Loading page content
Paste one Kubernetes resource or a whole multi-document file. Workloads are checked against the settings that decide whether a compromised container stays contained, and RBAC, Ingress, and Secret resources get their own checks.
SponsorThis spot is open to one DevOps or AI tooling company at a time. Ask about sponsoring
116 of 118 run entirely in your browser (Weather Widget uses Open-Meteo; What's My IP asks this site's server).
Share on XShare on LinkedInKubernetes defaults are permissive. A container with no securityContext may run as root, can gain privileges through setuid binaries, has a writable filesystem, and keeps a set of Linux capabilities it almost certainly does not use. None of that is visible in a manifest, because the problem is the lines that are missing. This checker reports the missing lines as well as the dangerous ones: privileged: true, hostNetwork, hostPID, hostPath volumes, and a mounted container runtime socket, each of which gives a pod a route to the node.
It also covers reliability settings that cause incidents rather than breaches. A container without memory limits can exhaust a node. One without requests is placed badly and evicted first. An image tagged latest can change between restarts, so a rollback may not bring back the old code. The checks follow the intent of the Kubernetes Pod Security Standards, but they read the YAML only. Enforce the same rules in the cluster with Pod Security Admission, Kyverno, or Gatekeeper, since a manifest check cannot stop someone applying something else.
Paste Kubernetes YAML, one resource or many separated by ---. Workloads are checked for privileged containers, root users, host access, plain-text secrets, unpinned images, and missing resource limits; RBAC, Ingress, and Secret resources get their own checks. Nothing leaves your browser.
Deployment/apiThe pod shares the node's network stack and can reach node-local services. Remove it unless this is a node agent.
Deployment/apiAccess to the runtime socket is root on the node: the pod can start privileged containers. Remove the mount.
Deployment/api · apiA privileged container has nearly the same access as root on the node. Remove privileged: true and add only the capabilities the process needs.
Deployment/api · apiDB_PASSWORD is written into the manifest. Reference a Secret with valueFrom.secretKeyRef instead.
Deployment/api · apiNothing stops the image from running as root. Set runAsNonRoot: true and a runAsUser.
Deployment/api · apimycompany/api:latest can change between pod restarts, so a rollback may not get the old code. Use an immutable version tag or a digest.
Deployment/api · apiWithout CPU and memory requests the scheduler cannot place the pod sensibly, and it is first to be evicted under pressure.
Deployment/api · apiA leak in this container can use all the memory on the node and take other pods down with it.
Deployment/apiThe pod gets an API token it probably does not use. Set automountServiceAccountToken: false, or give it a dedicated service account.
Deployment/apiThe resource lands in whatever namespace the applying context points at, often default. Set metadata.namespace, or apply it through Kustomize or Helm.
Deployment/apiA node drain or a crash takes the workload offline. Run at least two replicas with a PodDisruptionBudget if it serves traffic.
Deployment/api · apiSet readOnlyRootFilesystem: true and mount an emptyDir for the paths the process writes to.
Deployment/api · apiTraffic is sent to the pod as soon as the container starts, before the app can serve it.