lint_manifests
Statically lint Kubernetes manifests to find security, resource, probe, exposure, and removed-API issues with rule IDs, line numbers, and concrete fixes—no cluster required.
Instructions
Lint Kubernetes manifests with rules K8S1001-K8S1040: missing resource requests/memory limit,
:latest or untagged images (and tag-only pins as info), privileged / allowPrivilegeEscalation /
root user / readOnlyRootFilesystem / capabilities, hostNetwork/hostPID/hostPath/docker.sock,
missing probes, replicas 1, no PodDisruptionBudget or NetworkPolicy, default namespace, secrets as
plain env values (name and length only, never the value), service account token, seccomp,
imagePullPolicy, LoadBalancer/NodePort exposure, CronJob settings, and removed/deprecated apiVersions
with the replacement and the release that dropped them. Each finding has a rule ID, severity,
file:line and a concrete fix. Cross-object checks are in check_references, RBAC in rbac_review.
Suppress with # kubelint-ignore: K8S1004 above a line. Nothing is applied to any cluster.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
| result | Yes |