Kubernetes · open source · v0.7
Kubernetes guardrails that know your cluster
k8s-guardian is a free, open-source CLI that checks Kubernetes manifests, Helm charts and Kustomize overlays, fixes what is safe to fix, and tells you whether they will actually run in the target cluster. It is also a kubectl plugin, a GitHub Action and an MCP server, in one Go binary.
Valid YAML still breaks at deploy time
Most Kubernetes linters read a file and print an error. The failures that hurt happen later: a quota with no headroom, a Secret that does not exist, an immutable selector, an API that was removed. k8s-guardian checks the manifest and the cluster it is going to.
What k8s-guardian does
Go · Apache-2.0 licence · version 0.7.0
21 built-in rules
Requests and limits, non-root, privilege escalation, capabilities, probes, the :latest tag, host namespaces, seccomp, literal secrets in env, Service wiring, PodDisruptionBudgets, removed APIs and RBAC wildcards.
Safe auto-fix
Fixes keep your comments and leave untouched YAML byte for byte. Riskier fixes run only when you ask for them.
Helm, Kustomize, Argo Rollouts
Renders charts with your own values files and checks the result, not the template.
Will it fit the cluster?
With a kubeconfig it checks ResourceQuota headroom, node capacity, LimitRanges, and missing ConfigMaps, Secrets and CRDs.
Breaking-change diff
Compares the manifest with what is deployed now and flags immutable fields, removed APIs, downtime and port changes.
Same rules at admission
Exports the rules as ValidatingAdmissionPolicies or Kyverno policies, so CI and the cluster make the same decision.
Custom rules without Rego
Write your own rules in a small YAML format and keep them in the repository.
Built for CI
GitHub Action with pull-request annotations, SARIF output, pre-commit hook, Docker image, and a baseline so only new findings fail.
MCP server
Claude Code, Cursor and other MCP clients can run the checks and fixes as tools.
Quick start
go install github.com/andronaft/k8s-guardian/cmd/k8s-guardian@latest
k8s-guardian check -f k8s/ # files, directories, Helm charts, Kustomize
k8s-guardian check -f k8s/ --fix # apply the safe fixes in place
k8s-guardian check -f k8s/ --live -n prod # will it fit the cluster?
k8s-guardian diff -f k8s/ -n prod # what breaks if I apply it?
k8s-guardian export vap > guardrails.yaml # enforce the same rules at admissionQuestions
How is k8s-guardian different from kube-linter or kubeconform?
Those tools check the file. k8s-guardian also checks the target cluster (quotas, node sizes, LimitRanges, referenced Secrets and CRDs), diffs against what is running, fixes what is safe to fix, and exports the same rules as admission policies.
Does it need access to my cluster?
No. The basic check works offline on files. Cluster access is only used by the live check and the diff, and it is read-only.
Can I adopt it in a repository that already has many findings?
Yes. The init command writes a config and a baseline of today's findings, so CI fails only on new ones.
Is it free?
Yes. It is open source under the Apache 2.0 licence. The optional AI fixes need your own API key.
How do I install it as a kubectl plugin?
Through Krew with the manifest from the repository, or build from source, which also creates the kubectl guard plugin.
Read more
How and why I built it, and my other tools.