[CNCF LFX Proposal] Kubescape Native Multi-Cluster Fleet Posture Aggregation

### CNCF Project

Kubescape

### Term

2026 Term 3 (Sep-Nov)

### Program Name

Native Multi-Cluster Fleet Posture Aggregation

### Program Description

Kubescape scans exactly one cluster per invocation, but almost every real
user operates more than one (prod/staging/DR, per-region, per-tenant).
Today there is no first-class way to ask fleet-wide questions like "which
clusters fail control C-0016?" or "staging passes this control but prod
fails it — where did we drift?". Users fall back to shell loops over
`KUBECONFIG` plus hand-rolled `jq` merges, the commercial ARMO SaaS
platform (excluding air-gapped/privacy-sensitive users), or bespoke CI glue
— none of it shared or tested.

Two things currently block this: there is no type above the single-cluster
`PostureReport` anywhere in the codebase, and the Kubernetes client is a
process-global singleton (kubescape/kubescape#2004), so even holding two
live cluster clients at once is unsafe today.

This proposal adds a `kubescape scan fleet` command that scans a list of
kubeconfig contexts **sequentially**, through the existing, entirely
unmodified single-cluster scan path — re-pointing the global client once
per cluster and never holding two live clients at once — and aggregates the
resulting `PostureReport`s into a new, purely additive `FleetReport` type.
Concurrency is explicitly deferred to a later phase gated on the #2004
singleton refactor, which keeps this term's scope small, self-contained,
and mergeable without touching any existing report schema, printer, or
public API.

**Deliverables for the term:**
- `cmd/scan/fleet.go`: new `scan fleet` subcommand accepting
`--contexts` (comma-separated kubeconfig contexts) and `--baseline`,
reusing existing scan flags.
- `core/pkg/fleet/orchestrator.go`: sequential orchestrator that runs a
complete, unmodified scan per context and collects per-cluster results.
- A `FleetReport` type carrying a cross-cluster control matrix (control ×
cluster status) plus drift detection: controls whose result diverges from
a chosen baseline cluster are flagged explicitly.
- At least one printer for `FleetReport` (e.g. table or JSON) so results are
usable from the CLI and in CI.
- Tests covering multi-context orchestration, missing/unreachable contexts,
and drift computation against a baseline.

Open design questions the mentee will help resolve early in the term:
where `FleetReport` should live in the module layout, and where OSS fleet
aggregation stops versus where platform-level (SaaS) aggregation begins.

### Technologies

Go, Kubernetes client-go, CLI design

### Skills same as Technologies?

- [x] Yes, the required skills are the same as the technologies listed above.

### Required/Desirable Skills

_No response_

### Mentors

Matthias Bertschy | @matthyx | matthias.bertschy@gmail.com | matthyx
Ben Hirschberg | @slashben | ben@armosec.io | slashben

### Upstream Issue URL

https://github.com/kubescape/kubescape/issues/2004

### Application Prerequisites

- [ ] Resume
- [ ] Cover Letter
- [ ] School Enrollment Verification
- [ ] Participation Permission from school or employer
- [ ] Coding Challenge
- [ ] Custom Prerequisite (fill in details below)

### Coding Challenge URL

_No response_

### Custom Prerequisite Name

_No response_

### Custom Prerequisite Description

_No response_

### Custom Prerequisite — File Upload

- [ ] Yes — completion of this task requires the mentee to submit a file.

---
**LFX program:** [CNCF - Kubescape: Native Multi-Cluster Fleet Posture Aggregation (2026 Term 3)](https://mentorship.lfx.linuxfoundation.org/project/784f1b4f-9e8b-41e9-a39a-b353099e2702)

Start by reading the existing single-cluster scan path and PostureReport, then review the proposed entry point in cmd/scan/fleet.go and orchestrator in core/pkg/fleet/orchestrator.go. Define how FleetReport and baseline drift fit the module layout, and cover multi-context, missing or unreachable contexts, and drift computation with tests. Done means sequential fleet scanning, a usable FleetReport printer, and the requested CLI flags.

Written by the indexing model from the issue text.