Kubernetes Scanner

The Kubernetes Scanner is a native scanner type that inspects a connected Kubernetes cluster.It discovers the full inventory of identities, such as service accounts and their RBAC bindings, and secrets, including certificates, which Kubernetes stores as kubernetes.io/tls typed Secrets rather than as a separate object type. It also maps the relationships between these objects.
Each discovered object is evaluated against Identity and Secrets Intelligence security policies, which assess its risk posture and surface the resulting findings for review.

Prerequisites

• An Akeyless account with the Identity & Secrets Intelligence license.
• A deployed and connected Akeyless Gateway version 5.1.0 and later.
• A Gateway with Akeyless AI Insights configured.
• A Kubernetes Target representing the service account that will scan the cluster.
• The credentials used by the Target granted the permissions listed under Required Kubernetes Permissions below.
• Access to configure and run the scanner, granted via:
  1. "Manage ISI Scanners" or "Admin" Gateway Permission.
  2. "Identity & Secrets Intelligence" Administrative Rule set to Scoped or All.
  3. "List" permission on the Kubernetes Target.

Required Kubernetes Permissions

The credentials used by the Target need list-only access to your cluster's API resources. There are two ways to grant it:

• Quick Setup - bind a single predefined ClusterRole covering everything the scanner can use. Fastest to configure, but grants more access than a narrowly-scoped scan configuration strictly needs.
• Granular Permissions - bind only the specific list verbs your scan configuration needs, following the principle of least privilege.

Both produce a complete scan, the difference is privilege scope, not scan coverage.

Quick Setup

Bind this ClusterRole to the scanner's service account. All access is list-only.

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: akeyless-isi-scanner
rules:
  - apiGroups: [""]
    resources: ["namespaces", "serviceaccounts", "secrets"]
    verbs: ["list"]
  - apiGroups: ["rbac.authorization.k8s.io"]
    resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]
    verbs: ["list"]

Granular Permissions

All permissions below are list-only. The scanner never requires read, write, or exec access to your cluster, and never reads secret values, only metadata.

Required Permissions

The permissions listed below are required for the scan to complete successfully. If any one of them is missing, the corresponding scan will fail.

Additional Permissions for Complete Coverage

These permissions are optional. If missing, the scan still completes, but with reduced visibility, and any gaps are reported in the Access Status field within the scan details.

Managed-Cluster Authentication

For clusters running on a managed Kubernetes service, the scanner's credentials also need cloud-level access to reach the cluster:

• EKS: The AWS IAM Role used by the Target needs sts:GetCallerIdentity and eks:DescribeCluster.

Create a Kubernetes Scanner

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click New, and select the scanner type Kubernetes, then click Next.
3. Define a Name for the scanner.
4. Select the Target representing the cluster to scan, and the Gateway that will execute the scans, then click Next.
5. Use the Object Type drop-down list to select the scanner's scope, and click Finish.

Run a Scan

1. Log in to the Akeyless Console, and go to Products > Identity & Secrets Intelligence > Scanners.
2. Click the Kubernetes scanner.
3. Click Start Scan.

Once the scan completes, results appear in Inventory for review.