How to scan a Kubernetes deployment for security issues with kubectl-kubesec?

Use the command `kubectl kubesec-scan -n deployment `, which outputs a security score and specific advice like setting runAsNonRoot. For self-hosting, add `--url http://localhost:8080` after running the local Docker service.

kubectl-kubesec vs kube-bench: which is better for Kubernetes security?

kubectl-kubesec focuses on scanning resource configurations for misconfigurations like privileged containers, while kube-bench checks cluster-level compliance with CIS benchmarks. kubesec is more for workload security, kube-bench for infrastructure hardening.

Can kubectl-kubesec scan YAML files offline?

Yes, but indirectly; you need to apply the YAML to a cluster or use a mock environment. Self-hosting the kubesec service with Docker allows offline scanning by pointing to the local instance with the `--url` flag.

What types of security issues does kubectl-kubesec detect?

It identifies common misconfigurations such as running containers as root, excessive kernel capabilities, host network or PID sharing, and provides recommendations like readOnlyRootFilesystem and dropping ALL capabilities based on kubesec.io's rules.

How to install kubectl-kubesec on Windows?

The README doesn't specify Windows, but you can use the curl method adapted for Windows Subsystem for Linux or check for community builds. Installation via krew is cross-platform if krew is set up on Windows.

Is kubectl-kubesec free to use with the cloud service?

The hosted kubesec.io service is generally free, but usage terms and rate limits might apply; self-hosting is open-source and free, though it requires maintaining your own Docker instance and staying updated with API changes.

Open-Awesome

Kubectrl Kubesec

Apache-2.0Gov1.1.0

A kubectl plugin for security risk analysis of Kubernetes resources like pods, deployments, daemonsets, and statefulsets.

Visit Website GitHub

517 stars36 forks0 contributors

What is Kubectrl Kubesec?

kubectl-kubesec is a kubectl plugin that performs security risk analysis on Kubernetes resources. It scans pods, deployments, daemonsets, and statefulsets to identify security misconfigurations and provides actionable recommendations to improve security posture. The plugin integrates with the kubesec.io service to analyze resources and assign security scores.

Target Audience

Kubernetes administrators, DevOps engineers, and security teams who need to identify and fix security issues in their Kubernetes workloads before deployment.

Value Proposition

Developers choose kubectl-kubesec because it provides specific, actionable security advice directly within their kubectl workflow, supports both cloud and self-hosted scanning options, and helps prevent common security misconfigurations in Kubernetes resources.

Overview

Security risk analysis for Kubernetes resources

Use Cases

Best For

Scanning Kubernetes deployments for security vulnerabilities before applying them
Identifying security misconfigurations in production pods and daemonsets
Implementing DevSecOps practices in Kubernetes CI/CD pipelines
Self-hosting security scanning tools for air-gapped or private environments
Getting actionable security recommendations for hardening Kubernetes workloads
Integrating security analysis into existing kubectl workflows

Not Ideal For

Organizations requiring real-time, continuous security monitoring and alerting systems
Teams that need to scan all Kubernetes resource types, not just pods, deployments, daemonsets, and statefulsets
Environments with strict data privacy policies where even self-hosting is not feasible due to compliance constraints

Pros & Cons

Pros

Actionable Security Advice

Provides specific, actionable recommendations like enforcing runAsNonRoot and dropping capabilities, directly helping users fix security misconfigurations based on scan outputs.

Seamless Kubectl Integration

Installs as a kubectl plugin via krew or curl, allowing scans to be performed with familiar kubectl commands without leaving the CLI workflow.

Self-Hosted Option

Supports running kubesec locally with Docker, enabling use in air-gapped or private networks where cloud services are prohibited, as shown in the README examples.

Clear Risk Scoring

Assigns a numerical security score to each resource, making it easy to prioritize fixes based on the severity of issues identified, such as critical vs. advisory items.

Cons

Limited Resource Support

Only scans pods, deployments, daemonsets, and statefulsets, omitting other critical resources like services or configmaps that might have security implications.

Cloud Service Dependency

By default, sends scan data to the hosted kubesec.io service, which could raise privacy, security, and availability concerns for sensitive workloads unless self-hosted.

Manual and Ad-Hoc Nature

Requires manual execution for each scan, lacking built-in automation for continuous monitoring or seamless integration into existing security pipelines without additional scripting.

Frequently Asked Questions

Related Projects

Kube-Score

Kubernetes object analysis with recommendations for improved reliability and security. kube-score actively prevents downtime and bugs in your Kubernetes YAML and Charts. Static code analysis for Kubernetes.

Stars3,105

Forks205

Last commit5 months ago

Kubescape

Cloud Native Computing Foundation - An open-source Kubernetes security platform for your IDE, CI/CD pipelines, and clusters

Stars0

Forks0

Last commit

Community-curated · Updated weekly · 100% open source

Found a gem we're missing?

Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.

Submit a project Star on GitHub