Kube ShipGuard

Kube ShipGuard is an open-source Kubernetes release-readiness scanner for platform and DevOps teams. It checks rendered manifests before deployment and blocks risky workloads in CI.

The scanner focuses on production signals that reviewers usually look for manually: probes, resources, non-root containers, read-only filesystems, image tags, PodDisruptionBudgets, NetworkPolicies, and risky Secret/ConfigMap patterns.

Why it exists

Kubernetes manifests often pass syntax validation while still being unsafe to ship. Kube ShipGuard adds a release gate that answers a more useful question:

Is this workload ready to survive production traffic, disruption, and security review?

Features

• Scans plain Kubernetes YAML and multi-document files.
• Supports Deployment, StatefulSet, DaemonSet, Pod, Service, Secret, ConfigMap, PodDisruptionBudget, and NetworkPolicy.
• Detects missing probes, missing resource requests/limits, unsafe security contexts, mutable image tags, single-replica workloads, missing PDBs, and missing NetworkPolicies.
• Emits text, JSON, and SARIF output.
• Includes an interactive terminal review mode for local manifest reviews.
• Supports release verdicts with risk scoring: SHIP, REVIEW, or BLOCK.
• Supports diff-aware PR scanning with --changed-from.
• Supports baselines for legacy findings and expiring suppressions for accepted exceptions.
• Scans rendered Helm and Kustomize output.
• Supports CI failure gates by severity.
• Ships with a reusable GitHub Action.

Quick start

go run ./cmd/kube-shipguard scan examples/secure --format text --fail-on high

Build the binary:

make build
./bin/kube-shipguard scan examples/secure

Generate SARIF for GitHub code scanning:

go run ./cmd/kube-shipguard scan deploy --format sarif --output kube-shipguard.sarif

Scan only changed manifests in a pull request:

go run ./cmd/kube-shipguard scan deploy --changed-from origin/main --fail-on high

Create a baseline for existing findings, then fail only on new risk:

go run ./cmd/kube-shipguard baseline deploy --output .kube-shipguard-baseline.yaml
go run ./cmd/kube-shipguard scan deploy --baseline .kube-shipguard-baseline.yaml --fail-on high

Scan rendered manifests:

go run ./cmd/kube-shipguard scan --helm-chart charts/api --helm-values values-prod.yaml
go run ./cmd/kube-shipguard scan --kustomize overlays/prod

Run the unsafe example without failing the process:

make demo

Open an interactive terminal review:

go run ./cmd/kube-shipguard review examples/unsafe

Review mode shortcuts:

• 1, 2, 3, a filter high, medium, low, or all findings;
• / searches rule IDs, files, resources, messages, and remediation text;
• ? opens the help overlay;
• j/k, arrow keys, home, and end navigate findings;
• q exits.

Example output

Kube ShipGuard found 7 findings

HIGH  KSG004 default/api Deployment/api container api allows privilege escalation
HIGH  KSG006 default/api Deployment/api container api uses mutable image tag latest
MED   KSG001 default/api Deployment/api container api has no readiness probe

Exit behavior

--fail-on controls the minimum severity that returns a non-zero exit code:

• none never fails;
• low fails on low, medium, or high;
• medium fails on medium or high;
• high fails only on high findings.

GitHub Action

name: kube-shipguard

on:
  pull_request:

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: yankawai/kube-shipguard@v1
        with:
          path: deploy
          changed-from: origin/main
          baseline: .kube-shipguard-baseline.yaml
          config: .kube-shipguard.yaml
          fail-on: high
          format: sarif
          output: kube-shipguard.sarif

For SARIF upload, add:

      - uses: github/codeql-action/upload-sarif@v4
        with:
          sarif_file: kube-shipguard.sarif

Checks

Rule	Severity	Description
KSG001	Medium	Container has no readiness probe
KSG002	Medium	Container has no liveness probe
KSG003	Medium	Container has incomplete CPU/memory requests or limits
KSG004	High	Container allows privilege escalation
KSG005	Medium	Container root filesystem is writable
KSG006	High	Container uses a mutable image tag
KSG007	High	Workload can run as root
KSG008	Medium	Container does not drop Linux capabilities
KSG009	Medium	Replicated workload has fewer than two replicas
KSG010	Medium	Workload has no matching PodDisruptionBudget
KSG011	Medium	Workload has no matching NetworkPolicy
KSG012	High	Secret manifest is stored in repository YAML
KSG013	High	ConfigMap key looks like a secret
KSG014	Low	Service exposes LoadBalancer directly

Documentation

• Configuration
• SARIF integration
• Security policy