Use Static Analysis of User Workloads

In this lesson we explain how to catch security misconfigurations in Kubernetes resource definition files before they ever reach the cluster. Static analysis examines manifests (YAML/JSON) as soon as they are written — before kubectl apply or any admission controller runs — enabling earlier feedback, faster remediation, and safer CI/CD pipelines.

A presentation slide titled "Static Analysis of User Workloads" with a dark blue curved panel on the right showing a white icon of scales and document sheets.

Why perform static analysis?

When a user submits a Pod creation request, the control plane and configured admission controllers may accept, mutate, or reject the request. However, by the time that happens the manifest has already been written and applied. Static analysis moves policy and security checks earlier into the development workflow so problems are found:

Immediately after the manifest is authored (IDE, editor, pre-commit).
During CI build and test stages (pull request validation).
Before any resource is pushed to the cluster.

This shift-left approach reduces the cost and risk of fixing security issues and enforces standards consistently across teams.

Example: a risky Pod manifest

Below is a simple Pod manifest that intentionally includes multiple security concerns:

apiVersion: v1
kind: Pod
metadata:
  name: sample-pod
spec:
  containers:
    - name: ubuntu
      image: ubuntu
      command: ["sleep", "3600"]
      securityContext:
        privileged: true
        runAsUser: 0
        capabilities:
          add: ["SYS_ADMIN"]
  volumes:
    - name: data-volume
      hostPath:
        path: /data
        type: Directory

Common security issues in this manifest:

privileged: true grants highly elevated privileges to the container and is generally high-risk.
runAsUser: 0 runs the process as root inside the container.
Adding capability SYS_ADMIN expands kernel-level permissions.
hostPath exposes the node filesystem to the Pod, enabling host-level access.

Static analysis tools flag these problems early so developers can fix them before deployment.

Static analysis helps catch misconfigurations and enforce policies before resources are submitted to the cluster, reducing the risk and cost of fixing issues later in the pipeline.

Typical findings, risk classification, and remediation

Setting / Finding	Risk Level	Example remediation
`privileged: true`	High	Remove `privileged` or require a Just-In-Time approval process; use PSP/PSA or OPA Gatekeeper to block.
`runAsUser: 0`	High	Set `runAsNonRoot: true` or pick a non-root UID with `runAsUser: <uid>`.
`capabilities: add: ["SYS_ADMIN"]`	High	Avoid adding powerful capabilities; use least-privilege; drop all capabilities then add explicitly required ones.
`hostPath` volumes	High	Replace with network-attached volumes (PVCs) or restrict `hostPath` usage via policy.
Missing resource limits	Medium	Define `resources.requests` and `resources.limits` for CPU/memory.
Image tag `latest` or unpinned image	Medium	Pin image digests or use immutable tags, and scan images for vulnerabilities.

Lightweight static analysis: kubesec

kubesec (https://kubesec.io) is a simple tool that scores Kubernetes manifests and explains findings. It provides a numeric score and detailed guidance for each issue it detects, which makes it easy to prioritize fixes. Ways to use kubesec:

Install the kubesec CLI and scan local files.
Use the publicly hosted API at https://v2.kubesec.io/scan.
Run a local kubesec HTTP server to integrate with local tooling.

Example commands:

# Scan a local file with the kubesec binary
$ kubesec scan pod.yaml

# Post the manifest to the public kubesec API and get analysis
$ curl -sSX POST --data-binary @"pod.yaml" https://v2.kubesec.io/scan

# Run a local kubesec HTTP server on port 8080 (background)
$ kubesec http 8080 &

When kubesec completes an analysis it lists issues, explains their significance, and returns a score that helps prioritize remediation. Integrate such checks into pre-commit hooks, CI pipelines, or IDE extensions so manifests are validated before being applied to a cluster.

Other useful static-analysis tools and integrations

Tool	Primary focus	Notes / Links
kube-linter	Policy and best-practice checks	Good for CI and PR checks — https://github.com/stackrox/kube-linter
kube-score	Scoring and suggestions	Focuses on Pod/Deployment best practices — https://github.com/zegl/kube-score
conftest	Policy testing with Rego	Use for custom policies and tests — https://www.conftest.dev/
OPA Gatekeeper / OPA	Admission-time enforcement using Rego policies	Enforces policies inside the cluster — https://www.openpolicyagent.org/

Where to integrate static analysis

Local development: editor/IDE plugins or pre-commit hooks (faster feedback).
Continuous Integration: block pull requests with failing checks.
Artifact scanning: validate rendered manifests from Helm, Kustomize, or templating pipelines.
Developer platforms: embed checks in self-service portals and developer onboarding.

Recommended workflow

Add static checks in the developer’s IDE and pre-commit hooks.
Fail builds in CI when critical issues are detected.
Enforce cluster-level policies with OPA Gatekeeper or similar admission controllers.
Continuously scan images and artifacts in your supply chain.

References

kubesec: https://kubesec.io
Open Policy Agent: https://www.openpolicyagent.org/
kube-linter: https://github.com/stackrox/kube-linter
kube-score: https://github.com/zegl/kube-score
conftest: https://www.conftest.dev/

That covers the essentials of static analysis for Kubernetes manifests and practical ways to adopt these checks across your development lifecycle.

Introduction

Understanding the Kubernetes Attack Surface

Cluster Setup and Hardening

System Hardening

Minimize Microservice Vulnerabilities

Supply Chain Security

Monitoring, Logging and Runtime Security

Use Static Analysis of User Workloads

Why perform static analysis?

Example: a risky Pod manifest

Typical findings, risk classification, and remediation

Lightweight static analysis: kubesec

Other useful static-analysis tools and integrations

Where to integrate static analysis

Recommended workflow

References

Watch Video

Practice Lab

​Why perform static analysis?

​Example: a risky Pod manifest

​Typical findings, risk classification, and remediation

​Lightweight static analysis: kubesec

​Other useful static-analysis tools and integrations

​Where to integrate static analysis

​Recommended workflow

​References

Watch Video

Practice Lab

Why perform static analysis?

Example: a risky Pod manifest

Typical findings, risk classification, and remediation

Lightweight static analysis: kubesec

Other useful static-analysis tools and integrations

Where to integrate static analysis

Recommended workflow

References