Skip to content

SKILL.md

Latest commit

 

History

History
119 lines (85 loc) · 3.41 KB

SKILL.md

File metadata and controls

119 lines (85 loc) · 3.41 KB
Raw
name k8s-lint
description Kubernetes YAML validation - Use kube-linter and kubeconform to check K8s config security and best practices

Kubernetes Lint Skill

📋 Overview

This skill uses kube-linter and kubeconform for dual validation of Kubernetes YAML configurations, ensuring:

  • 🔒 Security (RBAC, Pod Security, NetworkPolicy)
  • ✅ Schema validation (K8s API spec compliance)
  • ⚡ Resource limit configuration
  • 🛡️ Best practices compliance

🔧 Prerequisites

Tool Purpose Windows Linux/Mac
kube-linter Best practices check scoop install kube-linter brew install kube-linter
kubeconform Schema validation scoop install kubeconform brew install kubeconform
kubectl (Optional) Cluster validation scoop install kubectl brew install kubectl

🚀 Usage

Check single file:

# Windows
.\.agents\skills\k8s-lint\scripts\lint.ps1 -File deployment.yaml

# Linux/Mac
./agent/skills/k8s-lint/scripts/lint.sh deployment.yaml

Check entire directory:

# Windows  
.\.agents\skills\k8s-lint\scripts\lint.ps1 -Path .\k8s -Recursive

# Linux/Mac
./.agents/skills/k8s-lint/scripts/lint.sh -r k8s/

🎯 What It Checks

Security Checks

  • ✅ Prohibit privileged containers
  • ✅ Prohibit hostNetwork/hostPID
  • ✅ Require readOnlyRootFilesystem
  • ✅ Run as non-root user
  • ✅ Capabilities whitelist

Resource Management

  • ✅ CPU/Memory limits set
  • ✅ liveness/readiness probes
  • ✅ Pod Disruption Budget
  • ✅ HPA configuration check

Best Practices

  • ✅ Image pull policy
  • ✅ Don't use latest tag
  • ✅ Service Account configuration
  • ✅ Label/Annotation standards

📊 Output Example

☸️  Kubernetes Lint - Checking config files...

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🔍 Schema Validation (kubeconform)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
✅ deployment.yaml - valid
✅ service.yaml - valid
❌ ingress.yaml - invalid: Missing required field: spec.rules

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
🛡️  Best Practices Check (kube-linter)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

deployment.yaml: (object: <no namespace>/nginx-deployment apps/v1, Kind=Deployment)
    ⚠️  no-read-only-root-fs: Container "nginx" does not have a read-only root file system
    ❌ cpu-requirements: Container "nginx" has no CPU limits
    ❌ memory-requirements: Container "nginx" has no memory limits

📊 Check Results:
   ❌ Errors: 3
   ⚠️  Warnings: 1

⚙️ Configuration

Create .kube-linter.yaml:

checks:
  exclude:
    - no-read-only-root-fs  # Temporarily allow writable root filesystem
  
  include:
    - cpu-requirements
    - memory-requirements
    - privileged-containers
    - run-as-non-root

customChecks: []

🔗 Related Resources