Kubernetes YAML Security Scanner

Why a dedicated Kubernetes YAML scanner?

Most security failures in Kubernetes do not come from Kubernetes bugs — they come from manifests that were written in a hurry and never reviewed. A single privileged: true on a Pod effectively disables every isolation guarantee the kernel provides. A hostPath mount of /var/run/docker.sock is a container-escape on a platter. This scanner catches those classes before they land.

The 20 rules

• SF-K8S-001 – privileged: true (disables almost all isolation)
• SF-K8S-002 – hostNetwork: true (container shares the host's network namespace)
• SF-K8S-003 – hostPID: true (can see and signal host processes)
• SF-K8S-004 – hostIPC: true (shares host IPC — rarely justified)
• SF-K8S-005 – runAsUser: 0 or missing (container runs as root)
• SF-K8S-006 – allowPrivilegeEscalation: true or missing
• SF-K8S-007 – readOnlyRootFilesystem not set to true
• SF-K8S-008 – capabilities.add includes dangerous caps (SYS_ADMIN, NET_ADMIN, ALL)
• SF-K8S-009 – No capabilities.drop: [ALL] (principle of least privilege)
• SF-K8S-010 – Any hostPath volume
• SF-K8S-011 – hostPath mounts /, /etc, /var/run/docker.sock, or the Kubernetes API cert dir
• SF-K8S-012 – Missing resources.limits (runaway pods can exhaust nodes)
• SF-K8S-013 – Missing resources.requests
• SF-K8S-014 – Image uses :latest or has no tag
• SF-K8S-015 – imagePullPolicy: Always with a pinned tag (inefficient) or missing
• SF-K8S-016 – Uses the default ServiceAccount
• SF-K8S-017 – automountServiceAccountToken not explicitly set to false
• SF-K8S-018 – Secret inline in env (env:  - name: PASSWORD value: hardcoded)
• SF-K8S-019 – Missing livenessProbe / readinessProbe
• SF-K8S-020 – Missing explicit securityContext (informational)

What it does not do

This tool is a static YAML linter. It does not check your cluster's posture (RBAC, audit logs, admission controllers, NetworkPolicies, CNI settings), nor does it validate against a live Kubernetes API. For continuous, cluster-aware scanning across your organization, you need Security Factor 365's IaC Engine, which runs these rules plus 40+ others against every PR and posts a comment with blocking/non-blocking findings.

References

• Kubernetes Pod Security Standards (baseline, restricted)
• NIST SP 800-190 — Application Container Security Guide
• CIS Kubernetes Benchmark
• Container Security by Liz Rice, O'Reilly (2nd edition, Oct 2025) — Chapter 11 "Breaking Container Isolation"