Kubernetes Manifest Risk Analyzer

{
  "type": "json",
  "example": {
    "label": "paid-demo:risky-production-workload",
    "stats": {
      "low": 2,
      "high": 12,
      "medium": 2,
      "critical": 2,
      "findings": 18,
      "documents": 2,
      "workloads": 1,
      "containers": 1,
      "secret_value_paths_masked": 0
    },
    "profile": "restricted",
    "summary": "2 Kubernetes object(s), 1 workload(s), and 1 container(s) produced 18 finding(s): 2 critical, 12 high, 2 medium, 2 low.",
    "verdict": "BLOCK",
    "coverage": {
      "input_format": "parsed Kubernetes JSON objects",
      "cluster_contacted": false,
      "pod_security_profile": "restricted",
      "pod_security_standard": "Kubernetes Pod Security Standards",
      "secret_values_returned": false,
      "runtime_state_evaluated": false,
      "admission_plugins_evaluated": false,
      "container_registries_contacted": false
    },
    "findings": [
      {
        "code": "rbac_wildcard_permission",
        "path": "/rules/0",
        "message": "ClusterRole grants wildcard RBAC permissions.",
        "resource": "ClusterRole/default/payments-admin",
        "severity": "critical",
        "standard": "rbac-least-privilege",
        "remediation": "Replace wildcard verbs, resources, and URLs with the minimum required set."
      },
      {
        "code": "privileged_container",
        "path": "/spec/template/spec/containers/0/securityContext/privileged",
        "message": "Container api disables normal container isolation.",
        "resource": "Deployment/production/payments",
        "severity": "critical",
        "standard": "pod-security-baseline",
        "remediation": "Set privileged to false and grant only the specific capability required."
      },
      {
        "code": "literal_secret_environment_value",
        "path": "/spec/template/spec/containers/0/env/0/value",
        "message": "Container api embeds a secret-like environment variable as a literal value.",
        "resource": "Deployment/production/payments",
        "severity": "high",
        "standard": "secret-handling",
        "remediation": "Use valueFrom.secretKeyRef or an external secret provider."
      },
      {
        "code": "privilege_escalation_not_disabled",
        "path": "/spec/template/spec/containers/0/securityContext/allowPrivilegeEscalation",
        "message": "Container api does not explicitly disable privilege escalation.",
        "resource": "Deployment/production/payments",
        "severity": "high",
        "standard": "pod-security-restricted",
        "remediation": "Set securityContext.allowPrivilegeEscalation to false."
      },
      {
        "code": "disallowed_linux_capability",
        "path": "/spec/template/spec/containers/0/securityContext/capabilities/add",
        "message": "Container api adds capabilities outside the baseline allowlist.",
        "resource": "Deployment/production/payments",
        "severity": "high",
        "standard": "pod-security-baseline",
        "remediation": "Remove added capabilities and grant only an explicitly allowed capability."
      },
      {
        "code": "restricted_capability_added",
        "path": "/spec/template/spec/containers/0/securityContext/capabilities/add",
        "message": "Container api adds a capability forbidden by the Restricted profile.",
        "resource": "Deployment/production/payments",
        "severity": "high",
        "standard": "pod-security-restricted",
        "remediation": "Remove the capability; Restricted permits only NET_BIND_SERVICE."
      },
      {
        "code": "capabilities_not_dropped",
        "path": "/spec/template/spec/containers/0/securityContext/capabilities/drop",
        "message": "Container api does not drop all Linux capabilities.",
        "resource": "Deployment/production/payments",
        "severity": "high",
        "standard": "pod-security-restricted",
        "remediation": "Set capabilities.drop to [ALL], then add back only NET_BIND_SERVICE if needed."
      },
      {
        "code": "run_as_non_root_not_required",
        "path": "/spec/template/spec/containers/0/securityContext/runAsNonRoot",
        "message": "Container api is not required to run as a non-root user.",
        "resource": "Deployment/production/payments",
        "severity": "high",
        "standard": "pod-security-restricted",
        "remediation": "Set runAsNonRoot: true at the Pod or container level."
      },
      {
        "code": "runs_as_root",
        "path": "/spec/template/spec/containers/0/securityContext/runAsUser",
        "message": "Container api explicitly runs as UID 0.",
        "resource": "Deployment/production/payments",
        "severity": "high",
        "standard": "pod-security-restricted",
        "remediation": "Use a non-zero UID and set runAsNonRoot: true."
      },
      {
        "code": "seccomp_profile_missing",
        "path": "/spec/template/spec/containers/0/securityContext/seccompProfile",
        "message": "Container api lacks a Restricted-compatible seccomp profile.",
        "resource": "Deployment/production/payments",
        "severity": "high",
        "standard": "pod-security-restricted",
        "remediation": "Set seccompProfile.type to RuntimeDefault or an approved Localhost profile."
      },
      {
        "code": "unconfined_seccomp",
        "path": "/spec/template/spec/containers/0/securityContext/seccompProfile/type",
        "message": "Container api explicitly disables seccomp confinement.",
        "resource": "Deployment/production/payments",
        "severity": "high",
        "standard": "pod-security-baseline",
        "remediation": "Use RuntimeDefault or an approved Localhost seccomp profile."
      },
      {
        "code": "host_namespace_network",
        "path": "/spec/template/spec/hostNetwork",
        "message": "Pod shares the host Network namespace.",
        "resource": "Deployment/production/payments",
        "severity": "high",
        "standard": "pod-security-baseline",
        "remediation": "Remove hostNetwork: true unless this workload is explicitly isolated and approved."
      },
      {
        "code": "restricted_volume_type",
        "path": "/spec/template/spec/volumes/0",
        "message": "Volume type is outside the Restricted Pod Security allowlist.",
        "resource": "Deployment/production/payments",
        "severity": "high",
        "standard": "pod-security-restricted",
        "remediation": "Use configMap, CSI, downwardAPI, emptyDir, ephemeral, PVC, projected, or secret."
      },
      {
        "code": "host_path_volume",
        "path": "/spec/template/spec/volumes/0/hostPath",
        "message": "Pod mounts a path from the host filesystem.",
        "resource": "Deployment/production/payments",
        "severity": "high",
        "standard": "pod-security-baseline",
        "remediation": "Replace hostPath with an allowed volume type or isolate the workload."
      },
      {
        "code": "mutable_image_reference",
        "path": "/spec/template/spec/containers/0/image",
        "message": "Container api uses an unpinned or latest image reference.",
        "resource": "Deployment/production/payments",
        "severity": "medium",
        "standard": "workload-hardening",
        "remediation": "Pin the image by digest or an immutable release tag."
      },
      {
        "code": "resource_bounds_incomplete",
        "path": "/spec/template/spec/containers/0/resources",
        "message": "Container api lacks complete CPU and memory requests or limits.",
        "resource": "Deployment/production/payments",
        "severity": "medium",
        "standard": "workload-hardening",
        "remediation": "Set CPU and memory requests and limits appropriate for the workload."
      },
      {
        "code": "service_account_token_automount",
        "path": "/spec/template/spec/automountServiceAccountToken",
        "message": "Pod does not explicitly disable automatic service-account token mounting.",
        "resource": "Deployment/production/payments",
        "severity": "low",
        "standard": "workload-hardening",
        "remediation": "Set automountServiceAccountToken: false when Kubernetes API access is unnecessary."
      },
      {
        "code": "writable_root_filesystem",
        "path": "/spec/template/spec/containers/0/securityContext/readOnlyRootFilesystem",
        "message": "Container api does not require a read-only root filesystem.",
        "resource": "Deployment/production/payments",
        "severity": "low",
        "standard": "workload-hardening",
        "remediation": "Set readOnlyRootFilesystem: true and mount writable paths explicitly."
      }
    ],
    "resources": [
      {
        "kind": "ClusterRole",
        "resource": "ClusterRole/default/payments-admin",
        "finding_count": 1,
        "highest_severity": "critical"
      },
      {
        "kind": "Deployment",
        "resource": "Deployment/production/payments",
        "finding_count": 17,
        "highest_severity": "critical"
      }
    ],
    "risk_score": 100,
    "analysis_id": "kube-b9d6cd6119ee10800f77",
    "approval_gates": [
      "Remove added capabilities and grant only an explicitly allowed capability.",
      "Remove hostNetwork: true unless this workload is explicitly isolated and approved.",
      "Remove the capability; Restricted permits only NET_BIND_SERVICE.",
      "Replace hostPath with an allowed volume type or isolate the workload.",
      "Replace wildcard verbs, resources, and URLs with the minimum required set.",
      "Set capabilities.drop to [ALL], then add back only NET_BIND_SERVICE if needed.",
      "Set privileged to false and grant only the specific capability required.",
      "Set runAsNonRoot: true at the Pod or container level.",
      "Set seccompProfile.type to RuntimeDefault or an approved Localhost profile.",
      "Set securityContext.allowPrivilegeEscalation to false.",
      "Use RuntimeDefault or an approved Localhost seccomp profile.",
      "Use a non-zero UID and set runAsNonRoot: true."
    ],
    "analyzer_version": "kubeguard-kubernetes-manifest/1.0"
  }
}