Kubescape
v4.0.8SecurityKubescape v4.0.8 is a focused patch release that fixes several VAP (Validating Admission Policy) bugs and adds a --timeout flag to the deploy-library command.
breakingVAP label selector parsing was silently wrong — verify your policies
The old code split label selectors on '=' directly instead of using Kubernetes' label parser. DoubleEquals (==) selectors were also incorrectly accepted. If you've generated VAP policies with Kubescape and used complex label selectors, re-generate and re-validate those policies with v4.0.8. Don't assume previously generated output was correct.
enhancementUse --timeout with VAP deploy-library in slow clusters
The new --timeout flag on the deploy-library command lets you tune how long Kubescape waits during VAP library deployment. If your cluster has slow API server response times or you're running in CI with strict time limits, set this explicitly rather than relying on the default. Test in staging first to find a safe value before enforcing it in pipelines.
enhancementConnector URL back-propagation fix matters for cloud API setups
A bug where connector URLs weren't back-propagated to the config object during cloud API initialization is now fixed. If you use Kubescape's cloud integration and noticed inconsistent scan result submissions, this patch addresses the root cause. Upgrade and re-run a scan to confirm results are reaching your backend correctly.
Key changes (5)
- Added --timeout flag to the VAP deploy-library command for controlling deployment timeouts
- Fixed label selector validation to use Kubernetes upstream label parsing instead of raw string splitting — prevents silent breakage with complex selectors
- Fixed K8s name and namespace validation to use proper DNS label validation helpers
- Fixed writeOutput to auto-create parent directories, preventing file write failures
- Suppressed spurious interrupt signal log messages on graceful exit — cleaner operator experience