A security inspection tool for managed Kubernetes clusters that identifies common misconfigurations via Docker container and web UI.
MKIT is a Managed Kubernetes Inspection Tool that identifies security misconfigurations in managed Kubernetes clusters and their workloads. It runs from a Docker container to query cloud provider APIs and Kubernetes clusters, then displays results through a local web interface. The tool helps security-minded administrators quickly assess common security risks in their Kubernetes environments.
Kubernetes cluster administrators and security teams responsible for managed Kubernetes services (AKS, EKS, GKE) who need to identify security misconfigurations. It's particularly valuable for organizations running production workloads on cloud-managed Kubernetes.
Developers choose MKIT because it provides a unified, containerized tool that works across multiple cloud providers without sending data externally. Unlike manual checks or disparate tools, MKIT offers a consistent security assessment workflow with an intuitive web interface for reviewing findings.
MKIT is a Managed Kubernetes Inspection Tool that validates several common security-related configuration settings of managed Kubernetes cluster objects and the workloads/resources running inside the cluster.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Supports AKS, EKS, and GKE out of the box, allowing administrators to use a single tool across major cloud providers without switching between different utilities.
Inspects both managed cluster configurations via cloud APIs and internal Kubernetes workloads, providing a holistic view of security risks as highlighted in the README's dual-check approach.
Runs entirely from a local Docker container, ensuring easy deployment, isolation, and that all results remain internal without external data sharing, prioritizing security.
Launches a local web interface at localhost:8000 to visually navigate and filter security findings, making it accessible without command-line expertise.
Lacks support for Azure AD authentication with AKS-Engine clusters, requiring workarounds like using 'az aks get-credentials', as admitted in the README.
Requires exporting multiple cloud provider credentials as environment variables (e.g., AWS_ACCESS_KEY_ID, AZURE_CLIENT_SECRET), which is error-prone and cumbersome for automated pipelines.
All results are stored only within the container during the run, with no built-in options for saving, exporting, or long-term retention, limiting audit trails.
Relies on external Chef InSpec profiles; customizing or updating checks requires forking repositories and rebuilding the container, adding overhead for tailored assessments.