Using KubeLinter to Lint Kubernetes YAML and Helm Charts for Production‑Readiness and Security

KubeLinter is an open‑source tool that analyzes Kubernetes YAML files and Helm charts to ensure they follow best practices, with a strong focus on production readiness and security.

Why Choose KubeLinter?

KubeLinter ships with sensible default checks but is fully configurable; you can enable or disable specific checks, create custom checks, and receive actionable remediation advice when a lint check fails, along with a non‑zero exit code to indicate problems.

Installation, Setup, and Getting Started

You can install KubeLinter via Go, Homebrew/LinuxBrew, or by building from source.

Using Go

go install golang.stackrox.io/kube-linter/cmd/kube-linter@latest

Using Homebrew (macOS) or LinuxBrew (Linux)

brew install kube-linter

Building from Source

# Clone the KubeLinter repository
git clone [email protected]:stackrox/kube-linter.git

# Build the binary
make build

# Verify the installation
.gobin/kube-linter version

KubeLinter provides unit tests, end‑to‑end integration tests, and tests using bats‑core to ensure reliability.

How to Use KubeLinter

Run KubeLinter against local YAML files or directories: kube-linter lint /path/to/your/yaml.yaml The output lists detected issues with remediation suggestions and a summary of lint errors. You can also lint Helm charts by pointing to the directory containing chart.yaml.

Example command for a Helm chart:

kube-linter lint /path/to/directory/containing/chart.yaml-file/

You can specify output format with --format=json or --format=sarif, and integrate KubeLinter as a pre‑commit hook:

- repo: https://github.com/stackrox/kube-linter
  rev: 0.6.0 # kube-linter version
  hooks:
    - id: kube-linter

Configuration

KubeLinter looks for a YAML configuration file (e.g., .kube-linter.yaml) in the current directory. If none is found, default checks are used. Configuration sections include customChecks for user‑defined checks and checks for default checks. You can disable all defaults with doNotAutoAddDefaults: true or enable all built‑in checks with addAllBuiltIn: true. Custom checks can be added like:

customChecks:
  - name: required-annotation-responsible
    template: required-annotation
    params:
      key: company.io/responsible

Conclusion

KubeLinter is still in an early alpha stage, so commands, flags, and configuration formats may change, but it is a valuable tool for testing Kubernetes manifests, identifying security and production‑readiness issues, and contributing to a more robust DevOps workflow.