ksail workload scan

Run security scans on Kubernetes manifests using Kubescape.

This command scans manifests in the specified path against security frameworks
such as NSA-CISA, MITRE ATT&CK, and CIS Benchmarks.

When the target directory is a Kustomize root, manifests are rendered before
scanning (Kustomize build + Flux variable substitution + in-process Helm
templating of HelmReleases), so findings reflect overlay patches and chart output
rather than the raw files. HelmReleases that cannot be rendered offline are left
as-is with a warning. Use --no-render to scan the raw files instead.

If no path is provided, the path is resolved in order:
  1. spec.workload.sourceDirectory from ksail.yaml (if a config file is found and the field is set)
  2. The default source directory when spec.workload.sourceDirectory is unset ("k8s" directory)
  3. The current directory (fallback when no ksail.yaml config file is found)

Exceptions: pass --exceptions <file> to forward a Kubescape exceptions file (a JSON
array of PostureExceptionPolicy objects) so justified, runtime-enforced findings
(e.g. Kyverno admission mutation, Cilium network policies, VPA-managed resources) are
suppressed and --compliance-threshold 100 can gate CI. The file loads locally with no
cloud account and the scan stays offline.

The frameworks, exceptions file, and compliance threshold can also be set under
spec.workload.scan in ksail.yaml so 'ksail workload scan' (no args) is a turnkey CI
gate; a relative exceptions path resolves against the ksail.yaml directory and CLI
flags override the config.

Available frameworks: nsa, mitre, cis, pss (and any other framework supported by Kubescape)
Available output formats: pretty-printer, json, sarif, junit (and any other format supported by Kubescape)

For more information, see https://github.com/kubescape/kubescape

Usage:
  ksail workload scan [PATH] [flags]

Flags:
      --compliance-threshold float32   Fail if compliance score is below this threshold (0-100) (overrides spec.workload.scan.complianceThreshold from ksail.yaml)
      --ephemeral                      EXPERIMENTAL (ksail#5919): provision an isolated throwaway Kind cluster for the duration of this command (guaranteed teardown) and install the workload's declared Helm charts into it, so declared operators' CRDs are registered. Applying rendered manifests and scanning operator-rendered children is the next slice — off by default.
      --exceptions string              Path to a Kubescape exceptions file (a JSON array of PostureExceptionPolicy objects) forwarded to Kubescape's --exceptions (overrides spec.workload.scan.exceptions from ksail.yaml)
      --format string                  Output format (pretty-printer, json, sarif, junit) (default "pretty-printer")
      --framework strings              Security frameworks to scan against (e.g. nsa, mitre, cis, pss) (overrides spec.workload.scan.frameworks from ksail.yaml) (default [nsa])
      --no-render                      Scan the raw manifest files instead of the Kustomize + Helm rendered output (skip rendering entirely; restores the pre-rendering behavior)
  -o, --output string                  Output file path (stdout if empty)
      --verbose                        Show all resources in output, not just failed ones

Global Flags:
      --benchmark       Show per-activity benchmark output
      --config string   Path to config file (default: ksail.yaml found via directory traversal)
      --experimental    Enable experimental (unstable) commands and features