kube-score — Static Analysis for Kubernetes Manifests

Introduction

kube-score is a command-line tool that analyzes Kubernetes YAML manifests and scores them against a set of best-practice checks. It catches common misconfigurations like missing resource limits, absent health probes, insecure security contexts, and anti-patterns in pod specifications. Integrating kube-score into CI pipelines helps teams prevent reliability and security issues before they reach the cluster.

What kube-score Does

• Validates Kubernetes manifests against reliability and security best practices
• Checks for missing CPU and memory resource requests and limits
• Verifies readiness and liveness probes are configured on containers
• Flags security risks like running as root, missing network policies, and privileged containers
• Scores manifests on a pass/warning/critical scale with actionable fix suggestions

Architecture Overview

kube-score parses Kubernetes YAML or JSON manifests into typed Go objects using the official Kubernetes API types. Each check is implemented as a function that inspects specific fields of the parsed objects and returns scored results. The tool reads from files or stdin, making it composable with Helm, Kustomize, and other template engines. Output formats include human-readable text, JSON, and CI-friendly scoring.

Self-Hosting & Configuration

• Install via go install, Homebrew (brew install kube-score), or download prebuilt binaries
• Run against any YAML file: kube-score score my-deployment.yaml
• Pipe Helm or Kustomize output: helm template . | kube-score score -
• Use --output-format ci for machine-readable output in CI pipelines
• Disable specific checks with --ignore-test flags when intentional exceptions exist

Key Features

• Opinionated checks derived from production Kubernetes operational experience
• Supports Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, Services, and more
• Composable with Helm, Kustomize, and any tool that outputs Kubernetes YAML
• CI-friendly exit codes (non-zero on critical findings) for automated gates
• Actively maintained with checks updated for recent Kubernetes API versions

Comparison with Similar Tools

• Polaris — Dashboard-focused with in-cluster scanning; kube-score is a CLI-first static analyzer
• KubeLinter — Similar static analysis by StackRox; kube-score has a simpler check set focused on reliability
• Datree — Policy enforcement with custom rules; kube-score provides built-in best-practice checks
• Kubescape — Broader security scanning including runtime; kube-score focuses on manifest-level analysis
• conftest — Generic OPA-based policy tool; kube-score provides Kubernetes-specific checks out of the box

FAQ

Q: Can I use kube-score in CI/CD pipelines? A: Yes. kube-score returns non-zero exit codes when critical issues are found, making it ideal for CI gates. Use --output-format ci for structured output.

Q: Does kube-score run inside my cluster? A: No. kube-score is a static analysis tool that reads YAML files. It does not connect to any Kubernetes cluster.

Q: Can I disable certain checks? A: Yes. Use --ignore-test followed by the check name to skip specific validations when you have intentional exceptions.

Q: Does kube-score work with Helm charts? A: Yes. Pipe the rendered Helm output: helm template my-chart | kube-score score -.

Sources

• https://github.com/zegl/kube-score
• https://kube-score.com/