"
* added validation for if ORIGIN_TAG=null
* check KUBESCAPE_EXEC is not empty before deletion
* change concurrency in 00-pr-scanner
* remove merge action
* core(logs): Enhance logs (#1158)
* change trigger for wf
* changed ks_branch to release
* moved the output TEST_NAMES to wf-preparation job (was
check-secret job) and added step export_tests..
* fixed syntax error
* fixed syntax error
* added input to make the binary build and test dynamic
* added CHECKOUT_REPO input parameter
* update host scanner image tag
* change failed to submit message
* Signed-off-by: David Wertenteil <dwertent@armosec.io>
* fix references to kubectl in completion help
* Set scanning event
* replace error by warning
* Added context to HandleResults
* add dependencies to httphandler
* upgrade opa-utils and armo api
* Add prompt for removing old way of installation
* Clean uninstall of old installation
* Change installation path to ~/.kubescape/bin
* bump go-logger (#1144)
* Update CONTRIBUTING.md
* feat: integrate support to retrieve eks policies
* Revert add '.exe' to Win release binary
* ci(release): fix publishing krew plugin; add .exe suffix to Win
binary
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.2.5:
* initialize context in Prometheus handler
* fixup unit test: error handling
* test(hostsensorutils): added unit tests to the
hostsensorutils package
* test(reports): adds unit test to the report receiver
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.2.4:
* chore(lintin): run another pass of linting with the rules
already in place
* removed otel middleware from some APIs
* wip: update UTMs & display UTM only on first scan
* wip: do not add message when account ID is empty
* Do not display URL when message is empty
* wip: removed unused code
* wip: update link in docs
* refactor: update node scanner daemonset tolerations
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.2.3:
* ci: pin workflows versions to fixed commits
* fix(hostsensorsutils): remove hostNet and hostPort from
deployment
* added clusterName to otel initialization
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.2.2:
* Move GITHUB_REF to the krew step
* add unitsests to new behavior
* Do not print table when logger level is warn
* marking structs that are implementing IPrinter
* wip: re-arange struct
* Override GITHUB_REF env when releasing krew
* removing host scanner otel env
* Update rbac-utils pkg
* fix(processorhandler): reduce GC pressure
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.2.1:
* fix(hostsensorutils): improve namespace deletion in
host-scanner lifecycle
* update opa pkg to 238
* update opa pkg
* Fix HTML output (#1111)
* bump go-git-url (#1110)
* fix macos build - add missing pkg-config
* style(hostsensorutils): simplify code with gofmt
* fix(build): LICENSE file
* fix(README): broken links
* enable krew plugin publishing action
* chore: Remove an unwanted file
* fix(hostsensorutils): improve cloud provider detection
* generated rego policy json fixture file, short-circuited call
to github when fixture is here
* test(getters): added unit tests for utilities
* test(getters): added unit tests to the kubescape API client
* tests(cautils): added unit tests for released policy
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.2.0:
* Statuses (#1016) (#1082)
* modify plugin description for krew approval
* Revert "fix: add check to skip controlplaneinfo in case of
cloud providers"
* fix: add check to skip controlplaneinfo in case of cloud providers
* docs(contributing): add semantic commit messages best practice
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.1.3:
* Loading kubeconfig name from env when running ms (#1089)
* removed unwnated span (#1088)
* fix #1025 (#1087)
* Default frameworks (#1085)
* update logs in some resource getters (#1071)
* don't add host scanner as excluded ns, use exception instead
(#1083)
* Fixes for krew plugin submission (#1081)
* GitRegoStore moved to Regolibrary (#1058)
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.1.1:
* Renaming the files (#1079)
* Mon Mar 13 2023 Johannes Kastl <kastl@b1-systems.de>
- update to 2.1.0:
* Add cosign functions for signature checking
* Add progress bar for control processing
* Add OTEL with uptrace client
* Changed default JSON output to v2
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.182:
* setCloudMetadata only when scanning a cluster
* Initial documentation update upon joining the CNCF (#1020)
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.181:
* update opa-utils pkg with URL parsing fixed
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.180:
* Release (#1000)
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.179:
* update httphandler go mod
* update go-git pkg
* update config scanning path
* Update core/pkg/resultshandling/results.go
* feat: notify about writing to an output file in PrettyPrinter
* style: tidy up the PDFPrinter
* style: shorten receiver names in JUnitPrinter
* style: shorten receiver names in JSONPrinter
* style: shorten receiver names in HTML Printer
* style: shorten receiver names in PrettyPrinter
* docs: clarify new meaning of the `--format` CLI flag
* feat: always print to (T)UI using PrettyPrinter
* style: `GetFormats` → `Formats`
* style: `go fmt` the project
* style: shorten receiver names in ResultsHandler
* style: shorten receiver names for Prometheus printer
* refactor: tidy up printing to multiple outputs
* fix: revert the overriden ScanningTarget when submitting
reports
* Add logs for some formats
* Update core/pkg/resultshandling/printer/printresults.go
* Handle Output Extensions Gracefully
* Add logs for some formats
* Support getting outputs in multiple formats
* minor fix
* update go mod in httphandler
* Breakdown cloud-cluster name
* Fixed test
* DownloadInfo, PolicyIdentifier add Identity, remove ID and Name
* opa-utils v0.0.216
* opa-utils v0.0.216
* ignore resource if it is not found
* remove image vuln warning
* remove --verbose flag from default
* remove emoji from display
* Adopt CNCF Code of Conduct.
* Update maintainers
* validate downloaded framework
* Revert "Excluding controlPlaneInfo from error message in case
no data recieved."
* chore: Explicit set allowPrivilegeEscalation=true
* test fix
* test fix
* control scan by id
* download control only by id
* minor
* revert opa-utils version
* patch to filter out "controlPlaneInfo" from error messages in
case no data
* chore(style): renamed versioned packages to stick to idiomatic
conventions
* go mod tidy
* update opa-utils v0.0.209
* All prints and outputs to get data by control ID
* added GitLab repo scanning support
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.178:
* change linux runner to 20.04 instead of ubuntu-latest (#960)
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.177:
* Fix Junit format
* Added Kubescape flow.drawio
* remove tag latest
* fixed scanning example
* do not build dev images
* fixed echo command
* go mod tidy ancillary modules manifest
* move parsing of version to GetVersion
* fix(giturlparse): fixes panic on unexpected gitlab remote URL
* fixed typo
* Update cmd/scan/framework.go
* deprecate set-output
* testing release
* run build only if secret is set
* tagging only main image as latest
* update repository scanning URL
* update hostscanner version
* added logs of host scanner version
* fix link for cis controls in html output
* go mod tidy
* minor fix
* update opa-utils functions
* Update host-scanner image version to v1.0.38
* Handle Invalid Formats
* Support in new host-scanner endpoint - cloudProviderInfo
* Getting cloud provider from gitversion of discovered API
version
* Getting cluster name from context
* supporting client type from env
* update examples
* Added "CloudProvider" to postureControlInputs
* fix: filepath.Dir requires trailing slash
* Adding frameworks column to control command
* PER-633 support loading exceptions from cache
* PER-550 Support loading attack tracks from cache
* stash
* omit raw resources flag in json output
* Revert PR #802 to the old junit format
* Fix RootDir Info
* replace src with RelSrc
* Relative Path When scanning Local Repos
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.176:
* test build flow
* fixed docker build to support arm
* replace control 0006 by 0048
* continue when resource not found
* Pretty Print frameworks and exceptions
* Shift GetControlLink to cautils
* remove from smoke test
* Do not exit on error
* Updating json v1 deprecation message
* Deprecate rbac submit
* adding Remediation to message
* Updated and Used GetControlLink
* Modified Link Convention for CIS Controls
* Improve Code Quality
* Pretty Print Controls made Pretty
* Update rbac-utils tag
* Fix go.mod in httphandler
* Update k8s-interface version
* remove deprecated ioutil package
* Invalid Format Error
* Solved: Empty Lines before printing Controls
* add IDs to controls list, deprecate id flag
* fixing readme (#899)
* Fix reading frameworks from local file
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.175:
* retrieve submit flag
* fixed indentation
* updated go.mod
* added line and column information when using the sarif format
* fix dependencies
* fix go.sum
* updated go.mod
* Remove irrelevant code
* Adding Log in Caller Function
* remove --submit from msg when not submitted
* Add support to exceptions on repo (files) scan
* remove platforms build
* removed log
* Added Path variables for credentials
* Error Info Added
* Update core/core/initutils.go
* Add go sum
* Fix go mod and go sum
* Support downloading system-exception from GitHub
* feat: support the SARIF output format
* Fix when running with include or exclude namespace scanning
only namespaced scope
* PER-335 Fix comments
* PER-335 Add comment
* PER-335 Remove submit option from kubescape docs
* Store default URLs in cache
* PER-335 Removing support for submitting results without
accountID
* update cmd functionality added
* update cmd functionality added
* removed getLastScanId function
* changed name and added readme
* fixed
* Added the required changes
* Made the required changes
* added adaptor
* Added the comments for update command
* auto pick the OS of the usersystem
* Added the update command for kubescape
* Update rootinfo.go
* Update root.go
* Delete kubeconfig.go
* Rename kubeconfig to kubeconfig.go
* Create kubeconfig
* Delete kubeconfig
* Create kubeconfig
* Update README.md
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.174:
* update hostsensor version
* commented out tests which made actual http calls
* Adding links to readme
* Update README.md
* APIServerInfo resource added to the scan
* Adopt custom cluster name
* Update go.mod
* Migrate to yaml.v3
* cleaning from unused branches
* Workflow call testing (#7)
* testing gh actions
* testing gh actions
* host scanner with fixed version
* update logs
* change user to ks
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.173:
* use os path join in build file
* adding github token
* comment out image release
* Store default URLs in cache (#875)
* removed path from dockerfile
* fixed typo
* Fixed host-sensor control plane info collecting
* following review
* Support for getting backend URLs from ENV
* Upgrade opa dependency
* Added `controlPlaneInfo` host-sensor endpoint
* Adopt custom cluster name (#862)
* feat: add `--kubeconfig` flag (#858)
* Use workflow_call (#859)
* update path env var
* Add arch diagrams (#857)
* Update python build file
* Update logs (#854)
* Addition of Cosign for image signing (#826)
* Fix typos, linting errors of markdown file, modify the content
to make it more concise (#820)
* Correcting Punctuation (#849)
* Refactoring of Code Base (#853)
* Merge branch 'master' into dev
* feat: unify severity threshold into one CLI flag (#838)
* Scan Kustomize Directory (#795)
* add flag validation for --account-id (#605) (#793)
* fixed attack tracks loading logic
* fixed merge
* fixed welcome message
* remove unsupported installation method
* typo in .gitignore file (#833)
* Fix merge conflict
* Per 307 fail on severity counters (#831)
* Issue 613 cluster name (#783)
* Prioritization (#815)
* removed the extra 'download' word from the example (#810)
* Print line separator only if some controls failed (#813)
* update AdoptClusterName
* Print line separator only if some controls failed
* Edit Junit output (#802)
* commened out prioritization logic
* Remove windows extension build (#775)
* remove windows exe extension
* Update host scanner image (#774)
* update scanner image
* Option to force enable color output (closes #560) (#767)
* bump opa-utils to 181
* Fixed: Kubescape fails to authenticate remote private Github
repo (#721)
* update logger version (#773)
* update logger version
* Merging typo fixes from master (#772)
* Added resource prioritization information, raw resource will be
sent on the result object
* Change formatting to %s
* Print chart name log when fail to generate
* update go.mod
* Added fixed control input
* Update completion.go
* Update core/pkg/resourcehandler/filesloader.go
* Fix scanning ListObj following reviews
* Handle with issues caused by updating opa-utils
* Fix issues according to review
* docs(readme): Star → star
* gramatical improvements
* Support scanning several files
* improved icon of kubescape in readme
* override infoMap only if it's not nil
* Broken links fix in roadmap.md
* Fix go mod in httphandler pkg
* Fix issue for scanning list obj
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.172:
* Release (#844)
* build killercoda playground added (#843)
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.171:
* Enhancing CLI flags (#835)
* Update README.md (#827)
* Fixed typos on multiple files (#808)
* Fixed typos in roadmap.md (#800)
* Update README.md (#804)
* fixed some typo mistakes (#786)
* fixed typos (#777)
* Fixed typos in contribute.md (#779)
* Update README.md (#782)
* Publishing community meetings (#781)
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.170:
* Hot fix - Revert report structure (#776)
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.169:
* Fixed InfoMap usage (#680)
* Update PULL_REQUEST_TEMPLATE.md
* fixed the typo in docs/index.html
* Fixed some typos in feature_request.md
* modified PR template
* build.py is modified
* Automatically Close "Typo" labelled Issue
* roadmap.md file is modified
* Added alpine tag
* Fixed readme
* Added link to code of conduct file
* Updated README.md file
* some grammar mistake is corrected in PULL_REQUEST_TEMPLATE.md
file
* fixed typos
* docs : added gitpod badge in readme.md
* punctuation changes
* grammar error fixer in CONTRIBUTING.md
* typo: In the title and h1 element
* Fixed Typos in examples/exceptions/README.md
* Update aws.sh
* Update container-image-vulnerability-adaptor.md
* fix typos
* greetings
* Update close-typos-issues.yaml
* auto close typo issues
* typo correction: for better code readability
* Update README.md
* Adding "open for contribution" tickets in the team intro
section
* small reame changes
* removing ARMO from Kubescape logo
* Updating high level roadmap
* Update README.md
* Update CONTRIBUTING.md
* Update roadmap.md
* Corrected grammatical errors
* Edited few words
* Edited here as well
* Edited few words
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.168:
* Fixing building section links
* Fixed readme links
* fixed test deps pkg
* pr fixes
* Update PULL_REQUEST_TEMPLATE.md
* Fixed typo
* replace armo by kubescape mentioned in urls
* Removing mention of ARMO in the initi log print
* use setters
* Requesting PRs should be opened against the dev branch
* Update README.md
* Update README.md
* Update README.md
* Correction of grammatical errors
* Added simple PR template
* Updated the correct link on the discord button
* Made changes in Readme file by adding discord link
* update to kubescape org
* chore: Add a Bug Report issue template
* Add a feature request template
* go mod tidy
* change if order
* log error
* send mapNamespace to nuimber of resources in report
* use ks namespace
* removing unused function
* updated dependencies pkgs
* refactor!: httphandler: use Kubescape’s updated exported
functions
* chore: summeryhelpers.go → summaryhelpers.go
* refactor!: resourcehandler: rename armoResources to ksResources
* refactor!: resourcehandler: rename armoResources to ksResources
* refactor!: resourcehandler: rename armoResources to ksResources
* chore!: registryadaptors: rename armosec/v1 Go files
* refactor!: registryadaptors: rename adaptor Armo to KS
* refactor!: policyhandler/handlenotification.go: rename
armoResources to ksResources
* refactor!: opaprocessor/processorhandlerutils.go: rename
getArmoObjects to getKSObjects
* refactor!: core/submit.go: rename armoAPI to ksCloudAPI
* refactor!: core/list: rename armoAPI to ksCloudAPI
* refactor!: core/initutils.go: rename Armo to Kubescape Cloud
* refactor!: core/delete.go: rename Armo to Kubescape
* style: format ArmoResource comment
* refactor!: rename MapArmoResource to MapKSResource
* refactor!: rename "ArmoResources" to "KSResources"
* chore!: scaninfo_test.go: remove commented out code
* docs!: scaninfo.go: remove Armo mentions
* chore!: remove commented out code from reportv2tov1
* docs: rename CA in comments to Kubescape Cloud
* refactor!: rename "ruleWithArmoOpaDependency" to
"ruleWithKSOpaDependency"
* refactor!: rename "ArmoResources" to "KSCloudResources"
* docs: "armo" to "kubescape cloud" in customerloader comments
* chore!: rename "armoapi.go" to "kscloudapi.go"
* refactor(armoapiutils)!: rename "armoAPI" to "api"
* refactor!: rename "armoAPI" receivers to "api"
* refactor!: rename NewArmoAPICustomized to NewKSCloudCustomized
* refactor!: rename "NewARMOAPIStaging" to "NewKSCloudAPIStaging"
* refactor!: rename top-level global vars from "armo" to
"ksCloud"
* refactor!: rename "NewARMOAPIProd" to "NewKSCloudAPIProd"
(Github tests ratelimit fails here)
* refactor!: rename "NewArmoAPIDev" to "NewKSCloudAPIDev"
* refactor!: rename "globalArmoAPIConnector" to
"globalKSCloudAPIConnector"
* refactor!: rename "GetArmoAPIConnector" to
"etKSCloudAPIConnector"
* refactor!: rename SetArmoAPIConnector to SetKSCloudAPIConnector
* refactor!: rename ArmoAPI to KSCloudAPI
* refactor!: rename "armo" to "kscloud" in RootInfo
* refactor!: rename `armo` to `kubescape` in rootutils
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.167:
* Ignore markdown changes in workflows
* Updated brew commands
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.166:
* fixed url displayed
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.165:
* adding gitlab support
* fixed rbac submit
* fixed link in readme
* update readme
* update failed image scanning message
* chore: remove swagger.yaml at root
* chore: regenerate swagger.yaml on latest
* chore: clean up unused files
* fix: add Swagger file to httphandler package
* fix: update go module files
* docs: add embedded Swagger spec
* fix: tag proper JSON field in StatusQueryParams
* refactor: clean up OpenAPI UI serving func
* wip: feat: serve swagger doc
* wip: docs: autogenerate Swagger specs
* docs: add OpenAPI v3 spec
* docs: swagger: extend GET scan endpoint info
* docs: swagger: add OpenAPI V2 schema
* adding UTMs
* adding pprof
* docs: update link for playground
* cleaning the readme
* adding heap api
* helm chart name fix
* Fix support account from ENV
* include helm chart name
* Support windows build
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.164:
* Update Makefile
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.163:
* remove URLs from python build file
* use exteranl go logger
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.162:
* update go sum
* Support relative paths in repo scanning
* updated README
* fix README
* Replaced install_dependencie with Makefile, updated readme
* updated workflow to run also on PR to dev
* update build
* update submodule commit
* fix tests
* missing tag for go test
* update build process with libgit2
* remove file commit information for windows
* use git2go to get file commit information
* update go deps
* Decrease max report size
* update URL
* fixed tests
* printing error when failed to load exceptions
* Refactor for code aesthetics
* update dev and stage urls
* Modify the ScanningTarget to be a cluster or file
* go mod tidy
* Change "[info] Scanning. cluster:” to be dynamic by targetScan
* Edit the noOfWorkers to be the minimum between the number of
pods and 10
* Ignore a case where the chan is closed
* support in wokerpool in host sensor
* Replacing the documentation links to the new URL
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.161:
* update report size limit to 4mb
* use filepath join in unitests
* update go mod
* update readme
* update readme
* validate no workloads found
* mixed merge
* helm chart scanning
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.160:
* fixed printer
* handke invalide files
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.159:
* remove error when reading yaml
* Added host sensor new resources
* fixed docker version
* fixed typo
* fixed test for win
* fixed test
* fixed test
* ignore empty file
* upgrade go version
* fixed test
* add nixos/nix and go install instructions
* update dependencies
* update pkg
* fixed test
* update opa pkg
* fixed unitests
* adding file path to wl
* feat: add HTML as an output for scan results
* fixed go mod
* fixed build files
* do not submit invalide account ID
* validating slice length
* Added gitignore for vscode git history files
* Fixed web URL in git repo scanning
* Fixed relative path in git repo scan
* Fix backward competability of file scanning
* Added default pattern, and type filtering in `listFiles`
* Use clone in remote git repositories
* ignore last commit
* adding git data to file
* support installation of a fixed version
* moved testdata repo
* beta url support
* submit git scanning
* adding client build
* adding grafana dashboard
* supporting github.repository_owner
* updated commit date to time.Time and added length checking for
remote URLs
* implemented LocalGitRepository for working with a local git
folder
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.158:
* Update README.md
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.157:
* chore: add maintenance message
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.156:
* print submit error
* support secret key and account ID from cmd
* adding logs
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.155:
* do not submit results every scan with Prometheus
* loading from file fallback
* update loading customer config
* update auth url
* load data from config.json
* update readme
* send prometheus triggering to queue
* use channels for triggering scan
* update status busy to support more than one req
* fixed triggerd all frameworks
* using Buildx in githubactions
* update k8s-interface pkg
* adding scan request log
* go mod
* update k8s-iface for http handler
* update k8s-interface version
* fixed import
* adding status rest api
* fix test
* unit test for isEmptyImgVulns
* unit test for isMaterNodeTaints
* go mod
* show skipped for scan without imgvuln
* pull worker nodes based on taints
* update go mod
* support http and https for all endpoints
* update k8s-interface
* fix url
* make parse func
* support env with http
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.154:
* rm format-vers flag from examples
* support control view
* Updated readme - Lens extension
* Updated readme - Lens extension
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.153:
* reprot ks version
* return response object
* check that fixCOmmand is not nul
* go mod
* support fixCOmmand
* fixed saving error files
* adding tests
* docker user name
* support keep in query
* check tat control is not nil
* check that control is present
* use iface
* update docker user name
* return resp object from http req
* update http handler
* update go mod
* sent git repo context
* fix skipped for controlsd which use both armo and k8s resources
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.152:
* removed binary
* Mon Mar 13 2023 kastl@b1-systems.de
- Update to version 2.0.151:
* update version check
* rm context name
* rm error msg
* merge
* change to ge contextname
* fixed submit url
* Call cmd pkg from root
* update pkg struct
* remove v1 format
* adding logs
* save policy in file
* update resource table
* format v2
* report format version
* convert score to int
* support only one input
* send file meta
* update output
* fix error msg for cloud
* go mod
* exit status 1
* fix go mod
* fix control input for yaml scan
* register usesrs download from BE
* update metrics
* Added Severity Column with colored text
* Improved grammatical mistakes and typos
* mv cloud logic to k8s-interface
* support yaml scan submit
/usr/bin/kubescape /usr/share/doc/packages/kubescape /usr/share/doc/packages/kubescape/README.md /usr/share/doc/packages/kubescape/TODO_GORELEASER_E2E.md /usr/share/doc/packages/kubescape/architecture.md /usr/share/doc/packages/kubescape/azure-pipelines.md /usr/share/doc/packages/kubescape/circleci.md /usr/share/doc/packages/kubescape/cli-reference.md /usr/share/doc/packages/kubescape/environment-dependencies-policy.md /usr/share/doc/packages/kubescape/getting-started.md /usr/share/doc/packages/kubescape/github-code-scanning.md /usr/share/doc/packages/kubescape/gitlab-ci.md /usr/share/doc/packages/kubescape/harbor.md /usr/share/doc/packages/kubescape/ics-ot-workloads.md /usr/share/doc/packages/kubescape/img /usr/share/doc/packages/kubescape/img/architecture-diagram.png /usr/share/doc/packages/kubescape/img/architecture.drawio /usr/share/doc/packages/kubescape/img/architecture.drawio.svg /usr/share/doc/packages/kubescape/img/demo-v3.gif /usr/share/doc/packages/kubescape/img/demo.gif /usr/share/doc/packages/kubescape/img/favicon.ico /usr/share/doc/packages/kubescape/img/kcd-amsterdam-rabo.jpg /usr/share/doc/packages/kubescape/img/ks-cli-arch.png /usr/share/doc/packages/kubescape/img/ks-operator-arch.png /usr/share/doc/packages/kubescape/img/ks-scan-with-compliance.gif /usr/share/doc/packages/kubescape/img/ksfromcodetodeploy.png /usr/share/doc/packages/kubescape/img/summary.png /usr/share/doc/packages/kubescape/index.html /usr/share/doc/packages/kubescape/installation.md /usr/share/doc/packages/kubescape/jenkins.md /usr/share/doc/packages/kubescape/mcp-server.md /usr/share/doc/packages/kubescape/optimization-plan.md /usr/share/doc/packages/kubescape/proposals /usr/share/doc/packages/kubescape/proposals/container-image-vulnerability-adaptor.md /usr/share/doc/packages/kubescape/providers /usr/share/doc/packages/kubescape/providers.md /usr/share/doc/packages/kubescape/providers/armo-platform-dashboard.png /usr/share/doc/packages/kubescape/providers/armo-powered-by-kubescape-logo-grey.svg /usr/share/doc/packages/kubescape/providers/armo.md /usr/share/doc/packages/kubescape/providers/compliance.png /usr/share/doc/packages/kubescape/providers/install.ps1 /usr/share/doc/packages/kubescape/providers/install.sh /usr/share/doc/packages/kubescape/roadmap.md /usr/share/doc/packages/kubescape/troubleshooting.md /usr/share/licenses/kubescape /usr/share/licenses/kubescape/LICENSE
Generated by rpm2html 1.8.1
Fabrice Bellet, Sun Aug 2 01:54:38 2026