Runs on your device

Kubernetes Workload Hardening

Paste manifests, kubectl JSON, Helm values or compose. Get PSS and RBAC findings.

Findings

Manifest, kubectl JSON, Helm values or docker-compose or drop a .yaml, .yml or .json file

Open files

Examples

Your manifest never leaves this tab.

How it works, references and FAQ

Background readingKubernetes security Least privilege

What it checks

Every workload against Pod Security Standards Baseline and Restricted, Roles and bindings against RBAC good practice, plus hygiene: writable root, missing limits, :latest images, literal secrets, token automount.

Observability agents are flagged only for host access beyond what they need. Runtime caps decodes a capability mask and maps dangerous caps to escape techniques.

Sources

Pod Security Standards: kubernetes.io/docs/concepts/security/pod-security-standards
RBAC good practices: kubernetes.io/docs/concepts/security/rbac-good-practices
Docker default capabilities: moby/moby daemon/pkg/oci/caps/defaults.go (commit c74ba95, 2025-07-24): the 14 caps a container keeps unless you add more.
Capability numbers: Linux include/uapi/linux/capability.h (0 to 40, up to CAP_CHECKPOINT_RESTORE).
Agent host access: the node_exporter README and the prometheus-node-exporter, Fluent Bit, Vector and Alloy chart values; Promtail end of life (2026-03-02).
StatefulSets and volumes: StatefulSet, topology spread constraints, pod QoS and emptyDir.

Hardening FAQ

What do I paste in?

Multi-document YAML (helm template or kustomize build output), kubectl get -o json, docker-compose, or a Helm values.yaml.

Can I paste a Helm values.yaml?

Yes, as a values-level check: findings point at the values path. Render with helm template for full coverage.

How are node-exporter and log shipper DaemonSets judged?

Each agent gets the host access its README and chart defaults need. Only the excess is flagged: privileged mode, hostPID or hostNetwork on a log shipper, and writable host mounts.

Which standard does it check against?

The Kubernetes Pod Security Standards (Baseline and Restricted), plus RBAC good practices and hygiene checks.

Is my manifest sent anywhere?

No. The parser and every check run in the page.

What is the capability decoder for?

Paste a CapEff, CapPrm or CapBnd mask from /proc/PID/status to see the capability names, those beyond Docker's defaults, and known escape techniques.

Checks reflect the Pod Security Standards, RBAC good practices and upstream agent chart defaults as of October 2026. Sample manifests on this page are fictional.