Secure Kubernetes Manifests with cnspec

Scan Kubernetes manifests for security misconfigurations during development and in CI/CD pipelines.

Shift Kubernetes security left by scanning manifests before they ever reach a cluster. cnspec evaluates YAML manifests against the same policies you use on live clusters, so you can catch privilege escalations, missing resource limits, and other misconfigurations in pull requests and CI pipelines instead of in production.

This page is part of scanning your supply chain with cnspec. If you're new to cnspec, start with the Quickstart to install cnspec and run your first scan.

Prerequisites

To scan Kubernetes manifests with cnspec, you must have:

cnspec installed on your workstation
Kubernetes manifest files (.yml or .yaml) on your local system to scan

Scan a Kubernetes manifest

Run:

cnspec scan k8s MANIFESTFILE

For MANIFESTFILE, substitute the path to the manifest file you want to scan. For example, run:

cnspec scan k8s luna-postgres.yml

cnspec returns a report summarizing the scan results:

Show or hide example scan results

→ discover related assets for 1 asset(s)
Asset: (Kubernetes Manifest) K8s Manifest luna-postgres
-------------------------------------------------------

Passing:
✓ Cluster role bindings should not grant cluster-admin
✓ Roles and cluster roles should not use wildcard permissions
✓ Service accounts should not be bound to cluster-admin

Asset: (Kubernetes StatefulSet) luna/postgresql
-----------------------------------------------

Passing:
✓ Container should not mount the CRI-O socket
✓ Container should not run as a privileged container
✓ Container should request CPU
✓ Container should request memory
✓ Pod should not run with hostIPC
✓ Pod should not run with hostNetwork
✓ StatefulSets should not run in the default namespace

Failing:
✕ LOW (20):       Container should configure a livenessProbe
✕ LOW (20):       Container should configure a readinessProbe
✕ LOW (20):       Container should have a memory limit
✕ MEDIUM (60):    StatefulSet container image pull should be consistent
✕ HIGH (80):      Container should use an immutable root filesystem
✕ CRITICAL (100): Container should not allow privilege escalation
✕ CRITICAL (100): Container should not run as root

Scanned 3 assets

Kubernetes Manifest
  LOW (0):      K8s Manifest luna-postgres

Kubernetes Namespace
  CRITICAL (100):  luna

Kubernetes StatefulSet
  MEDIUM (60):  luna/postgresql

To see scan results in full detail, run:

cnspec scan k8s MANIFESTFILE -o full

To control the output format or send results to a file or CI system, read Report Results.

Learn more about testing Kubernetes

The same policies that scan your manifests also scan live clusters. To close the loop, read Secure Kubernetes Clusters with cnspec.
To scan Helm charts or Kustomize overlays instead of raw manifests, read Secure Helm Charts with cnspec and Secure Kustomize Overlays with cnspec.
To learn more about how the MQL query language works, read Write Effective MQL.
For a list of all the Kubernetes resources and fields you can query, read the Mondoo Kubernetes (K8s) Resource Pack Reference.

Secure Kubernetes Manifests with cnspec

Prerequisites

Scan a Kubernetes manifest

Learn more about testing Kubernetes

On this page