Static code analysis tool for Kubernetes YAML and Helm charts that provides recommendations to improve reliability and security.
kube-score is a static code analysis tool for Kubernetes object definitions (YAML files and Helm charts). It scans configurations to provide recommendations that improve application reliability, security, and production readiness, helping prevent downtime and bugs before deployment.
Kubernetes administrators, DevOps engineers, and platform teams who manage Kubernetes deployments and want to enforce best practices in their YAML configurations.
Developers choose kube-score because it offers a comprehensive, automated way to validate Kubernetes manifests against established best practices, integrates seamlessly into CI/CD pipelines, and provides clear, actionable feedback to harden deployments.
Kubernetes object analysis with recommendations for improved reliability and security. kube-score actively prevents downtime and bugs in your Kubernetes YAML and Charts. Static code analysis for Kubernetes.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Checks for critical issues like container resource limits, Pod security contexts, and NetworkPolicy targeting, as detailed in README_CHECKS.md, ensuring configurations align with production-ready standards.
Supports output formats like 'ci' and 'sarif' for easy parsing in pipelines, and provides examples for Helm, Kustomize, and static YAMLs, making automation straightforward.
Allows ignoring or enabling specific tests via command-line flags (e.g., --ignore-test) or annotations (e.g., kube-score/ignore), enabling tailored analysis without modifying source code.
Available as pre-built binaries, Docker images, Homebrew packages, and Krew plugins, as listed in the README, reducing setup time and increasing adoption across teams.
Enforces specific recommendations like avoiding NodePort services, which may not suit all use cases, forcing teams to rely on ignore annotations that can clutter manifests and reduce clarity.
Cannot detect runtime issues such as resource contention or misapplied network policies, as it only examines YAML definitions, leaving gaps that require supplemental monitoring tools.
Requires managing per-object annotations to suppress false positives or non-applicable checks, which can lead to configuration drift and increased complexity over time.