segrep-k8s scanner

Opt-in Kubernetes manifest security scanner for RBAC, pod security, and deployment configs

Opt-in Kubernetes manifest security scanner for Segrep that detects RBAC misconfigurations, pod security issues, container privilege escalation risks, and missing resource limits — no external binary required.

Why use segrep-k8s

Detects 20 categories of Kubernetes security misconfigurations across deployments, pods, statefulsets, daemonsets, jobs, and cronjobs.
Runs locally with zero dependencies — no Kubescape or kube-linter binary required.
Flags privileged containers, host namespace sharing, wildcard RBAC, missing network policies, and docker socket mounts.
Maps every finding to CIS Kubernetes Benchmark and NSA Kubernetes Hardening Guidance references.

Scanner behavior

segrep-k8s runs as an opt-in scanner.

pnpm segrep scan . --scanners segrep-k8s

It walks the scan root and scans .yaml and .yml files that contain Kubernetes manifests (files with both apiVersion: and kind: top-level fields).

Rules

Privilege & Security Context

Rule ID	Severity	What it detects
`k8s-privileged-container`	critical	Container with `privileged: true`
`k8s-allow-privilege-escalation`	high	Container with `allowPrivilegeEscalation: true`
`k8s-running-as-root`	high	Container with `runAsNonRoot: false`
`k8s-writable-root-filesystem`	medium	Container with `readOnlyRootFilesystem: false`
`k8s-no-security-context`	medium	Container with no `securityContext` block

Host Namespace

Rule ID	Severity	What it detects
`k8s-host-network`	high	Pod with `hostNetwork: true`
`k8s-host-pid`	high	Pod with `hostPID: true`
`k8s-host-ipc`	high	Pod with `hostIPC: true`
`k8s-host-ports`	high	Container with `hostPort` set

Images & Supply Chain

Rule ID	Severity	What it detects
`k8s-image-latest-tag`	medium	Container image using `:latest` tag or no tag
`k8s-image-digest-pinning`	low	Image not pinned by `@sha256:` digest

Capabilities & Networking

Rule ID	Severity	What it detects
`k8s-added-capabilities`	high	Added Linux capabilities (excluding `NET_BIND_SERVICE`)
`k8s-docker-socket-mount`	critical	Mount of `/var/run/docker.sock`

Resource Management

Rule ID	Severity	What it detects
`k8s-no-resource-limits`	medium	Container with no `resources` block
`k8s-no-memory-limit`	medium	`limits` block present but no `memory` limit

Liveness & Readiness

Rule ID	Severity	What it detects
`k8s-no-liveness-probe`	medium	Container with no `livenessProbe`

RBAC & Service Accounts

Rule ID	Severity	What it detects
`k8s-default-service-account`	medium	`serviceAccountName: default` or `automountServiceAccountToken: true`
`k8s-wildcard-clusterrole`	critical	Wildcard `*` in apiGroups, resources, or verbs of a ClusterRole
`k8s-automount-token`	low	`automountServiceAccountToken: true`

Secrets & Network Policy

Rule ID	Severity	What it detects
`k8s-secret-in-env`	low	Secret mounted as environment variable via `secretKeyRef`
`k8s-no-network-policy`	medium	Workload resource present but no `NetworkPolicy` in the same file

Volumes

Rule ID	Severity	What it detects
`k8s-hostpath-mount`	high	`hostPath` volume mount

Finding output

Each finding includes:

ruleId — the matched rule (e.g., k8s-privileged-container)
cweId — CWE reference
line — line number where the issue was found
snippet — the matched line

Example finding:

{
  "id": "segrep-k8s:k8s-privileged-container:deployment.yaml:15",
  "title": "Container running in privileged mode",
  "severity": "critical",
  "filePath": "deployment.yaml",
  "scanner": "segrep-k8s",
  "category": "iac",
  "ruleId": "k8s-privileged-container",
  "cweId": "CWE-250",
  "line": 15,
  "snippet": "privileged: true"
}

CIS & NSA mappings

Each rule maps to the relevant CIS Kubernetes Benchmark and NSA Kubernetes Hardening Guidance control:

Rule	CIS	NSA
`k8s-privileged-container`	5.2.1	NS-C-0001
`k8s-allow-privilege-escalation`	5.2.5	NS-C-0002
`k8s-running-as-root`	5.2.6	NS-C-0003
`k8s-host-network`	5.2.4	NS-C-0004
`k8s-host-pid`	5.2.2	NS-C-0005
`k8s-host-ipc`	5.2.3	NS-C-0006
`k8s-added-capabilities`	5.2.7	NS-C-0007
`k8s-docker-socket-mount`	—	NS-C-0008
`k8s-default-service-account`	5.1.1	NS-C-0009
`k8s-wildcard-clusterrole`	5.1.2	NS-C-0010
`k8s-secret-in-env`	—	NS-C-0011
`k8s-no-network-policy`	—	NS-C-0012
`k8s-hostpath-mount`	5.2.12	NS-C-0013

Policy integration

scanners:
  - segrep-k8s

# Allowlist known-good findings by rule ID
allowlist:
  - k8s-image-latest-tag

# Ignore test fixtures
ignore_paths:
  - "fixtures/**"
  - "**/*.test.*"

Examples

Kubernetes manifests only:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-k8s

Combine with IaC scanning:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-k8s,segrep-iac --format json

Fail CI on any critical or high finding:

docker run --rm -v "$(pwd):/repo:ro" security-scanner:local \
  scan /repo --scanners segrep-k8s --fail-on high

Product scan guide
Docker image reference
segrep-iac — IaC misconfiguration scanner
segrep-cloud — cloud security scanner
segrep-secrets — native secret detection