Skip to content

v0.1.0

Latest
Latest

Choose a tag to compare

View all tags
@heyimusa heyimusa released this 20 Jul 16:55
v0.1.0
ee2acd6

What this release does

kube-blast-radius explains the security impact of a before-to-after Kubernetes manifest change.

Included in v0.1.0

  • raw YAML, Kustomize, and Helm rendering inputs;
  • RBAC change analysis for Secret access, wildcard access, escalation verbs, resource-name widening, non-resource URLs, and new bindings;
  • workload hardening regression checks including privileged mode, host namespaces, hostPath, ServiceAccount changes, Linux capabilities, privilege escalation, and UID 0;
  • exposure changes for Service types/external IPs, Kubernetes Ingress, NetworkPolicy removal, and Traefik IngressRoute rules;
  • text and JSON output, with exit 1 for high-severity findings and 2 for invalid input/render failures.

Boundaries

This is an offline change analyzer, not a complete cluster security assessment. It does not access a Kubernetes cluster, kubeconfig, or Secret values. Render untrusted Helm/Kustomize inputs in an isolated sandbox.

Assets

  • kube-blast-radius-linux-amd64
  • kube-blast-radius-linux-amd64.sha256
Assets 4
Loading