KubeLinter

KubeLinter runs static analysis on Kubernetes YAML files, Helm charts, and Kustomize manifests, checking them against best practices with a focus on production readiness and security. It helps teams catch misconfigurations early, including running containers as non-root, enforcing least privilege, and storing sensitive data only in secrets.

It runs sensible default checks and is fully configurable, so you can enable or disable checks or write custom ones for organization-specific policies. When a check fails, it reports recommendations for how to resolve the issue and returns a non-zero exit code, making it easy to wire into CI pipelines.

A single run can emit multiple output formats at once, such as SARIF for code-scanning tooling and JSON for machine processing. Install it from a release binary, with Homebrew, or pull the published container image for use in automated workflows.