KubeLinter

What KubeLinter is

KubeLinter is a free static analyzer for Kubernetes configuration files. It checks Kubernetes YAML, Helm chart directories, and Kustomize directories for best practices, production readiness, and security concerns. Default checks include whether containers run as non-root, least privilege is enforced, and sensitive information is kept in secrets. Users can enable or disable checks and define custom checks to align with organizational policies, using YAML configuration and CEL expressions. When a check fails, KubeLinter provides remediation recommendations and exits with a non-zero code, which can make findings actionable in automated workflows. Results can be written as plain text, JSON, or SARIF, including multiple formats in a single run. The project documents use with pre-commit hooks, a Docker-based pre-commit hook, and a GitHub Action for CI. Installation options include Go, release binaries, Homebrew or LinuxBrew, nix-shell, and Docker. Container images are signed with cosign, and a public verification key is provided. KubeLinter is licensed under Apache License 2.0; the repository says StackRox created it and Red Hat now powers it.