KubeLinter

https://github.com/stackrox/kube-linter
Admin
KubeLinter is a static analysis tool that analyzes Kubernetes YAML files, Helm charts, and Kustomize...
Tokens:16,546
Snippets:283
Trust Score:10
License:Apache-2.0
Update:1 month ago
Show doc for...
Tokens:
Raw
### Install KubeLinter using Go

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Install KubeLinter using the Go programming language. Ensure Go is installed on your system.

```bash
go install golang.stackrox.io/kube-linter/cmd/kube-linter@latest
```

--------------------------------

### Install KubeLinter using nix-shell

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Install KubeLinter using the nix-shell package manager.

```bash
nix-shell -p kube-linter
```

--------------------------------

### Install KubeLinter using Homebrew

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Install KubeLinter using Homebrew on macOS or LinuxBrew for Linux systems.

```bash
brew install kube-linter
```

--------------------------------

### Install KubeLinter using Docker

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Pull the latest KubeLinter Docker image.

```bash
docker pull stackrox/kube-linter:latest
```

--------------------------------

### KubeLinter Output Example

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

This is an example of the output generated by KubeLinter when linting a pod specification file. It highlights security and production readiness issues.

```text
pod.yaml: (object: <no namespace>/security-context-demo /v1, Kind=Pod) The container "sec-ctx-demo" is using an invalid container image, "busybox". Please use images that are not blocked by the `BlockList` criteria : [".*:(latest)$"] (check: latest-tag, remediation: Use a container image with a specific tag other than latest.)

pod.yaml: (object: <no namespace>/security-context-demo /v1, Kind=Pod) container "sec-ctx-demo" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in the container securityContext.)

pod.yaml: (object: <no namespace>/security-context-demo /v1, Kind=Pod) container "sec-ctx-demo" has memory limit 0 (check: unset-memory-requirements, remediation: Set memory limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)

Error: found 3 lint errors

```

--------------------------------

### CI Integration: JSON and SARIF to Files

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Example for CI integration, generating both JSON and SARIF reports to specified files, using a configuration file, and linting a directory.

```bash
kube-linter lint \
  --format json --output build/kube-linter.json \
  --format sarif --output build/kube-linter.sarif \
  --config .kube-linter.yaml \
  deployments/
```

--------------------------------

### KubeLinter Helm Chart Linting Output Example

Source: https://github.com/stackrox/kube-linter/blob/main/docs/README.md

This is an example of the output you might see when KubeLinter runs checks on a Helm chart. It highlights potential issues such as missing read-only root file systems, non-root user configurations, and unset CPU requirements.

```text
helm-chart-sample/helm-chart-sample/templates/tests/test-connection.yaml: (object: <no namespace>/test-release-helm-chart-sample-test-connection /v1, Kind=Pod) container "wget" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in your container's securityContext.)

helm-chart-sample/helm-chart-sample/templates/tests/test-connection.yaml: (object: <no namespace>/test-release-helm-chart-sample-test-connection /v1, Kind=Pod) container "wget" is not set to runAsNonRoot (check: run-as-non-root, remediation: Set runAsUser to a non-zero number, and runAsNonRoot to true, in your pod or container securityContext. See https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for more details.)

helm-chart-sample/helm-chart-sample/templates/tests/test-connection.yaml: (object: <no namespace>/test-release-helm-chart-sample-test-connection /v1, Kind=Pod) container "wget" has cpu request 0 (check: unset-cpu-requirements, remediation: Set your container's CPU requests and limits depending on its requirements. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for more details.)

... 

Error: found 12 lint errors
```

--------------------------------

### Verify KubeLinter Image with Cosign Key

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Verify the KubeLinter image using cosign and the provided public key. Ensure cosign is installed and the IMAGE_NAME environment variable is set.

```shell
cosign verify --key kubelinter-cosign $IMAGE_NAME
```

--------------------------------

### Verify KubeLinter Version

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Check the installed KubeLinter version after building from source.

```bash
.gobin/kube-linter version
```

--------------------------------

### Unsafe Sysctls Configuration Example

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This snippet shows an example configuration for the 'unsafe-sysctls' check, listing specific sysctl values that are considered unsafe and should be avoided.

```yaml
unsafeSysCtls:
- kernel.msg
- kernel.sem
- kernel.shm
- fs.mqueue.
- net.
```

--------------------------------

### Verify KubeLinter Image with Cosign Key

Source: https://github.com/stackrox/kube-linter/blob/main/docs/README.md

Verify the KubeLinter image using a public key and cosign. Ensure you have cosign installed and the KubeLinter public key.

```shell
cat kubelinter-cosign.pub
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEl0HCkCRzYv0qH5QiazoXeXe2qwFX
DmAszeH26g1s3OSsG/focPWkN88wEKQ5eiE95v+Z2snUQPl/mjPdvqpyjA==
-----END PUBLIC KEY-----


cosign verify --key kubelinter-cosign $IMAGE_NAME
```

--------------------------------

### Verify KubeLinter Image with Cosign Keyless Signatures

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Verify the KubeLinter image using cosign keyless signatures. Note: Keyless signatures are not production-ready. Ensure cosign is installed and the IMAGE_NAME environment variable is set.

```shell
# NOTE: Keyless signatures are NOT PRODUCTION ready.

COSIGN_EXPERIMENTAL=1 cosign verify $IMAGE_NAME
```

--------------------------------

### Custom Check with Remediation Message

Source: https://github.com/stackrox/kube-linter/blob/main/docs/configuring-kubelinter.md

Configure a custom check to include a specific remediation message when the check fails. This message guides users on how to resolve the issue.

```yaml
customChecks:
  - name: required-annotation-responsible
    template: required-annotation
    params:
      key: company.io/responsible
  remediation: Please set the annotation 'company.io/responsible'. This will be parsed by xy to generate some docs.
```

--------------------------------

### Build KubeLinter from Source

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Compile the KubeLinter source code to generate binary files. This command places binaries in the .gobin folder.

```bash
make build
```

--------------------------------

### View KubeLinter Help Information

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Use the --help option to retrieve CLI reference information for KubeLinter. This includes available resources, commands, and their respective options.

```bash
kube-linter --help
```

```bash
kube-linter checks --help
```

```bash
kube-linter lint --help
```

--------------------------------

### Run Go Unit Tests for KubeLinter

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Execute the Go unit tests for KubeLinter.

```bash
make test
```

--------------------------------

### Create a Helm Chart

Source: https://github.com/stackrox/kube-linter/blob/main/docs/README.md

Use this command to create a new Helm chart for testing.

```bash
helm create helm-chart-sample
```

--------------------------------

### Download KubeLinter Binary for CI

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Use these commands to download the latest KubeLinter binary release for use in your CI pipeline. This involves fetching the latest tag, downloading the Linux tarball, and extracting it.

```bash
LOCATION=$(curl -s https://api.github.com/repos/stackrox/kube-linter/releases/latest \
| jq -r '.tag_name
    | "https://github.com/stackrox/kube-linter/releases/download/\(.)/kube-linter-linux.tar.gz"')
curl -L -o kube-linter-linux.tar.gz $LOCATION
mkdir kube-linter/
tar -xf kube-linter-linux.tar.gz -C "kube-linter/"
```

--------------------------------

### Run KubeLinter with Docker

Source: https://github.com/stackrox/kube-linter/blob/main/docs/README.md

Run KubeLinter using Docker to lint YAML files. Mount your local files and configuration into the container. The `--config` flag is optional.

```bash
docker run -v /path/to/files/you/want/to/lint:/dir -v /path/to/config.yaml:/etc/config.yaml stackrox/kube-linter lint /dir --config /etc/config.yaml
```

--------------------------------

### Lint Kustomize Directory

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Run KubeLinter on a Kustomize project by providing the path to the directory containing kustomization.yaml. KubeLinter automatically detects and renders Kustomize manifests.

```bash
kube-linter lint /path/to/directory/containing/kustomization.yaml
```

--------------------------------

### Lint YAML File with KubeLinter

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Run KubeLinter to analyze a specified YAML file for security and production readiness best practices. Provide the path to your YAML file.

```bash
kube-linter lint /path/to/your/yaml.yaml
```

--------------------------------

### Add KubeLinter Binary to PATH

Source: https://github.com/stackrox/kube-linter/blob/main/docs/README.md

Optionally add the generated KubeLinter binary to your system's PATH. This allows you to run the `kube-linter` command from anywhere.

```bash
echo export PATH='"${PATH}:'"$(pwd)"/.gobin"'"
```

--------------------------------

### Access Application via Ingress

Source: https://github.com/stackrox/kube-linter/blob/main/tests/testdata/mychart/templates/NOTES.txt

If Ingress is enabled, this snippet shows how to construct the application URL using defined hosts and paths.

```go-template
{{- if .Values.ingress.enabled }}
{{- range $host := .Values.ingress.hosts }}
  {{- range .paths }}
  http{{ if $.Values.ingress.tls }}s{{ end }}://{{ $host.host }}{{ . }}
  {{- end }}
{{- end }}
{{- end }}
```

--------------------------------

### Run End-to-End Integration Tests for KubeLinter

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Execute the end-to-end integration tests for KubeLinter.

```bash
make e2e-test
```

--------------------------------

### Lint with SARIF Output to File

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Run KubeLinter and write the results in SARIF format to a specified file.

```bash
kube-linter lint --format sarif --output results.sarif myapp.yaml
```

--------------------------------

### Lint Kubernetes YAML Files

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Run KubeLinter on a single Kubernetes YAML file.

```bash
kube-linter lint /path/to/yaml-file.yaml
```

--------------------------------

### KubeLinter Command Syntax

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

General syntax for running KubeLinter commands. Resources, commands, and options can be specified to control KubeLinter's behavior.

```bash
kube-linter [resource] [command] [options]
```

--------------------------------

### Run End-to-End Integration Tests with bats-core

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Execute the end-to-end integration tests for KubeLinter using bats-core.

```bash
make e2e-bats
```

--------------------------------

### Run All Default Checks in KubeLinter

Source: https://github.com/stackrox/kube-linter/blob/main/docs/configuring-kubelinter.md

Set `addAllBuiltIn` to `true` in the `checks` section of your KubeLinter configuration file to run all built-in checks. The equivalent CLI flag is `--add-all-built-in`.

```yaml
checks:
  addAllBuiltIn: true
```

--------------------------------

### Specify KubeLinter Configuration File

Source: https://github.com/stackrox/kube-linter/blob/main/docs/configuring-kubelinter.md

Use the `--config` flag to specify a custom KubeLinter configuration file. If no config file is provided, KubeLinter searches for `.kube-linter.yaml` or `.kube-linter.yml` in the current directory, or uses defaults if none are found.

```bash
# specific config file
kube-linter lint pod.yaml --config kubelinter-config.yaml

# will search for config based on the above order or will load defaults
kube-linter lint pod.yaml
```

--------------------------------

### Lint a Helm Chart with KubeLinter

Source: https://github.com/stackrox/kube-linter/blob/main/docs/README.md

Run KubeLinter on a Helm chart by providing the path to the directory containing the Chart.yaml file. This command initiates the linting process for the specified Helm chart.

```bash
kube-linter lint helm-chart-sample/
```

--------------------------------

### Multiple Output Formats to Multiple Files

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Generate reports in multiple formats (SARIF, JSON, plain text) and write each to a separate file in a single KubeLinter run. Flags are paired by position.

```bash
kube-linter lint \
  --format sarif --output kube-linter.sarif \
  --format json --output kube-linter.json \
  --format plain --output kube-linter.txt \
  myapp.yaml
```

--------------------------------

### Lint Helm Chart Directory

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Run KubeLinter on a Helm chart by providing the path to the directory containing Chart.yaml.

```bash
kube-linter lint /path/to/directory/containing/Chart.yaml-file/
```

--------------------------------

### Lint Directory of Kubernetes YAML Files

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Run KubeLinter on all Kubernetes YAML files within a specified directory.

```bash
kube-linter lint /path/to/directory/containing/yaml-files/
```

--------------------------------

### Lint Kubernetes Pod Specification with KubeLinter

Source: https://github.com/stackrox/kube-linter/blob/main/docs/README.md

Lint a Kubernetes pod specification file using the KubeLinter CLI. This command will report security and production readiness issues.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: busybox
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
    command: [ "sh", "-c", "sleep 1h" ]
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:
      allowPrivilegeEscalation: false

```

```bash
kube-linter lint pod.yaml
```

```text
pod.yaml: (object: <no namespace>/security-context-demo /v1, Kind=Pod) container "sec-ctx-demo" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in your container's securityContext.)

pod.yaml: (object: <no namespace>/security-context-demo /v1, Kind=Pod) container "sec-ctx-demo" has cpu limit 0 (check: unset-cpu-requirements, remediation: Set your container's CPU requests and limits depending on its requirements. See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for more details.)

pod.yaml: (object: <no namespace>/security-context-demo /v1, Kind=Pod) container "sec-ctx-demo" has memory limit 0 (check: unset-memory-requirements, remediation: Set your container's memory requests and limits depending on its requirements.    See https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for more details.)

Error: found 3 lint errors

```

--------------------------------

### Clone KubeLinter Repository

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Clone the KubeLinter source code repository from GitHub.

```bash
git clone git@github.com:stackrox/kube-linter.git
```

--------------------------------

### KubeLinter GitHub Action Configuration

Source: https://github.com/stackrox/kube-linter/blob/main/docs/README.md

Configure the KubeLinter GitHub Action to scan YAML files. Specify the directory containing the files and an optional configuration file path.

```yaml
- name: Scan yamls
  id: kube-lint-scan
  uses: stackrox/kube-linter-action@v1
  with:
    directory: yamls
    config: .kube-linter/config.yaml
```

--------------------------------

### Lint with JSON Output to Stdout

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Run KubeLinter and output the results in JSON format directly to standard output. This is the backward-compatible default behavior when only one format is specified.

```bash
kube-linter lint --format json myapp.yaml
```

--------------------------------

### Access Application via ClusterIP and Port-Forward

Source: https://github.com/stackrox/kube-linter/blob/main/tests/testdata/mychart/templates/NOTES.txt

For ClusterIP service types, this snippet retrieves the pod name and container port, then sets up port-forwarding to access the application locally.

```bash
export POD_NAME=$(kubectl get pods --namespace {{ .Release.Namespace }} -l "app.kubernetes.io/name={{ include "mychart.name" . }},app.kubernetes.io/instance={{ .Release.Name }}" -o jsonpath="{.items[0].metadata.name}")
export CONTAINER_PORT=$(kubectl get pod --namespace {{ .Release.Namespace }} $POD_NAME -o jsonpath="{.spec.containers[0].ports[0].containerPort}")
echo "Visit http://127.0.0.1:8080 to use your application"
kubectl --namespace {{ .Release.Namespace }} port-forward $POD_NAME 8080:$CONTAINER_PORT
```

--------------------------------

### Generate Multiple KubeLinter Output Formats

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Use this command to generate reports in multiple formats (SARIF and JSON) simultaneously. This improves efficiency by processing files only once. Explicit --output flags are required for multiple formats.

```bash
kube-linter lint \
  --format sarif --output kube-linter.sarif \
  --format json --output kube-linter.json \
  --config .kube-linter.yaml \
  pod.yaml

```

--------------------------------

### Minimum Replicas Configuration

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This check flags deployments using fewer than the specified minimum number of replicas, which is 3 by default. To improve fault tolerance, increase the replica count.

```yaml
minReplicas: 3
```

--------------------------------

### Display KubeLinter Public Key

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Display the KubeLinter public key used for image verification with cosign.

```shell
cat kubelinter-cosign.pub
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEl0HCkCRzYv0qH5QiazoXeXe2qwFX
DmAszeH26g1s3OSsG/focPWkN88wEKQ5eiE95v+Z2snUQPl/mjPdvqpyjA==
-----END PUBLIC KEY-----
```

--------------------------------

### Access Application via LoadBalancer

Source: https://github.com/stackrox/kube-linter/blob/main/tests/testdata/mychart/templates/NOTES.txt

For LoadBalancer service types, this snippet shows how to retrieve the LoadBalancer IP and construct the application URL. It also includes a note about potential delays in IP availability.

```bash
NOTE: It may take a few minutes for the LoadBalancer IP to be available.
      You can watch the status of by running 'kubectl get --namespace {{ .Release.Namespace }} svc -w {{ include "mychart.fullname" . }}'
export SERVICE_IP=$(kubectl get svc --namespace {{ .Release.Namespace }} {{ include "mychart.fullname" . }} --template "{{ range (index .status.loadBalancer.ingress 0) }}{{.}}{{ end }}")
echo http://$SERVICE_IP:{{ .Values.service.port }}
```

--------------------------------

### Lint a Pod Specification File

Source: https://github.com/stackrox/kube-linter/blob/main/README.md

Use this command to lint a Kubernetes pod specification file. Ensure the YAML content is saved to 'pod.yaml' before running.

```yaml
apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: busybox
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
    command: [ "sh", "-c", "sleep 1h" ]
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:
      allowPrivilegeEscalation: false

```

```bash
kube-linter lint pod.yaml
```

--------------------------------

### Exclude Specific Checks in KubeLinter

Source: https://github.com/stackrox/kube-linter/blob/main/docs/configuring-kubelinter.md

Use `addAllBuiltIn: true` along with the `exclude` key to run most checks but skip specified ones. `exclude` takes precedence over `include` if both are used.

```yaml
checks:
  addAllBuiltIn: true
  exclude:
    - "unset-cpu-requirements"
    - "unset-memory-requirements"
```

--------------------------------

### Update Release Notes Compare Link

Source: https://github.com/stackrox/kube-linter/blob/main/RELEASE.md

When publishing release notes, ensure the compare link accurately reflects the new release version. This helps users see the changes between versions.

```text
https://github.com/stackrox/kube-linter/compare/0.3.0...<new.release.version>
```

--------------------------------

### Configure Minimum Replicas for No Anti-Affinity Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This parameter specifies the minimum number of replicas a deployment must have for the 'no-anti-affinity' check to be enforced. Ensure this value aligns with your deployment's scaling strategy.

```yaml
minReplicas: 2
```

--------------------------------

### Error Case: Mismatched Format and Output Counts

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Demonstrates an error scenario where the number of specified formats does not match the number of output files. This will result in an error message.

```bash
# This will fail with an error
kube-linter lint \
  --format json --format sarif \
  --output out.json \
  pod.yaml
```

--------------------------------

### Configure DNS Options

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This check alerts on deployments without specified dnsConfig options. Remediation involves specifying these options in your Pod specification.

```yaml
Key: ndots
Value: "2"
```

--------------------------------

### Create Release Tag

Source: https://github.com/stackrox/kube-linter/blob/main/RELEASE.md

Use this command to create a new git tag for a release. Ensure the tag does not have a 'v' prefix. This triggers automated workflows for building Docker images and uploading release assets.

```shell
git pull --tags
git checkout main
git tag <new.release.version> # NOTE: PLEASE DO NOT USE THE PREFIX "v" FOR THE TAG!
git push origin <new.release.version>
```

--------------------------------

### Anti-affinity Not Specified Template Configuration

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/templates.md

Configure the 'anti-affinity' template to flag objects with multiple replicas where inter-pod anti-affinity is not specified. Parameters include the minimum replicas before enforcement and the topology key for anti-affinity.

```yaml
- description: The minimum number of replicas a deployment must have before anti-affinity
    is enforced on it
  name: minReplicas
  required: false
  type: integer
- description: The topology key that the anti-affinity term should use. If not specified, 
    it defaults to "kubernetes.io/hostname".
  name: topologyKey
  negationAllowed: true
  regexAllowed: true
  required: false
  type: string
```

--------------------------------

### Configure Sensitive Host Mounts Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

Define sensitive directories to monitor for host mounts. The `dirs` parameter accepts a list of regular expressions for directory paths.

```yaml
dirs:
- ^/$
- ^/boot$
- ^/dev$
- ^/etc$
- ^/lib$
- ^/proc$
- ^/sys$
- ^/usr$
```

--------------------------------

### Access Application via NodePort

Source: https://github.com/stackrox/kube-linter/blob/main/tests/testdata/mychart/templates/NOTES.txt

When the service type is NodePort, these commands retrieve the NodePort and Node IP to construct the application URL.

```bash
export NODE_PORT=$(kubectl get --namespace {{ .Release.Namespace }} -o jsonpath="{.spec.ports[0].nodePort}" services {{ include "mychart.fullname" . }})
export NODE_IP=$(kubectl get nodes --namespace {{ .Release.Namespace }} -o jsonpath="{.items[0].status.addresses[0].address}")
echo http://$NODE_IP:$NODE_PORT
```

--------------------------------

### Access to Resources Template Configuration

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/templates.md

Configure the 'access-to-resources' template to flag cluster role bindings and role bindings that grant access to specific resource kinds and verbs. Parameters include flagging roles not found in bindings, specifying resources via regex, and specifying verbs via regex.

```yaml
- description: Set to true to flag the roles that are referenced in bindings but not
    found in the context
  name: flagRolesNotFound
  required: false
  type: boolean
- arrayElemType: string
  description: An array of regular expressions specifying resources. e.g. ^secrets$ 
    for secrets and ^*$ for any resources
  name: resources
  negationAllowed: false
  regexAllowed: true
  required: false
  type: array
- arrayElemType: string
  description: An array of regular expressions specifying verbs. e.g. ^create$ for 
    create and ^*$ for any k8s verbs
  name: verbs
  negationAllowed: false
  regexAllowed: true
  required: false
  type: array
```

--------------------------------

### Include Specific Checks in KubeLinter

Source: https://github.com/stackrox/kube-linter/blob/main/docs/configuring-kubelinter.md

Use `doNotAutoAddDefaults: true` along with the `include` key to run only specified checks. This is useful for disabling most checks and enabling only a few.

```yaml
checks:
  doNotAutoAddDefaults: true
  include:
    - "privileged-container"
    - "run-as-non-root"
```

--------------------------------

### Add KubeLinter as a pre-commit Hook

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Configure KubeLinter to run automatically before each Git commit by adding this to your .pre-commit-config.yaml. Ensure you specify the desired KubeLinter version.

```yaml
  - repo: https://github.com/stackrox/kube-linter
    rev: 0.6.0 # kube-linter version 
    hooks:
        # You can change this to kube-linter-system or kube-linter-docker
      - id: kube-linter
```

--------------------------------

### Configure Disallowed API Group and Version for No Extensions/v1beta Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This parameter defines the group and version of deprecated APIs that the 'no-extensions-v1beta' check should flag. Use this to specify which API versions are considered outdated in your environment.

```yaml
group: extensions
version: v1beta.+
```

--------------------------------

### Verify Container Capabilities Configuration

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/templates.md

Configure forbidden and exception capabilities for containers. This is used to flag containers that do not match specific capability requirements.

```yaml
- arrayElemType: string
  description: List of capabilities that needs to be removed from containers.
  name: forbiddenCapabilities
  negationAllowed: false
  regexAllowed: false
  required: false
  type: array
- arrayElemType: string
  description: List of capabilities that are exceptions to the above list. This should
    only be filled when the above contains "all", and is used to forgive capabilities
    in ADD list.
  name: exceptions
  negationAllowed: false
  regexAllowed: false
  required: false
  type: array
```

--------------------------------

### CPU Requirements Configuration

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

Defines parameters for the unset-cpu-requirements check, specifying thresholds for CPU requests.

```yaml
lowerBoundMillis: 0
requirementsType: request
upperBoundMillis: 0
```

--------------------------------

### Lint YAML Files in CI Pipeline

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Execute KubeLinter within your CI pipeline to lint YAML files. Use the --fail-on-invalid-resource flag to ensure the pipeline fails if any YAML file is invalid.

```bash
./kube-linter/kube-linter lint --fail-on-invalid-resource /path/to/yaml-file.yaml
```

--------------------------------

### Configure Access to Pods Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This configuration specifies resources and verbs for the access-to-pods check. It's used to identify subjects with create access to pods and related resources.

```yaml
resources:
- ^pods$
- ^deployments$
- ^statefulsets$
- ^replicasets$
- ^cronjob$
- ^jobs$
- ^daemonsets$
verbs:
- ^create$
```

--------------------------------

### Configure Ports for Containers

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/templates.md

Flags containers exposing ports under protocols that match the supplied parameters. Use this to ensure specific protocols are used for exposed ports.

```yaml
- description: The port
  name: port
  required: false
  type: integer
- description: The protocol
  name: protocol
  negationAllowed: true
  regexAllowed: true
  required: false
  type: string
```

--------------------------------

### Error Case: Multiple Formats to Stdout

Source: https://github.com/stackrox/kube-linter/blob/main/docs/using-kubelinter.md

Illustrates an error scenario where multiple output formats are requested to stdout without specifying individual output files. This prevents unparseable mixed output.

```bash
# This will fail with an error (prevents unparseable mixed output)
kube-linter lint --format json --format plain pod.yaml
```

--------------------------------

### Configure SSH Port Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

Specify the port and protocol to check for SSH access. The `port` parameter defaults to 22 and `protocol` to TCP.

```yaml
port: 22
protocol: TCP
```

--------------------------------

### Configure Accepted Priority Class Names

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/templates.md

Flags applications running with invalid priority class names. Specify an array of accepted priority class names to enforce specific priority levels.

```yaml
- arrayElemType: string
  description: Array of all priority class names that are accepted.
  name: acceptedPriorityClassNames
  negationAllowed: false
  regexAllowed: false
  required: false
  type: array
```

--------------------------------

### Ignore Paths in KubeLinter

Source: https://github.com/stackrox/kube-linter/blob/main/docs/configuring-kubelinter.md

Specify paths to ignore using the `ignorePaths` field within the `checks` section. This uses the `**` match syntax for flexible path matching. The equivalent CLI flag is `--ignore-paths`.

```yaml
checks:
  ignorePaths:
    - ~/foo/bar/**
    - "**/*/foo/**"
    - ../baz/**
    - /tmp/*.yaml
```

--------------------------------

### Rolling Update Strategy Configuration

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This snippet shows the regex used to identify deployments that do not use a rolling update strategy. Ensure your deployment uses a rolling update strategy to avoid service disruption.

```yaml
strategyTypeRegex: ^(RollingUpdate|Rolling)$
```

--------------------------------

### Configure Required Annotation

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This YAML configuration specifies a required annotation 'email' and a regex pattern for its value. Use this to enforce the presence and format of specific annotations on Kubernetes objects.

```yaml
key: email
value: '[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z0-9-.]+'
```

--------------------------------

### Configure Schema Validation with Kubeconform

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

Set parameters for schema validation using kubeconform. `ignoreMissingSchemas` can be set to true to allow resources without schemas, and `strict` to enforce strict validation.

```yaml
ignoreMissingSchemas: true
strict: true
```

--------------------------------

### Memory Requirements Configuration

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

Defines parameters for the unset-memory-requirements check, specifying thresholds for memory requests and limits.

```yaml
lowerBoundMB: 0
requirementsType: limit
upperBoundMB: 0
```

--------------------------------

### Configure Sorted Keys Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

Enable recursive checking for sorted YAML keys. Set `recursive` to true to apply the check to nested structures.

```yaml
recursive: true
```

--------------------------------

### Manage Container Capabilities

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This check indicates when containers do not drop the NET_RAW capability. Remove this capability in container security contexts to enhance security.

```yaml
forbiddenCapabilities:
- NET_RAW
```

--------------------------------

### Configure Access to Secrets Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This configuration defines resources and verbs for the access-to-secrets check. It helps identify subjects with excessive permissions on secrets.

```yaml
resources:
- ^secrets$
verbs:
- ^get$
- ^list$
- ^delete$
- ^create$
- ^watch$
- ^*$
```

--------------------------------

### Kube-Linter duplicate-env-var Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This check identifies deployments that pass duplicate named environment variables. Ensure your DeploymentLike objects do not have duplicate environment variable names.

```yaml
apiVersion: kube-linter.io/v1alpha1
kind: KubeLinterConfig
checks:
  duplicate-env-var:
    enabled: true
```

--------------------------------

### Kube-Linter SCC Deny Privileged Container Parameter

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

Indicates that the SecurityContextConstraints has AllowPrivilegedContainer set to true. This is a dangerous setting and should be avoided.

```yaml
AllowPrivilegedContainer: true
```

--------------------------------

### Required Annotation Parameters

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/templates.md

Defines parameters for the 'required-annotation' check, specifying how to identify required annotations by key and optionally by value, supporting negation and regex.

```yaml
- description: Key of the required label.
  name: key
  negationAllowed: true
  regexAllowed: true
  required: true
  type: string
- description: Value of the required label.
  name: value
  negationAllowed: true
  regexAllowed: true
  required: false
  type: string
```

--------------------------------

### Default Service Account Usage Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

Identifies pods that are using the default service account. It is recommended to create dedicated service accounts for pods. This check uses a regex to match the default service account name.

```yaml
serviceAccount: ^(|default)$
```

--------------------------------

### Service Account Matching Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/templates.md

Flags containers that use a service account matching a specified regular expression. Supports negation for excluding specific service accounts.

```yaml
- description: A regex specifying the required service account to match.
  name: serviceAccount
  negationAllowed: true
  regexAllowed: true
  required: true
  type: string
```

--------------------------------

### Sorted Keys Check Configuration

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/templates.md

Flags YAML keys that are not sorted alphabetically. The 'recursive' parameter determines if the check applies to nested levels.

```yaml
- description: Recursive determines whether to check keys recursively at all nesting
    levels. Default is true.
  name: recursive
  required: false
  type: boolean
```

--------------------------------

### Kube-Linter Required Label Owner Parameter

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

Specifies the key for the owner label check. Ensure objects have an annotation with this key and an email address for the owner.

```yaml
key: owner
```

--------------------------------

### Define Custom Required Label Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/configuring-kubelinter.md

Configure a custom check using the `required-label` template to ensure a specific label exists on Kubernetes objects. Specify the label key in the `params` section.

```yaml
customChecks:
  - name: required-label-release
    template: required-label
    params:
      key: company.io/release
```

--------------------------------

### Kube-Linter exposed-services Check Configuration

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

Configure the exposed-services check to specify forbidden service types. This check alerts on services for forbidden types like NodePort or LoadBalancer.

```yaml
forbiddenServiceTypes:
- NodePort
- LoadBalancer
```

--------------------------------

### Define Custom Required Annotation Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/configuring-kubelinter.md

Configure a custom check using the `required-annotation` template to ensure a specific annotation exists on Kubernetes objects. Specify the annotation key in the `params` section.

```yaml
customChecks:
  - name: required-annotation-responsible
    template: required-annotation
    params:
      key: company.io/responsible
```

--------------------------------

### SecurityContextConstraints Allow Privileged Container Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/templates.md

Flags Security Context Constraints (SCCs) where 'allowPrivilegedContainer' is set to true. This check helps identify overly permissive SCC configurations.

```yaml
- description: allowPrivilegedContainer value
  name: allowPrivilegedContainer
  required: false
  type: boolean
```

--------------------------------

### Cluster Admin Role Binding Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This check, cluster-admin-role-binding, is designed to ensure the cluster-admin role is used only where necessary, aligning with CIS Benchmark 5.1.1.

```yaml
# No specific parameters shown for this check in the source.
```

--------------------------------

### Delete and Re-tag Git Tag

Source: https://github.com/stackrox/kube-linter/blob/main/RELEASE.md

If an incorrect tag is used, follow these steps to delete the published release, remove the incorrect tag locally and remotely, and then create a new, correct tag.

```shell
# Example commands for deleting and re-tagging (specific commands may vary based on git client version and setup)
# git tag -d <wrong.tag>
# git push origin --delete <wrong.tag>
# git tag <new.release.version>
# git push origin <new.release.version>
```

--------------------------------

### Kube-Linter env-value-from Check Configuration

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

Configure the env-value-from check to ignore specific ConfigMaps or Secrets. This check flags when objects use a secret or configmap not included in the deployment.

```yaml
IgnoredConfigMaps: []
IgnoredSecrets: []
```

--------------------------------

### Ignore Violations for Specific Objects

Source: https://github.com/stackrox/kube-linter/blob/main/docs/configuring-kubelinter.md

Add an annotation `ignore-check.kube-linter.io/<check-name>` to a Kubernetes object to ignore a specific check for that object. Provide an explanation as the annotation value. Use `kube-linter.io/ignore-all` to ignore all checks for an object.

```yaml
metadata:
  annotations:
    ignore-check.kube-linter.io/privileged-container: "This deployment needs to run as privileged because it needs kernel access"
```

--------------------------------

### Prevent Docker Socket Mount

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This check alerts on deployments that mount the docker.sock in containers. Ensure the Docker socket is not mounted to prevent container escape vulnerabilities.

```yaml
dirs:
- docker.sock$
```

--------------------------------

### Latest Tag Container Image Check

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

This check identifies when a deployment-like object uses a container image with the 'latest' tag. It is enabled by default. Remediation involves using a specific tag other than 'latest'.

```yaml
BlockList:
- ".*:(latest)$"
- "^[^"]*$"
- "(.*/[^"]*)$"
```

--------------------------------

### Custom Check with Object Scope

Source: https://github.com/stackrox/kube-linter/blob/main/docs/configuring-kubelinter.md

Define a custom check to ensure a specific annotation exists on all deployments. The `scope` parameter restricts the check to `DeploymentLike` object kinds.

```yaml
customChecks:
  - name: required-annotation-responsible
    template: required-annotation
    params:
      key: company.io/responsible
  scope:
    objectKinds:
      - DeploymentLike
```

--------------------------------

### Disable All Default Checks in KubeLinter

Source: https://github.com/stackrox/kube-linter/blob/main/docs/configuring-kubelinter.md

Set `doNotAutoAddDefaults` to `true` in the `checks` section of your KubeLinter configuration file to disable all built-in checks. The equivalent CLI flag is `--do-not-auto-add-defaults`.

```yaml
checks:
  doNotAutoAddDefaults: true
```

--------------------------------

### Kube-Linter env-var-secret Check Configuration

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/checks.md

Configure the env-var-secret check to flag environment variables matching a specific name pattern and having a value. This check indicates when objects use a secret in an environment variable, advising against raw secrets in environment variables.

```yaml
name: (?i).*secret.*
value: .+
```

--------------------------------

### Check for Unhealthy Pod Eviction Policy

Source: https://github.com/stackrox/kube-linter/blob/main/docs/generated/templates.md

Flags PodDisruptionBudget objects that do not explicitly set unhealthyPodEvictionPolicy. This check is relevant for PodDisruptionBudget objects.
Tokens:
Raw