Static analysis for Kubernetes
[](https://goreportcard.com/report/github.com/stackrox/kube-linter) # What is KubeLinter? KubeLinter analyzes Kubernetes YAML files, Helm charts, and Kustomize manifests, and checks them against a variety of best practices, with a focus on production readiness and security. KubeLinter runs sensible default checks, designed to give you useful information about your Kubernetes YAML files, Helm charts, and Kustomize manifests. This is to help teams check early and often for security misconfigurations and DevOps best practices. Some common examples of these include running containers as a non-root user, enforcing least privilege, and storing sensitive information only in secrets. KubeLinter is configurable, so you can enable and disable checks, as well as create your own custom checks, depending on the policies you want to follow within your organization. When a lint check fails, KubeLinter reports recommendations for how to resolve any potential issues and returns a non-zero exit code. ## Documentation Visit https://docs.kubelinter.io for detailed documentation on installing, using and configuring KubeLinter. ## Installing KubeLinter Kube-linter binaries could be found here: https://github.com/stackrox/kube-linter/releases/latest ### Using Go To install using [Go](https://golang.org/), run the following command: ```bash go install golang.stackrox.io/kube-linter/cmd/kube-linter@latest ``` Otherwise, download the latest binary from [Releases](https://github.com/stackrox/kube-linter/releases) and add it to your PATH. ### Using Homebrew for macOS or LinuxBrew for Linux To install using Homebrew or LinuxBrew, run the following command: ```bash brew install kube-linter ``` ### Using nix-shell ``` nix-shell -p kube-linter ``` ### Using docker ``` docker pull stackrox/kube-linter:latest ``` ## Development ### Prerequisites - Make sure that you have [installed Go](https://golang.org/doc/install) prior to building from source. ### Building KubeLinter Installing KubeLinter from source is as simple as following these steps: 1. First, clone the KubeLinter repository. ```bash git clone git@github.com:stackrox/kube-linter.git ``` 1. Then, compile the source code. This will create the kube-linter binary files for each platform and places them in the `.gobin` folder. ```bash make build ``` 1. Finally, you are ready to start using KubeLinter. Verify your version to ensure you've successfully installed KubeLinter. ```bash .gobin/kube-linter version ``` ### Testing KubeLinter There are several layers of testing. Each layer is expected to pass. 1. `go` unit tests: ```bash make test ``` 2. end-to-end integration tests: ```bash make e2e-test ``` 3. and finally, end-to-end integration tests using `bats-core`: ```bash make e2e-bats ``` ## Verifying KubeLinter images KubeLinter images are signed by [cosign](https://github.com/sigstore/cosign). We recommend verifying the image before using it. Once you've installed cosign, you can use the [KubeLinter public key](kubelinter-cosign.pub) to verify the KubeLinter image with: ```shell cat kubelinter-cosign.pub -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEl0HCkCRzYv0qH5QiazoXeXe2qwFX DmAszeH26g1s3OSsG/focPWkN88wEKQ5eiE95v+Z2snUQPl/mjPdvqpyjA== -----END PUBLIC KEY----- cosign verify --key kubelinter-cosign $IMAGE_NAME ``` KubeLinter also provides [cosign keyless signatures](https://github.com/sigstore/cosign/blob/623d50f9b77ee85886a166daac648455e65003ec/KEYLESS.md). You can verify the KubeLinter image with: ```shell # NOTE: Keyless signatures are NOT PRODUCTION ready. COSIGN_EXPERIMENTAL=1 cosign verify $IMAGE_NAME ``` ## Using KubeLinter ### Local YAML Linting Running KubeLinter to Lint your YAML files only requires two steps in its most basic form. 1. Locate the YAML file you'd like to test for security and production readiness best practices: 1. Run the following command: ```bash kube-linter lint /path/to/your/yaml.yaml ``` ### Example Consider the following sample pod specification file `pod.yaml`. This file has two production readiness issues and one security issue: **Security Issue:** 1. The container in this pod is not running as a read only file system, which could allow it to write to the root filesystem. **Production readiness:** 1. The container's memory limits are not set, which could allow it to consume excessive memory ```yaml apiVersion: v1 kind: Pod metadata: name: security-context-demo spec: securityContext: runAsUser: 1000 runAsGroup: 3000 fsGroup: 2000 volumes: - name: sec-ctx-vol emptyDir: {} containers: - name: sec-ctx-demo image: busybox resources: requests: memory: "64Mi" cpu: "250m" command: [ "sh", "-c", "sleep 1h" ] volumeMounts: - name: sec-ctx-vol mountPath: /data/demo securityContext: allowPrivilegeEscalation: false ``` 1. Copy the YAML above to pod.yaml and lint this file by running the following command: ```bash kube-linter lint pod.yaml ``` 1. KubeLinter runs its default checks and reports recommendations. Below is the output from our previous command. ``` pod.yaml: (object: