KubeLinter

What KubeLinter is

KubeLinter checks Kubernetes configuration files for practices tied to production readiness and security. It analyzes Kubernetes YAML, Helm chart directories, and Kustomize directories, with default checks that include whether containers run as non-root, least privilege is enforced, and sensitive information is kept in secrets. Teams can turn checks on or off and define custom checks to reflect their own policies, using YAML configuration and CEL expressions.

When a check fails, KubeLinter provides remediation recommendations and returns a non-zero exit code, so its findings can feed into automated workflows. Results can be written as plain text, JSON, or SARIF, with more than one format produced in a single run. The project documents use with pre-commit hooks, a Docker-based pre-commit hook, and a GitHub Action for CI. Installation routes include Go, release binaries, Homebrew or LinuxBrew, nix-shell, and Docker. Its container images are signed with cosign, and a public key is available for verification. KubeLinter is an Apache License 2.0 project created by StackRox and now powered by Red Hat.

Who it suits

KubeLinter suits teams that maintain Kubernetes YAML, Helm charts, or Kustomize manifests and want checks for security and production practices. It can fit workflows using pre-commit hooks or GitHub Actions, as well as teams that need custom policies and machine-readable reports.

Limits

The project notes that command usage, flags, and configuration file formats may change. The listed plan is free under the Apache License 2.0.

Getting started

1. Open the KubeLinter documentation website.
2. Choose an installation route: Go, release binary, Homebrew or LinuxBrew, nix-shell, or Docker.
3. Point it at Kubernetes YAML files, a Helm chart directory, or a Kustomize directory.
4. Choose or configure checks, then select plain text, JSON, or SARIF output.
5. Add it to a documented pre-commit hook or GitHub Action workflow if useful.

Verdict

Choose KubeLinter if you want configurable checks for Kubernetes manifests and findings that can be used in CI. Consider the documented possibility of changes to commands, flags, and configuration formats when building workflows around it.