GitHub - k8s-security-pro/k8s-audit: A fast, dependency-light Kubernetes security audit with kubectl and jq, mapped to the k8s-security.pro 50-point checklist. · GitHub
/" data-turbo-transient="true" />
Skip to content
Search/
Sign in<br>Sign upAppearance settings
You signed in with another tab or window. Reload to refresh your session.<br>You signed out in another tab or window. Reload to refresh your session.<br>You switched accounts on another tab or window. Reload to refresh your session.
Dismiss alert
{{ message }}
k8s-security-pro
k8s-audit
Public
Notifications<br>You must be signed in to change notification settings
Fork
Star
main
BranchesTags
Go to file
CodeOpen more actions menu
Latest commit
History<br>4 Commits<br>4 Commits
Folders and files<br>NameNameLast commit message<br>Last commit date<br>.github/workflows
.github/workflows
CONTRIBUTING.md
CONTRIBUTING.md
LICENSE
LICENSE
README.md
README.md
demo.svg
demo.svg
k8s-audit.sh
k8s-audit.sh
View all files
Repository files navigation
k8s-audit
A fast, dependency-light Kubernetes security audit you can run in one command.
k8s-audit runs a set of high-signal security checks against your current cluster<br>using only kubectl + jq, and prints a clean report grouped by security domain —<br>privileged containers, missing NetworkPolicies, over-broad RBAC, :latest images,<br>missing resource limits, and more.
It's read-only, sends nothing anywhere, and needs no install beyond a shell.
Why this exists
Everything in Kubernetes security is technically "free" — CIS Benchmark, kube-bench,<br>Kubescape, Trivy. But those tools flag hundreds of items and leave you to figure out<br>which ones matter and how to fix them. k8s-audit is the opinionated 30-second first<br>pass: ~16 checks that catch the most common real-world exposures, each mapped to<br>a specific item in the k8s-security.pro 50-point checklist.
It's built and maintained by the team behind k8s-security.pro —<br>a production hardening kit (50-point audit, 25 YAML templates, Helm chart, Kustomize<br>overlays, CIS & SOC2 mappings). This repo is the free, open-source front door to it.
Install
No install required — just clone and run:
git clone https://github.com/k8s-security-pro/k8s-audit.git<br>cd k8s-audit<br>./k8s-audit.sh
Requirements: kubectl (pointed at your cluster) and jq.
Usage
./k8s-audit.sh # audit all namespaces<br>./k8s-audit.sh -n payments # a single namespace<br>./k8s-audit.sh --json # machine-readable output (for CI / dashboards)
Exit code is non-zero if any FAIL -severity check trips — so you can gate CI on it.
Use it in CI
Drop this into .github/workflows/k8s-security-audit.yml to fail a PR that introduces<br>a privileged container or an unprotected namespace (full example in<br>.github/workflows/):
- name: Kubernetes security audit<br>run: |<br>curl -sSL https://raw.githubusercontent.com/k8s-security-pro/k8s-audit/main/k8s-audit.sh -o k8s-audit.sh<br>chmod +x k8s-audit.sh<br>./k8s-audit.sh
What it checks (16 of 50)
Domain<br>Check
Pod Security<br>Privileged containers
Pod Security<br>allowPrivilegeEscalation not disabled
Pod Security<br>Running as root (runAsNonRoot unset)
4b<br>Pod Security<br>readOnlyRootFilesystem not set
Pod Security<br>hostNetwork / hostPID / hostIPC
Pod Security<br>ServiceAccount token auto-mounted
Pod Security<br>Capabilities not dropped (ALL)
7b<br>Pod Security<br>Dangerous capabilities added (SYS_ADMIN, NET_ADMIN, …)
Pod Security<br>hostPath volumes mounted
Network<br>Namespaces without a NetworkPolicy (no default-deny)
14<br>RBAC<br>cluster-admin bindings
15<br>RBAC<br>Workloads using the default ServiceAccount
16<br>RBAC<br>Roles granting * verbs on * resources
20<br>Cluster Hardening<br>Workloads in the default namespace
22<br>Cluster Hardening<br>Containers without resource limits
28<br>Supply Chain<br>Images using :latest or untagged
Going deeper
k8s-audit deliberately stops at the high-signal dozen. For the complete picture:
The full 50-point audit + copy-paste remediation YAML, Helm chart, Kustomize<br>overlays, and CIS/SOC2 compliance mappings → k8s-security.pro
Deeper CIS/NSA scanning → kube-bench,<br>Kubescape, Trivy<br>(if these are on your PATH, k8s-audit points you at the right command).
Contributing
Issues and PRs welcome — especially new high-signal checks (keep them kubectl+jq<br>only, read-only, and mapped to a checklist domain). New to the project? Look for the<br>good first issue<br>label — each one is a small, self-contained check with the jq filter sketched out for you.<br>See CONTRIBUTING.md for how a check is structured.
License
MIT © k8s-security.pro
About<br>A fast, dependency-light Kubernetes security audit with kubectl and jq, mapped to the k8s-security.pro 50-point checklist.<br>k8s-security.pro<br>Topics<br>cis-benchmarkcloud-nativedevsecopshardeningkuberneteskubernetes-securitysecurity<br>Resources<br>Readme<br>MIT license<br>Contributing<br>Contributing<br>Activity<br>Stars<br>1 star<br>Watchers<br>0 watching<br>Forks<br>0 forks<br>Report repository
Releases
Packages
Contributors
Languages
You can’t perform that action at this time.