wingetCollections
  • Auto
  • Search
  • Awesome Collections
  • Awesome Programs
  • My Favorite Collections
  • My Collections
  • Account / Settings
  • Terms of Service
  • Privacy
  • About

© 2025 winget.ragerworks.com

Loading...
Install KubeLinter using Winget - wingetCollections
  1. Go back
  2. Packages
  3. KubeLinter
KubeLinter logo

KubeLinter StackRox

hactoberfest helm-charts kubernetes static-analysis yaml-files
Use this command to install KubeLinter:
winget install --id=stackrox.kube-linter -e

KubeLinter is a static analysis tool designed to examine Kubernetes YAML files and Helm charts, ensuring adherence to best practices for production readiness and security. It evaluates configurations against a set of guidelines to identify potential issues, such as insecure settings or operational inefficiencies.

Key Features:

  • Best Practice Checks: Analyzes configurations for common misconfigurations related to security, resource management, and operational reliability.
  • Customizable Rules: Allows users to enable, disable, or modify checks to align with organizational policies.
  • Actionable Recommendations: Provides clear guidance on resolving identified issues, enhancing remediation efforts.
  • Helm Chart Support: Extends analysis to Helm charts, ensuring consistent compliance across templates.
  • Extensibility: Supports the creation of custom checks, enabling tailored enforcement of specific security or operational standards.
  • Integration Capabilities: Designed for seamless integration into CI/CD pipelines, facilitating early detection of issues during development.

Audience & Benefits: Ideal for Kubernetes developers, DevOps engineers, and security teams, KubeLinter helps organizations maintain secure and reliable containerized applications by identifying misconfigurations early in the development cycle. It promotes adherence to best practices, reducing risks associated with insecure or inefficient deployments. The tool can be installed via winget, ensuring straightforward setup.

README

Static analysis for Kubernetes

Go Report Card

What is KubeLinter?

KubeLinter analyzes Kubernetes YAML files and Helm charts, and checks them against a variety of best practices, with a focus on production readiness and security.

KubeLinter runs sensible default checks, designed to give you useful information about your Kubernetes YAML files and Helm charts. This is to help teams check early and often for security misconfigurations and DevOps best practices. Some common examples of these include running containers as a non-root user, enforcing least privilege, and storing sensitive information only in secrets.

KubeLinter is configurable, so you can enable and disable checks, as well as create your own custom checks, depending on the policies you want to follow within your organization.

When a lint check fails, KubeLinter reports recommendations for how to resolve any potential issues and returns a non-zero exit code.

Documentation

Visit https://docs.kubelinter.io for detailed documentation on installing, using and configuring KubeLinter.

Installing KubeLinter

Kube-linter binaries could be found here: https://github.com/stackrox/kube-linter/releases/latest

Using Go

To install using Go, run the following command:

go install golang.stackrox.io/kube-linter/cmd/kube-linter@latest

Otherwise, download the latest binary from Releases and add it to your PATH.

Using Homebrew for macOS or LinuxBrew for Linux

To install using Homebrew or LinuxBrew, run the following command:

brew install kube-linter

Using nix-shell

nix-shell -p kube-linter

Using docker

docker pull stackrox/kube-linter:latest

Development

Prerequisites

  • Make sure that you have installed Go prior to building from source.

Building KubeLinter

Installing KubeLinter from source is as simple as following these steps:

Versions
0.7.6
0.7.5
0.7.4
0.7.3
0.7.2
0.6.8
0.6.4
Website
github.com
License
Last updated
9/21/2025
Download latest version

  1. First, clone the KubeLinter repository.

    git clone git@github.com:stackrox/kube-linter.git

  2. Then, compile the source code. This will create the kube-linter binary files for each platform and places them in the .gobin folder.

    make build

  3. Finally, you are ready to start using KubeLinter. Verify your version to ensure you've successfully installed KubeLinter.

    .gobin/kube-linter version

Testing KubeLinter

There are several layers of testing. Each layer is expected to pass.

  1. go unit tests:

    make test

  2. end-to-end integration tests:

    make e2e-test

  3. and finally, end-to-end integration tests using bats-core:

    make e2e-bats

Verifying KubeLinter images

KubeLinter images are signed by cosign. We recommend verifying the image before using it.

Once you've installed cosign, you can use the KubeLinter public key to verify the KubeLinter image with:

cat kubelinter-cosign.pub
-----BEGIN PUBLIC KEY-----
MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEl0HCkCRzYv0qH5QiazoXeXe2qwFX
DmAszeH26g1s3OSsG/focPWkN88wEKQ5eiE95v+Z2snUQPl/mjPdvqpyjA==
-----END PUBLIC KEY-----


cosign verify --key kubelinter-cosign $IMAGE_NAME

KubeLinter also provides cosign keyless signatures.

You can verify the KubeLinter image with:

# NOTE: Keyless signatures are NOT PRODUCTION ready.

COSIGN_EXPERIMENTAL=1 cosign verify $IMAGE_NAME

Using KubeLinter

Local YAML Linting

Running KubeLinter to Lint your YAML files only requires two steps in its most basic form.

  1. Locate the YAML file you'd like to test for security and production readiness best practices:

  2. Run the following command:

    kube-linter lint /path/to/your/yaml.yaml

Example

Consider the following sample pod specification file pod.yaml. This file has two production readiness issues and one security issue:

Security Issue:

  1. The container in this pod is not running as a read only file system, which could allow it to write to the root filesystem.

Production readiness:

  1. The container's memory limits are not set, which could allow it to consume excessive memory

    apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo
spec:
  securityContext:
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
  volumes:
  - name: sec-ctx-vol
    emptyDir: {}
  containers:
  - name: sec-ctx-demo
    image: busybox
    resources:
      requests:
        memory: "64Mi"
        cpu: "250m"
    command: [ "sh", "-c", "sleep 1h" ]
    volumeMounts:
    - name: sec-ctx-vol
      mountPath: /data/demo
    securityContext:
      allowPrivilegeEscalation: false

  2. Copy the YAML above to pod.yaml and lint this file by running the following command:

    kube-linter lint pod.yaml

  3. KubeLinter runs its default checks and reports recommendations. Below is the output from our previous command.

    pod.yaml: (object: /security-context-demo /v1, Kind=Pod) The container "sec-ctx-demo" is using an invalid container image, "busybox". Please use images that are not blocked by the `BlockList` criteria : [".*:(latest)$" "^[^:]*$" "(.*/[^:]+)$"] (check: latest-tag, remediation: Use a container image with a specific tag other than latest.)

pod.yaml: (object: /security-context-demo /v1, Kind=Pod) container "sec-ctx-demo" does not have a read-only root file system (check: no-read-only-root-fs, remediation: Set readOnlyRootFilesystem to true in the container securityContext.)

pod.yaml: (object: /security-context-demo /v1, Kind=Pod) container "sec-ctx-demo" has memory limit 0 (check: unset-memory-requirements, remediation: Set memory limits for your container based on its requirements. Refer to https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#requests-and-limits for details.)

Error: found 3 lint errors

To learn more about using and configuring KubeLinter, visit the documentation page.

Mentions/Tutorials

The following are tutorials on KubeLinter written by users. If you have one that you would like to add to this list, please send a PR!

  • Ensuring YAML best practices using KubeLinter at civo.com by Saiyam Pathak.
  • Analyze Kubernetes files for errors with KubeLinter at opensource.com by Jessica Cherry.
  • How to add a new check in KubeLinter? by Priyanka Saggu.
  • Extending kube-linter To Build A Custom Template by Gareth Healy.

LICENSE

KubeLinter is licensed under the Apache License 2.0.

Community

If you would like to engage with the KubeLinter community, including maintainers and other users, you can join the Slack workspace here.

There may be breaking changes in the future to the command usage, flags, and configuration file formats. However, we encourage you to use KubeLinter to test your environment YAML files, see what breaks, and contribute.

As a reminder, all participation in the KubeLinter community is governed by our code of conduct.

KubeLinter is created with ❤️ by StackRox and is now powered by Red Hat.