Kubescape Headlamp Plugin

A Headlamp plugin for Kubescape — compliance scanning, vulnerability analysis, network policies, and eBPF-based runtime threat detection.

Fork: This is the sm-moshi fork of the upstream Kubescape Headlamp plugin, with CI/CD via Woodpecker, ArtifactHub metadata, and code quality improvements.

Demo

Prerequisites

• Kubescape operator installed in the cluster with configuration and image scanning enabled. We recommend helm chart v1.22.0 or later with capabilities.continuousScan: enable.

  Verify with: kubectl get workloadconfigurationscans -A

• Headlamp installed in-cluster or on your workstation (desktop version recommended for testing).

Functionality

• Compliance overview with views on controls, resources and namespaces
• Vulnerability overview with views on CVEs, resources and images
• Generated network policies viewer
• Validation Admission Policy playground
• eBPF-based runtime threat detection
• Custom frameworks and exceptions

The plugin uses Headlamp's Allowed namespaces feature for multi-tenant clusters. Configure per user in Settings/Cluster.

Installation

Desktop Headlamp

1. Install Headlamp
2. Open Plugin Catalogue
3. Select the Kubescape plugin and install
4. Restart Headlamp if prompted

In-cluster Headlamp

Install Headlamp and add the plugin as an init container. See example helm values:

initContainers:
  - command: ['/bin/sh', '-c', 'mkdir -p /build/plugins && cp -r /plugins/* /build/plugins/']
    image: ghcr.io/sm-moshi/headlamp-kubescape-plugin:v0.10.5
    name: kubescape-plugin
    volumeMounts:
      - mountPath: /build/plugins
        name: headlamp-plugins

Quick test

Create kind cluster

Install kind and create a cluster.

Install Kubescape operator

helm repo add kubescape https://kubescape.github.io/helm-charts/
helm upgrade --install kubescape kubescape/kubescape-operator \
  -n kubescape --create-namespace \
  --set capabilities.runtimeDetection=enable \
  --set alertCRD.installDefault=true \
  --set nodeAgent.config.maxLearningPeriod=10m \
  --set capabilities.continuousScan=enable

Wait for pods: kubectl get pods -n kubescape

Test deployments

kubectl apply -f https://k8s.io/examples/application/deployment.yaml -n default
kubectl apply -k github.com/BuoyantIO/emojivoto/kustomize/deployment

Start Headlamp desktop and load the kind cluster kubeconfig. Runtime detection requires waiting for the learning period (10 minutes).

Docs

Notes about the Kubescape data model and how the plugin leverages it.

Dependencies

• Kubescape User Hub for control documentation
• Kubescape regolibrary for framework and control JSON data

Contributing and Feedback

For questions or feedback, please open an issue on the GitHub repository.

Contributions welcome — fork the repository and submit a pull request.

License

Apache-2.0. See LICENSE for details.