GitHub - zegl/kube-score: Kubernetes object linting

6 years ago

source link: https://github.com/zegl/kube-score
Go to the source link to view the article. You can view the picture content, updated content and better typesetting reading experience. If the link is broken, please click the button below to view the snapshot at that time.

README.md

kube-score

kube-score is a tool that does static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resiliant.

Installation

Download

Pre-built releases can be downloaded from the Github Releases page, or from Docker Hub.

Building from source

kube-score requires go in version 1.11.+ with go modules. To install kube-score into you local gobin path run the following commands:

go get github.com/zegl/kube-score
cd $GOPATH/src/github.com/zegl/kube-score/
GO111MODULE=on go install github.com/zegl/kube-score/cmd/kube-score

Checks

Container limits (should be set)
Container image tag (should not be :latest)
Container image pull policy (should be Always)
Pod is targeted by a NetworkPolicy, both egress and ingress rules are recommended
Container probes, both readiness and liveness checks should be configured, and should not be identical
Container securityContext, run as high number user/group, do not run as root or with privileged root fs
Stable APIs, use a stable API if available (supported: Deployments, StatefulSets, DaemonSet)

Example output

Usage in CI

kube-score can run in your CI/CD environment and will exit with exit code 1 if a critical error has been found. The trigger level can be changed to warning with the --exit-one-on-warning argument.

The input to kube-score should be all applications that you deploy to the same namespace for the best result.

Example with Helm

helm template my-app | kube-score -

Example with static yamls

kube-score my-app/*.yaml

kube-score my-app/deployment.yaml my-app/service.yaml

Configuration

Usage: kube-score [--flag1 --flag2] file1 file2 ...

Use "-" as filename to read from STDIN.

Usage of ./kube-score:
  -exit-one-on-warning
    	Exit with code 1 in case of warnings
  -help
    	Print help
  -v	Verbose output

Recommend