Skip to content
SPECIFICTION
Get listed

KubeLinter

github.com

Free plan macOSLinuxSelf-hosted
Visit github.com
Spec score 7.8 #14 of 27 in Kubernetes Security Software

What it is

KubeLinter is a free, open-source static analyzer for Kubernetes YAML files, Helm charts, and Kustomize manifests. It checks production-readiness and security practices, including non-root containers, least privilege, and keeping sensitive information in secrets. Users can enable or disable checks and create custom checks for organizational policies. Failed checks produce remediation recommendations and a non-zero exit code. KubeLinter can generate several output formats in one run, including SARIF and JSON, and supports pull request scanning. Documented installation methods include Go, release binaries, Homebrew or LinuxBrew, nix-shell, and Docker. Container images are signed with cosign, with a public verification key supplied. The project uses the Apache License 2.0 and lists no paid tiers. Its README identifies StackRox as creator and Red Hat as current maintainer. The README also warns that commands, flags, and configuration formats may change. The latest listed release is v0.8.3.

Spec sheet

Purpose
KubeLinter statically analyzes Kubernetes YAML files, Helm charts, and Kustomize manifests against best practices for production readiness and security.Read 4 Oct 2026 · github.com
License
KubeLinter is licensed under the Apache License 2.0.Read 4 Oct 2026 · github.com
Maker
The README says KubeLinter was created by StackRox and is now powered by Red Hat.Read 4 Oct 2026 · github.com
Community support
The project invites users to join its Slack workspace to engage with maintainers and other users.Read 4 Oct 2026 · github.com
Compatibility caveat
The README warns that command usage, flags, and configuration file formats may change in the future.Read 4 Oct 2026 · github.com
Custom checks
Users can enable or disable checks and create custom checks to match organizational policies.Read 4 Oct 2026 · github.com
Default checks
Default checks cover practices such as running containers as non-root, enforcing least privilege, and storing sensitive information only in secrets.Read 4 Oct 2026 · github.com
Install options
The project documents installation through Go, release binaries, Homebrew or LinuxBrew, nix-shell, and Docker.Read 4 Oct 2026 · github.com
Keyless verification
The README says keyless cosign signatures are not production ready.Read 4 Oct 2026 · github.com
Latest release
The latest release page opened for this research identifies version v0.8.3.Read 4 Oct 2026 · github.com
Lint feedback
When a check fails, KubeLinter reports remediation recommendations and returns a non-zero exit code.Read 4 Oct 2026 · github.com
Output formats
KubeLinter can generate multiple output formats in one run, including SARIF and JSON.Read 4 Oct 2026 · github.com
Signing
KubeLinter container images are signed with cosign, and the project provides a public key for verification.Read 4 Oct 2026 · github.com
Vulnerability reporting
The security policy directs confidential vulnerability reports to Red Hat's Product Security team.Read 4 Oct 2026 · github.com

Plans and prices

KubeLinter Free Apache License 2.0 · no paid tiers listed Read 4 Oct 2026 · github.com

Every KubeLinter plan and price →

Strong points and limits

Strong points

  • Analyzes YAML, Helm, and Kustomize manifests
  • Supports custom checks and policy controls
  • Returns remediation advice and non-zero failures
  • Outputs SARIF and JSON
  • Open source under Apache License 2.0

Limits

  • Terraform and CloudFormation analysis are unavailable
  • Command and configuration formats may change
  • Keyless cosign verification is not production ready
  • Latest listed release is v0.8.3

Who it suits

It suits teams reviewing Kubernetes manifests for security and production practices, including automated workflows. Custom policies make it relevant to organizations with their own checks.

Verdict

KubeLinter provides configurable Kubernetes-focused linting with machine-readable output and remediation guidance. Its scope is limited to Kubernetes analysis, and users should account for changing command and configuration formats.

Where Specifiction places it

Alternatives to KubeLinterAll alternatives →