klint 🧹

Reminders 🎗

Tools 🔧

Usage 🐳

$ docker run --rm -it -v `pwd`:/src derekahn/klint

Kubescore

Example Usage

/src $ kube-score score *.yaml

Example Output

apps/v1/Deployment my-app in awesome 💥
 [CRITICAL] Pod Probes
 · Container has the same readiness and liveness probe
 Using the same probe for liveness and readiness is very likely dangerous. Generally it's better to avoid
 the livenessProbe than re-using the readinessProbe.
 More information: https://github.com/zegl/kube-score/blob/master/README_PROBES.md
 [CRITICAL] Container Resources
 · scala-sample -> CPU limit is not set
 Resource limits are recommended to avoid resource DDOS. Set resources.limits.cpu
 · scala-sample -> Memory limit is not set
 Resource limits are recommended to avoid resource DDOS. Set resources.limits.memory
 · scala-sample -> CPU request is not set
 Resource requests are recommended to make sure that the application can start and run without crashing.
 Set resources.requests.cpu
 · scala-sample -> Memory request is not set
 Resource requests are recommended to make sure that the application can start and run without crashing.
 Set resources.requests.memory
 [CRITICAL] Container Image Tag
 · scala-sample -> Image with latest tag
 Using a fixed tag is recommended to avoid accidental upgrades
 [CRITICAL] Pod NetworkPolicy
 · The pod does not have a matching NetworkPolicy
 Create a NetworkPolicy that targets this pod to control who/what can communicate with this pod. Note, this
 feature needs to be supported by the CNI implementation used in the Kubernetes cluster to have an effect.
 [CRITICAL] Deployment has PodDisruptionBudget
 · No matching PodDisruptionBudget was found
 It's recommended to define a PodDisruptionBudget to avoid unexpected downtime during Kubernetes
 maintenance operations, such as when draining a node.
 [WARNING] Deployment has host PodAntiAffinity
 · Deployment does not have a host podAntiAffinity set
 It's recommended to set a podAntiAffinity that stops multiple pods from a deployment from being scheduled
 on the same node. This increases availability in case the node becomes unavailable.
v1/Service my-app in awesome ✅

Kubeval

Example Usage

/src $ kube-score score *.yaml

Example Output

PASS - my-app-deply.yaml contains a valid Deployment (awesome.my-app)
PASS - my-app-svc.yaml contains a valid Service (awesome.my-app-svc)

Kubesec

Example Usage

/src $ kubesec scan my-app-deploy.yaml

Example Output

[
 {
 "object": "Deployment/my-app.awesome",
 "valid": true,
 "fileName": "my-app-deploy.yaml",
 "message": "Passed with a score of 5 points",
 "score": 5,
 "scoring": {
 "passed": [
 {
 "id": "CapDropAny",
 "selector": "containers[] .securityContext .capabilities .drop",
 "reason": "Reducing kernel capabilities available to a container limits its attack surface",
 "points": 1
 },
 {
 "id": "CapDropAll",
 "selector": "containers[] .securityContext .capabilities .drop | index(\"ALL\")",
 "reason": "Drop all capabilities and add only those required to reduce syscall attack surface",
 "points": 1
 },
 {
 "id": "ReadOnlyRootFilesystem",
 "selector": "containers[] .securityContext .readOnlyRootFilesystem == true",
 "reason": "An immutable root filesystem can prevent malicious binaries being added to PATH and increase attack cost",
 "points": 1
 },
 {
 "id": "RunAsNonRoot",
 "selector": "containers[] .securityContext .runAsNonRoot == true",
 "reason": "Force the running image to run as a non-root user to ensure least privilege",
 "points": 1
 },
 {
 "id": "RunAsUser",
 "selector": "containers[] .securityContext .runAsUser -gt 10000",
 "reason": "Run as a high-UID user to avoid conflicts with the host's user table",
 "points": 1
 }
 ],
 "advise": [
 {
 "id": "ApparmorAny",
 "selector": ".metadata .annotations .\"container.apparmor.security.beta.kubernetes.io/nginx\"",
 "reason": "Well defined AppArmor policies may provide greater protection from unknown threats. WARNING: NOT PRODUCTION READY",
 "points": 3
 },
 {
 "id": "ServiceAccountName",
 "selector": ".spec .serviceAccountName",
 "reason": "Service accounts restrict Kubernetes API access and should be configured with least privilege",
 "points": 3
 },
 {
 "id": "SeccompAny",
 "selector": ".metadata .annotations .\"container.seccomp.security.alpha.kubernetes.io/pod\"",
 "reason": "Seccomp profiles set minimum privilege and secure against unknown threats",
 "points": 1
 },
 ]
 }
 }
]

Kustomize

/src $ kustomize build overlays/development/
apiVersion: v1
kind: Namespace
metadata:
 annotations:
 kube-score/ignore: pod-networkpolicy,deployment-has-host-podantiaffinity,container-security-context,deployment-has-poddisruptionbudget
 name: awesome
---
apiVersion: apps/v1
kind: Deployment
metadata:
 annotations:
 kube-score/ignore: pod-networkpolicy,deployment-has-host-podantiaffinity,container-security-context,deployment-has-poddisruptionbudget
 labels:
 app: my-app
 name: my-app
 namespace: awesome
spec:
 selector:
 matchLabels:
 app: my-app
 template:
 metadata:
 annotations:
 kube-score/ignore: pod-networkpolicy,deployment-has-host-podantiaffinity,container-security-context,deployment-has-poddisruptionbudget
 labels:
 app: my-app
 spec:
 containers:
 - image: k8s:5000/my-app
 imagePullPolicy: Always
 name: my-app
 ports:
 - containerPort: 5000
 resources:
 limits:
 cpu: 1
 memory: 2048Mi
 requests:
 cpu: 1
 memory: 512Mi

Continuous Integration

Github Actions

jobs:
 container:
 runs-on: ubuntu-latest
 container: derekahn/klint:latest
 steps:
 - run: |
 kubeval *.yaml
 name: Run in container

Jenkins example using Docker agents

pipeline {
 agent {
 docker { image 'derekahn/klint:latest' }
 }
 stages {
 stage('lint') {
 steps {
 sh 'kubeval *.yaml'
 }
 }
 stage('validate') {
 steps {
 sh 'kube-score score *.yaml'
 }
 }
 stage('security scan') {
 steps {
 sh 'kubeval *.yaml'
 }
 }
 }
}

Drone

kind: pipeline
name: k8s validations
steps:
 - name: lint
 image: derekahn/klint:latest
 commands:
 - kubeval score *.yaml
 - name: validate
 image: derekahn/klint:latest
 commands:
 - kube-score score *.yaml
 - name: scan
 image: derekahn/klint:latest
 commands:
 - kubesec scan *.yaml

Circle-CI

version: 2.0
jobs:
 build:
 docker:
 - image: derekahn/klint:latest