docs/azure-pipelines.md
This guide explains how to integrate Kubescape with Azure Pipelines to automatically scan Kubernetes manifests, Helm charts, and container images for misconfigurations and vulnerabilities as part of your CI/CD pipeline.
azure-pipelines.yml file in the root of your repositoryKubescape runs as a step inside an Azure Pipelines job. The CLI is installed at runtime, scans the repository or a specified path, and exits with a non-zero code if the compliance score falls below the configured threshold — failing the pipeline.
Push / PR → Azure Pipelines → Install Kubescape → kubescape scan
↓
Compliance check
↓
Pass (exit 0) / Fail (exit 1)
Create an azure-pipelines.yml file in the root of your repository if one does not already exist:
trigger:
- main
pool:
vmImage: ubuntu-latest
steps: []
Add a step to install the Kubescape CLI:
- script: |
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash
echo "##vso[task.prependpath]$HOME/.kubescape/bin"
displayName: Install Kubescape
The ##vso[task.prependpath] logging command adds the Kubescape binary to PATH for all subsequent steps in the pipeline.
Add a step to scan all Kubernetes manifests in the repository against all frameworks:
- script: kubescape scan framework all . --compliance-threshold 80
displayName: Scan Kubernetes manifests
Kubescape exits with code 1 if the compliance score is below the threshold, marking the Azure Pipelines job as failed.
Note:
--compliance-thresholdonly applies toscan framework,scan control, and--view resource|control. Usingkubescape scan .without a framework does not enforce the compliance threshold.
To scan a specific directory instead of the entire repository, pass the path explicitly:
kubescape scan framework all ./manifests/ --compliance-threshold 80
To scan against a specific security framework such as NSA, MITRE, or CIS:
- script: kubescape scan framework nsa . --compliance-threshold 80
displayName: Scan with NSA framework
Available built-in frameworks: allcontrols, nsa, mitre. Run kubescape list frameworks to see all available frameworks including downloadable ones.
To scan a container image for vulnerabilities, add a separate step:
- script: kubescape scan image nginx:latest
displayName: Scan container image
Note: Kubescape pulls images directly from the registry using Syft/Grype and does not require a Docker daemon for registry-hosted images.
--format junitis not supported for image scans — usepretty-printer,json, orsarifinstead.
To store scan results as a downloadable Azure Pipelines artifact for later review:
- script: |
kubescape scan framework all . --format json --output $(Build.ArtifactStagingDirectory)/results.json || true
displayName: Save scan results
- task: PublishBuildArtifacts@1
inputs:
pathToPublish: $(Build.ArtifactStagingDirectory)
artifactName: kubescape-results
displayName: Publish scan results
The || true prevents the step from failing before the artifact is published. Add a separate threshold enforcement step after publishing results:
- script: kubescape scan framework all . --compliance-threshold 80
displayName: Enforce compliance threshold
The following is a complete azure-pipelines.yml that installs Kubescape, scans manifests, saves results as a pipeline artifact, and enforces a compliance threshold:
trigger:
- main
pool:
vmImage: ubuntu-latest
steps:
- script: |
curl -s https://raw.githubusercontent.com/kubescape/kubescape/master/install.sh | /bin/bash
echo "##vso[task.prependpath]$HOME/.kubescape/bin"
displayName: Install Kubescape
- script: |
kubescape scan framework all . --format json --output $(Build.ArtifactStagingDirectory)/results.json || true
displayName: Save scan results
- task: PublishBuildArtifacts@1
inputs:
pathToPublish: $(Build.ArtifactStagingDirectory)
artifactName: kubescape-results
displayName: Publish scan results
- script: kubescape scan framework all . --compliance-threshold 80
displayName: Enforce compliance threshold
Kubescape behaviour is controlled via CLI flags passed to the kubescape scan command.
| Flag | Default | Description |
|---|---|---|
--compliance-threshold | 0 | Minimum compliance score (0–100). The pipeline fails if the score is below this value. |
--format | pretty-printer | Output format for manifest/framework scans. Accepted values: pretty-printer, json, junit, sarif, html, pdf, prometheus. Image scans support pretty-printer, json, and sarif only (no junit). |
--output | stdout | Path to write the scan results file. |
--severity-threshold | (unset) | Fail the pipeline if any control failure at or above this severity is found. Accepted values: low, medium, high, critical. |
--exceptions | — | Path to an exceptions file to suppress known findings. |
To scan against multiple frameworks in the same pipeline, add a separate step for each:
- script: kubescape scan framework nsa . --compliance-threshold 80
displayName: Scan NSA framework
- script: kubescape scan framework mitre . --compliance-threshold 80
displayName: Scan MITRE framework
Azure DevOps supports SARIF output for static analysis results. To publish SARIF results:
- script: |
kubescape scan framework all . --format sarif --output $(Build.ArtifactStagingDirectory)/results.sarif || true
displayName: Save SARIF results
- task: PublishBuildArtifacts@1
inputs:
pathToPublish: $(Build.ArtifactStagingDirectory)
artifactName: CodeAnalysisLogs
displayName: Publish SARIF results
The install script adds Kubescape to ~/.kubescape/bin. In Azure Pipelines, use the ##vso[task.prependpath] logging command to add it to PATH for all subsequent steps:
echo "##vso[task.prependpath]$HOME/.kubescape/bin"
Using export PATH inside a script step does not persist across steps in Azure Pipelines.
This means the compliance score is below the --compliance-threshold value. Review the scan output in the pipeline logs and fix the flagged misconfigurations, or adjust the threshold value.
Kubescape scans the current directory by default. If your manifests are in a subdirectory, pass the path explicitly:
kubescape scan ./manifests/ --compliance-threshold 80
The || true in the save step prevents the step from exiting with code 1 before the artifact is published. Make sure threshold enforcement is a separate step placed after the PublishBuildArtifacts task.