Static analysis: kubesec, kube-linter, hadolint

Three tools, three jobs

kubesec

kubesec scan pod.yaml

[{"object":"Pod/web.prod","valid":true,"score":-30,
  "advise":[{"id":"runAsNonRoot","selector":"containers[] .securityContext .runAsNonRoot == true",
             "reason":"Force the running image to run as a non-root user"},
            {"id":"ReadOnlyRootFilesystem", "reason":"..."}]}]

A negative score means it is actively dangerous; advise is literally the list of
fixes. After hardening, the score goes positive. The exam answer is usually
"apply the advises the task lists and show the new score".

kube-linter

kube-linter lint pod.yaml
kube-linter lint deploy/ --add-all-built-in

Rules you will meet: run-as-non-root, read-only-root-fs, no-read-only-root-fs,
drop-net-raw-capability, privileged-container, privilege-escalation-container,
host-ipc, host-network, latest-tag, no-anti-affinity.

Exit code 1 with findings — in a task, "fix all findings" is the instruction.

hadolint

hadolint Dockerfile
# DL3007 warning: Using latest is prone to errors if the image will ever update
# DL3008 warning: Pin versions in apt get install
# DL3020 error:   Use COPY instead of ADD for files and folders
# DL4006 warning: Set the SHELL option -o pipefail before RUN with a pipe

Reading the fix, not the tool

The tools all point at the same five things. Learn the fixes and you do not need
the tools to be fast:

securityContext:
  runAsNonRoot: true
  runAsUser: 2000
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities: {drop: ["ALL"]}
  seccompProfile: {type: RuntimeDefault}

Conftest, if the cluster has it

conftest test pod.yaml -p policy/

Policy is Rego, same language as Gatekeeper — worth knowing that they are the
same skill, not two.

Traps

• latest tag: kube-linter fails it, hadolint warns about it, the exam usually asks you to pin a digest or a version.
• A Deployment needs the securityContext under spec.template.spec, not at the top of the Deployment. Both tools will report "no security context" and be right.
• Scores are not the answer; the marker checks the fields. Use the score to find the fields.