Comma

Share a Kubescape report

A Kubernetes posture score is a number that only means something over time, and against a set of decisions. Control 1.2.3 is failing because a DaemonSet legitimately needs hostPID. Control 4.5.6 is failing because nobody has got to it. Same red row, completely different follow-up.

Kubescape writes the rows. Where the follow-up lives is up to you, and in most setups it lives in a Slack thread that is gone by the next scan.

Publish it

kubescape scan framework nsa \
  --format html --output kubescape.html || true

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html kubescape.html \
        --arg title "Kubescape — $CLUSTER — $(date +%F)" \
        '{title: $title, html: $html}')"

|| true because a failing threshold is the run you want at a URL. One report id per cluster or per environment; PATCH appends a revision each scan, so prod has a posture history rather than a current snapshot.

Use a scoped token with reports:write only. Keep it private or team-visible — see the sharing model.

What the URL changes

  • Exemptions are documented where they apply. "hostPID required by the CNI, accepted 2026-07" pinned to the control. See commenting on HTML.
  • The score has a shape. Revision over revision shows whether the hardening work is landing. See revisions and diffs.
  • Compliance reviewers get a link, not a cluster credential.
  • Scheduled scans. A routine rescans nightly, so drift from a kubectl edit surfaces on its own — see monthly compliance digests.

Limits

  • HTML body: 5 MB. A large multi-tenant cluster report can approach it; scan per namespace or per framework and keep a report for each.
  • Scripts run, sandboxed: allow-scripts, no allow-same-origin.
  • 60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Create your first report →

Related