- Home
- Infrastructure Policy as Code Tools
- KubeLinter
KubeLinter
What it is
KubeLinter is a free, Apache License 2.0 tool for checking Kubernetes configuration. It statically analyzes Kubernetes YAML files, Helm chart directories, and Kustomize directories for best practices, production readiness, and security. Its built-in checks include non-root container execution, least-privilege enforcement, and keeping sensitive information in secrets. Teams can turn checks on or off and define additional checks with YAML configuration and CEL expressions. Failed checks produce remediation recommendations and a non-zero exit code. Reports are available as plain text, JSON, or SARIF, and one run can write multiple formats. The project documents pre-commit hooks, a Docker-based pre-commit hook, and a GitHub Action for CI. Installation options include Go, release binaries, Homebrew or LinuxBrew, nix-shell, and Docker. Container images are cosign-signed with a public verification key.
For and against
For
- Free plan under Apache License 2.0
- Checks Kubernetes, Helm, and Kustomize inputs
- Custom checks using YAML and CEL
- Plain text, JSON, and SARIF reports
- GitHub Action and pre-commit integrations
Against
- Command flags and configuration formats may change
- Requires configuration knowledge for custom policies
The verdict
KubeLinter focuses on static policy checks for common Kubernetes deployment formats. Its configurable checks, automation integrations, and machine-readable reports fit teams enforcing standards in development workflows.
Who it suits
KubeLinter suits teams managing Kubernetes, Helm, or Kustomize files who want configurable policy checks and CI reporting. It is available for Linux, macOS, and self-hosted use.
Plans and prices
KubeLinter
Apache License 2.0
Read 5 Oct 2026 · github.com
On the record
- Custom policies
- Users can enable or disable checks and create custom checks to match organizational policies.github.com · read 5 Oct 2026
- Default checks
- Its default checks cover issues such as running containers as non-root, enforcing least privilege, and storing sensitive information only in secrets.github.com · read 5 Oct 2026
- Findings
- When a lint check fails, KubeLinter reports remediation recommendations and returns a non-zero exit code.github.com · read 5 Oct 2026
- Image verification
- KubeLinter container images are signed with cosign, and the project provides a public key for verification.github.com · read 5 Oct 2026
- Input types
- KubeLinter can lint Kubernetes YAML files, Helm chart directories, and Kustomize directories.github.com · read 5 Oct 2026
- Installation
- The project documents installation using Go, release binaries, Homebrew or LinuxBrew, nix-shell, and Docker.github.com · read 5 Oct 2026
- Integrations
- The project documents use with pre-commit hooks, a Docker-based pre-commit hook, and a GitHub Action for CI.github.com · read 5 Oct 2026
- License
- KubeLinter is licensed under the Apache License 2.0.github.com · read 5 Oct 2026
- Maker
- The repository says KubeLinter was created by StackRox and is now powered by Red Hat.github.com · read 5 Oct 2026
- Notable limitation
- The project notes that command usage, flags, and configuration file formats may change in the future.github.com · read 5 Oct 2026
- Report formats
- It supports plain text, JSON, and SARIF output, including writing multiple formats in one run.github.com · read 5 Oct 2026
- Security reporting
- The security policy directs people reporting vulnerabilities to Red Hat's Product Security team for confidential disclosure.github.com · read 5 Oct 2026
- Support and community
- The project points users to its Slack workspace to engage with maintainers and other users.github.com · read 5 Oct 2026
- What it does
- KubeLinter statically analyzes Kubernetes YAML, Helm charts, and Kustomize manifests for best practices, production readiness, and security.github.com · read 5 Oct 2026
