kube-score

kube-score performs static code analysis on Kubernetes object definitions and returns a list of recommendations for making an application more secure and resilient. It looks at YAML files and rendered Helm charts before they are deployed, so problems are caught earlier than in a running cluster.

Its checks include setting container limits, applying NetworkPolicies for ingress and egress, adding PodDisruptionBudgets and host pod anti-affinity to Deployments and StatefulSets, configuring distinct readiness and liveness probes, using security contexts that avoid root and privileged filesystems, and preferring stable API versions. The full list is documented in the repository.

In CI it exits with code 1 when it finds a critical issue, and a flag lets it fail on warnings too. It is distributed as pre-built binaries for macOS, Linux and Windows, as a Docker image, through Homebrew and as a kubectl Krew plugin, and there is an online demo that runs in the browser. It is written in Go and licensed under MIT.