KubeSentinel 🛡️

Kubernetes Security Scanner - Detect security vulnerabilities and misconfigurations in your K8s clusters.

Overview

KubeSentinel is a production-ready CLI tool that scans Kubernetes clusters for security issues including:

• Privileged containers
• Dangerous capabilities (SYS_ADMIN, NET_ADMIN, etc.)
• Host namespace access (hostPID, hostNetwork, hostIPC)
• Missing resource limits
• RBAC misconfigurations

Installation

From Binary

# Linux
curl -sL https://github.com/dablon/kubesentinel/releases/download/v1.0.0/kubesentinel-linux-amd64 -o kubesentinel
chmod +x kubesentinel

# macOS
curl -sL https://github.com/dablon/kubesentinel/releases/download/v1.0.0/kubesentinel-darwin-amd64 -o kubesentinel

# Windows
curl -sL https://github.com/dablon/kubesentinel/releases/download/v1.0.0/kubesentinel-windows-amd64.exe -o kubesentinel.exe

From Source

go install github.com/dablon/kubesentinel@latest

Usage

Scan All Namespaces

kubesentinel scan

Scan Specific Namespace

kubesentinel scan -n production

Filter by Severity

kubesentinel scan -s critical  # Only critical issues
kubesentinel scan -s high      # Critical + High
kubesentinel scan -s all       # All issues (default)

JSON Output

kubesentinel scan -o json

Example Output

=== KubeSentinel Security Scan ===
Cluster: my-cluster
Time: 2026-03-03T10:00:00Z

--- Summary ---
Total Issues: 8
  Critical: 1
  High: 3
  Medium: 2
  Low: 2
Scanned Pods: 15

--- Issues ---
🔴 [critical] Container nginx runs in privileged mode
   Namespace: production
   Resource: pod/nginx-prod
   Fix: Set privileged: false

🟠 [high] Container runs as root
   Namespace: production
   Fix: Set runAsNonRoot: true

Configuration

Environment Variables

• KUBECONFIG - Path to kubeconfig file (default: ~/.kube/config)

Flags

• -c, --config - Config file path
• -n, --namespace - Namespace to scan (default: all)
• -o, --output - Output format: text, json (default: text)
• -s, --severity - Severity filter: critical, high, medium, low, all (default: all)
• -v, --verbose - Verbose output

Docker

docker run --rm -v ~/.kube:/root/.kube:ro kubesentinel scan -n production

Features

• ✅ 100% Test Coverage
• ✅ Real security checks (not mocked)
• ✅ Severity-based filtering
• ✅ JSON output for automation
• ✅ Kubernetes-native operation
• ✅ Zero dependencies (static binary)

Architecture

┌─────────────┐     ┌──────────────┐     ┌─────────────┐
│   CLI       │────▶│   Scanner    │────▶│   Results   │
│  (Cobra)    │     │   Engine     │     │   Reporter  │
└─────────────┘     └──────────────┘     └─────────────┘

License

MIT License - See LICENSE file for details.