README
¶
Kubernetes Admission Policy Toolkit
KubeAPT is a CLI for validating Kubernetes admission hardening. It evaluates ValidatingAdmissionPolicies (VAP) and bindings, checks Pod Security Admission (PSA) posture, and scans clusters for admission safeguards. It also manages policy bundles and standalone policies so you can download, inspect, and apply curated rulesets. Official bundles and policies are published at https://cenroq.com/policies.
Documentation lives at https://kubeapt.io.
Installation
Install the latest version of kubeapt using go install...
go install github.com/cenroq/kubeapt/v2/cmd/kubeapt@latest
...or download a pre-built binary from the releases page.
Star History
Directories
¶
| Path | Synopsis |
|---|---|
|
cmd
|
|
|
kubeapt
command
|
|
|
internal
|
|
|
scanaccess
Package scanaccess is an internal contract between pkg/policies (loader) and pkg/scanner (evaluator).
|
Package scanaccess is an internal contract between pkg/policies (loader) and pkg/scanner (evaluator). |
|
pkg
|
|
|
policies
Package policies loads kubeapt policy bundles from an fs.FS or directory, preserving each policy's raw YAML bytes for downstream "remediation as code" artifact bundling.
|
Package policies loads kubeapt policy bundles from an fs.FS or directory, preserving each policy's raw YAML bytes for downstream "remediation as code" artifact bundling. |
|
scanner
Package scanner evaluates a loaded policies.Bundle against a slice of in-memory Kubernetes manifests and returns structured findings.
|
Package scanner evaluates a loaded policies.Bundle against a slice of in-memory Kubernetes manifests and returns structured findings. |
|
types
Package types defines the shared primitives exposed by kubeapt's scanner API.
|
Package types defines the shared primitives exposed by kubeapt's scanner API. |
Click to show internal directories.
Click to hide internal directories.