Kubernetes Manifest Security Analyzer
Check Kubernetes manifests for privileged containers, root users, host mounts, the Docker socket, latest tags, wildcard RBAC and exposed services. Runs in your browser.
Runs in your browser Your input never leaves your device.
Paste one or more Kubernetes manifests (separate documents with ---): Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, Pods, Services, Roles and bindings. They are read in your browser: nothing is uploaded and nothing is applied to a cluster. Helm templates must be rendered first (helm template).
Findings
Objects
| Kind | Name | Namespace | Containers | Line |
|---|
What is checked
Workloads (Pod, Deployment, StatefulSet, DaemonSet, ReplicaSet, Job, CronJob): privileged containers, privilege escalation, running as root, writable root filesystem, NET_RAW, host network, PID and IPC, the Docker socket and sensitive or writable host mounts, latest or untagged images, secrets in environment variables, the default service account, the default namespace, missing CPU and memory settings, missing probes, port 22 and privileged ports, unsafe sysctls and /proc mounts, invalid port names, hostPort, seccomp. RBAC: cluster-admin bindings, bindings to anonymous or all users, wildcards in roles, escalate, bind and impersonate. Also: NodePort and LoadBalancer services, Secret manifests with values, Ingress without TLS, a file without any NetworkPolicy, and credentials written in the manifests.
The workload and RBAC rules are the checks of kube-linter and were compared with it on hundreds of generated manifests. Findings describe the manifests, not the cluster: admission controllers, Pod Security admission and network policies elsewhere can change the outcome. Run kube-linter, Pod Security admission and a policy engine (Kyverno, Gatekeeper) in the cluster too.
Report a problem with this tool
About this tool
Kubernetes manifests decide how much a compromised container can do: whether it runs as root, whether it is privileged, which host paths and namespaces it shares, what its service account can reach. This tool reads one or more manifests (documents separated by ---) in your browser and reports the problems with the line of each. The workload rules cover Pod, Deployment, StatefulSet, DaemonSet, ReplicaSet, Job and CronJob (including init containers): privileged mode and privilege escalation, running as root, a writable root filesystem, NET_RAW, host network, PID and IPC, the Docker socket and sensitive or writable host mounts, latest or untagged images, secrets in environment variables, the default service account, the default namespace, missing resource settings and probes, port 22 and privileged ports, unsafe sysctls and /proc mounts, invalid port names. The RBAC rules cover cluster-admin bindings, wildcards and risky verbs in roles, and bindings to anonymous users. These follow the checks of kube-linter (names kept) and were compared with it on hundreds of generated manifests (pod, container and role shapes, security contexts, mounts, ports, probes, resources). It adds hostPort, seccomp, Secret manifests with values, Ingress without TLS, NodePort and LoadBalancer services, a file with no NetworkPolicy and credentials in the text. It reads the manifests only: it knows nothing about admission controllers, Pod Security admission, policies in other files or what runs in the cluster, and Helm charts and Kustomize overlays must be rendered first.
How to use it
- Paste the manifests (or the output of helm template or kustomize build), or load a file.
- Fix the critical and high findings first: privileged, host mounts, the Docker socket, cluster-admin.
- Set securityContext (runAsNonRoot, readOnlyRootFilesystem, allowPrivilegeEscalation: false, drop ALL capabilities, seccomp RuntimeDefault) on every container.
- Copy the Markdown summary into your pull request or ticket.
Common problems
- A check refers to something defined in another file
- Checks such as the NetworkPolicy note only see this text. Paste everything that belongs together, or ignore the note.
- Helm templates show a YAML error
- Template syntax is not YAML. Render it first with helm template and paste the output.
- It reports root although my image runs as a user
- The page cannot see inside the image. Set runAsNonRoot: true and a numeric runAsUser so Kubernetes enforces it.