Static Analysis of Kubernetes Manifests
Talkat KubeCon + CloudNativeCon North America 2020 Virtual · on Wednesday, 2020-11-18· at 15:00· Intrado Virtual Event Platform,·
summary
Scans of public GitHub repos find widespread Kubernetes misconfigurations—public endpoints, missing CPU limits, and containers with runAsNonRoot overridden—so a Python tool named Chekhov static analyzer is built and released (>50 contributors, ~8,000 downloads, ~1,400 stars) to catch them. Chekhov runs as a pre-commit hook, a GitHub Action CI job, or as a runtime cluster scanner, prints file excerpts and remediation links, blocks failing commits and pull requests, and reduces downstream incident tickets.
AI-written summary · about
chapters (12)
- 0:00Static analysis intro
- 1:30Engineer's misconfig struggles
- 5:20Common manifest misconfigs
- 8:57Introducing Chekov
- 12:31Live Chekov demo
- 17:25Automating with pre-commit
- 20:38Skipping justified checks
- 22:05CI/CD integration
- 24:17Chekov in GitHub Actions
- 26:52Cluster drift detection
- 27:55Key takeaways
- 28:38Q&A
related talks
26mMulti-layer hardening in Kubernetes
32mSurviving From Endless Issues Coming From 7K+ Kubernetes Clusters
47mComputer Says No — Static analysis and CI in a Kotlin world
44mUsing Static Analysis Tools to Become A Superhero Programmer
27mRethinking Observability for Off-the-Shelf Tools
33mDetection of vulnerabilities and misconfigurations in production images
18mContinuous Security - Building Security into your Pipelines
33mAm I Using It Right? Checking Best Practices on Live Kubernetes Clusters