Skip to main content


License Apache-2.0GitHub release (latest SemVer)OWASP Incubator ProjectArtifact HUBGitHub Repo starsTwitter Follower

What is Kubeaudit?#

Kubeaudit finds security misconfigurations in you Kubernetes Resources and gives tips on how to resolve these.

Kubeaudit comes with a large lists of "auditors" which test various aspects, like the SecurityContext of pods. You can find the complete list of auditors here.

To learn more about the kubeaudit itself visit kubeaudit GitHub.


The kubeaudit chart can be deployed via helm:

# Install HelmChart (use -n to configure another namespace)helm upgrade --install kubeaudit secureCodeBox/kubeaudit

Scanner Configuration#

The following security scan configuration example are based on the [kube-hunter Documentation], please take a look at the original documentation for more configuration examples.

  • To specify remote machines for hunting, select option 1 or use the --remote option. Example: kube-hunter --remote
  • To specify interface scanning, you can use the --interface option (this will scan all the machine's network interfaces). Example: kube-hunter --interface
  • To specify a specific CIDR to scan, use the --cidr option. Example: kube-hunter --cidr


Kubernetes: >=v1.11.0-0


kubeauditScopestring"namespace"Automatically sets up rbac roles for kubeaudit to access the resources it scans. Can be either "cluster" (ClusterRole) or "namespace" (Role)
parser.envlist[]Optional environment variables mapped into each parseJob (see:
parser.image.repositorystring""Parser image repository
parser.image.tagstringdefaults to the charts versionParser image tag
parser.ttlSecondsAfterFinishedstringnilseconds after which the kubernetes job for the parser will be deleted. Requires the Kubernetes TTLAfterFinished controller:
scanner.backoffLimitint3There are situations where you want to fail a scan Job after some amount of retries due to a logical error in configuration etc. To do so, set backoffLimit to specify the number of retries before considering a scan Job as failed. (see:
scanner.envlist[]Optional environment variables mapped into each scanJob (see:
scanner.extraContainerslist[]Optional additional Containers started with each scanJob (see:
scanner.extraVolumeMountslist[]Optional VolumeMounts mapped into each scanJob (see:
scanner.extraVolumeslist[]Optional Volumes mapped into each scanJob (see:
scanner.nameAppendstringnilappend a string to the default scantype name.
scanner.resourcesobject{}CPU/memory resource requests/limits (see:,
scanner.securityContextobject{"allowPrivilegeEscalation":false,"capabilities":{"drop":["all"]},"privileged":false,"readOnlyRootFilesystem":true,"runAsNonRoot":true}Optional securityContext set on scanner container (see:
scanner.securityContext.allowPrivilegeEscalationboolfalseEnsure that users privileges cannot be escalated
scanner.securityContext.capabilities.drop[0]string"all"This drops all linux privileges from the container.
scanner.securityContext.privilegedboolfalseEnsures that the scanner container is not run in privileged mode
scanner.securityContext.readOnlyRootFilesystembooltruePrevents write access to the containers file system
scanner.securityContext.runAsNonRootbooltrueEnforces that the scanner image is run as a non root user
scanner.ttlSecondsAfterFinishedstringnilseconds after which the kubernetes job for the scanner will be deleted. Requires the Kubernetes TTLAfterFinished controller:



Code of secureCodeBox is licensed under the Apache License 2.0.



# SPDX-FileCopyrightText: 2021 iteratec GmbH## SPDX-License-Identifier: Apache-2.0
apiVersion: ""kind: Scanmetadata:  name: "kubeaudit-juiceshop"spec:  scanType: "kubeaudit"  parameters:    - "-n"    - "juice-shop"