KubeLinterでKubernetesのマニフェストを静的解析

1brew install kube-linter

1kube-linter lint [file path]

1kube-linter checks list

1kube-linter templates list

1checks:
2  doNotAutoAddDefaults: true

1apiVersion: apps/v1
2kind: Deployment
3metadata:
4  name: web
5  labels:
6    app: web
7spec:
8  replicas: 1
9  selector:
10    matchLabels:
11      app: web
12  template:
13    metadata:
14      labels:
15        app: web
16    spec:
17      containers:
18      - name: nginx
19        image: nginx
20        ports:
21          - containerPort: 80

1❯ kube-linter lint deployment.yml
2KubeLinter 0.2.6
3
4deployment.yml: (object: <no namespace>/web apps/v1, Kind=Deployment) The container "nginx" is using an invalid container image, "nginx". Please use images that are not blocked by the `BlockList` criteria : [".*:(latest)$" "^[^:]*$" "(.*/[^:]+)$"] (check: latest-tag, remediation: Use a container image with a specific tag other than latest.)
5
6deployment.yml: (object: <no namespace>/web apps/v1, Kind=Deployment) container "nginx" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in the container securityContext.)
7
8deployment.yml: (object: <no namespace>/web apps/v1, Kind=Deployment) container "nginx" is not set to runAsNonRoot (check: run-as-non-root, remediation: Set runAsUser to a non-zero number and runAsNonRoot to true in your pod or container securityContext. Refer to https://kubernetes.io/docs/tasks/configure-pod-container/security-context/ for details.)
9
10deployment.yml: (object: <no namespace>/web apps/v1, Kind=Deployment) container "nginx" has cpu request 0 (check: unset-cpu-requirements, remediation: Set CPU requests and limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)
11
12deployment.yml: (object: <no namespace>/web apps/v1, Kind=Deployment) container "nginx" has cpu limit 0 (check: unset-cpu-requirements, remediation: Set CPU requests and limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)
13
14deployment.yml: (object: <no namespace>/web apps/v1, Kind=Deployment) container "nginx" has memory request 0 (check: unset-memory-requirements, remediation: Set memory requests and limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)
15
16deployment.yml: (object: <no namespace>/web apps/v1, Kind=Deployment) container "nginx" has memory limit 0 (check: unset-memory-requirements, remediation: Set memory requests and limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)
17
18Error: found 7 lint errors

1checks:
2  doNotAutoAddDefaults: true

1❯ kube-linter lint deployment.yml
2Warning: no checks enabled.

1apiVersion: apps/v1
2kind: Deployment
3metadata:
4  name: web
5  labels:
6    app: web
7spec:
8  replicas: 1
9  selector:
10    matchLabels:
11      app: web
12  template:
13    metadata:
14      labels:
15        app: web
16    spec:
17      containers:
18      - name: nginx
19        image: nginx:1.21
20        ports:
21          - containerPort: 80
22        securityContext:
23          runAsUser: 1000
24          runAsGroup: 3000
25          fsGroup: 2000
26          readOnlyRootFilesystem: true
27        resources:
28          requests:
29            memory: "64Mi"
30            cpu: "500m"
31          limits:
32            memory: "64Mi"
33            cpu: "500m"

1❯ kube-linter lint deployment.yml
2KubeLinter 0.2.6
3
4No lint errors found!