But you meant the UI stopped working for that downstream cluster and not like the entire Rancher right? Like the local cluster was working (or others that don't have the kubescape installed) ?

If you want, I can probably re-create the issue in our dev cluster and do a short screen recording

I think the issue for me is that there is no graceful degradation in the UI. IE: instead of "this object type won't load" or "I see an error message", it's that "when I try to load the cluster in the UI, I just get a white page"

I know there's a ping/pong lookup for the cluster at a different endpoint, but maybe it's not affected in your particular situation?

I don’t know how responsive the kubescape folks are though, I’m not super familiar with it

FWIW, this is what we see in the UI, when we installed kubescape

This is our kubescape install

helm repo add kubescape <https://kubescape.github.io/helm-charts/>
helm repo update
helm upgrade \
   kubescape kubescape/kubescape-operator \
  --namespace kubescape-system \
  --values ./values.common.yaml \
  --install --create-namespace

# Values that are common across all clusters

# Ref: <https://github.com/kubescape/helm-charts/blob/main/charts/kubescape-operator/values.yaml>

excludeNamespaces: "cattle-dashboards,cattle-fleet-system,cattle-impersonation-system,cattle-monitoring-system,cattle-system,cattle-ui-plugin-system,cert-manager,kube-node-lease,kube-public,kube-system,kubeconfig,kubescape-system,logging-system,longhorn-system,metallb-system,topolvm-system"

ksNamespace: kubescape-system

# clusterName: ... # Override
capabilities:
  # scan types
  configurationScan: disable
  continuousScan: enable
  nodeScan: disable

  # skip SBOM for node
  nodeSbomGeneration: disable

  # runtime capabilites we don't want
  admissionController: disable
  httpDetection: disable

  # completely disable node-agent
  networkPolicyService: disable
  relevancy: disable
  runtimeObservability: disable
  runtimeDetection: disable
  malwareDetection: disable
  nodeProfileService: disable
  seccompProfileService: disable

cattle-cluster-agent logs on the affected downstream cluster

If you'd like, I can turn this into a Rancher issue/discussion, just lmk.

I know the problem isn't necessarily "simple" and/or a fix might not be practical, but if I'm thinking of a wishlist from a user perspective the following would be desirable (in my perceived order of difficulty): • A cattle-cluster-agent error message that indicates which resource is the problem (this could mean patching k8s.io/client-go) • A UI that can load and manage well-behaved resources, even if kubescape related resources aren't shown. • A UI that can display poorly behaved resources, but have some degraded behavior (IE: they can't be edited, an error shows when I try to view that specific resource, the UI doesn't update automatically for that resource, etc)

I did a bit of digging (mostly for my own curiosity). When I scaled down the kubescape storage server and restarted the agent, the Rancher UI started to behave

kubectl -n kubescape-system scale Deployment/storage --replicas=0
kubectl -n cattle-system rollout restart Deployment/cattle-cluster-agent

It's the only APIResource that kubescape exposes through the "aggregated API"; the rest have "service=Local"

% kubectl describe apiservices <http://v1beta1.spdx.softwarecomposition.kubescape.io|v1beta1.spdx.softwarecomposition.kubescape.io>
Name:         <http://v1beta1.spdx.softwarecomposition.kubescape.io|v1beta1.spdx.softwarecomposition.kubescape.io>
Namespace:
Labels:       app=storage
              <http://app.kubernetes.io/component=storage|app.kubernetes.io/component=storage>
              <http://app.kubernetes.io/instance=kubescape|app.kubernetes.io/instance=kubescape>
              <http://app.kubernetes.io/managed-by=Helm|app.kubernetes.io/managed-by=Helm>
              <http://app.kubernetes.io/name=kubescape-operator|app.kubernetes.io/name=kubescape-operator>
              <http://app.kubernetes.io/part-of=kubescape|app.kubernetes.io/part-of=kubescape>
              <http://app.kubernetes.io/version=1.40.1|app.kubernetes.io/version=1.40.1>
              <http://helm.sh/chart=kubescape-operator-1.40.1|helm.sh/chart=kubescape-operator-1.40.1>
              <http://kubescape.io/ignore=true|kubescape.io/ignore=true>
              tier=ks-control-plane
Annotations:  <http://meta.helm.sh/release-name|meta.helm.sh/release-name>: kubescape
              <http://meta.helm.sh/release-namespace|meta.helm.sh/release-namespace>: kubescape-system
API Version:  <http://apiregistration.k8s.io/v1|apiregistration.k8s.io/v1>
Kind:         APIService
Metadata:
  Creation Timestamp:  2026-05-06T14:52:30Z
  Resource Version:    653396731
  UID:                 c2baccca-1020-4c06-9342-f690dcd2e0ec
Spec:
  Ca Bundle: TRIMMED
  Group:                   <http://spdx.softwarecomposition.kubescape.io|spdx.softwarecomposition.kubescape.io>
  Group Priority Minimum:  1000
  Service:
    Name:            storage
    Namespace:       kubescape-system
    Port:            443
  Version:           v1beta1
  Version Priority:  15
Status:
  Conditions:
    Last Transition Time:  2026-05-06T14:58:30Z
    Message:               endpoints for service/storage in "kubescape-system" have no addresses with port name "https"
    Reason:                MissingEndpoints <------- because I scaled down Deployment/storage
    Status:                False            <------- because I scaled down Deployment/storage
    Type:                  Available
Events:                    <none>