0hardik1

0hardik1 / kubesplaining

Public

Kubernetes security assessment CLI: RBAC, pod-escape, and privilege-escalation path analysis. Cloudsplaining for Kubernetes.

0hardik1.github.iokubesplaining cli cloudsplaining devsecops golang kubernetes
19
0
100% credibility
Found May 04, 2026 at 19 stars -- GitGems finds repos before they trend. Get early access to the next one.
Sign Up Free
AI Analysis
Go
AI Summary

Kubesplaining is a command-line tool that scans Kubernetes clusters for RBAC privilege escalation paths and generates easy-to-read security reports.

How It Works

1
🔍 Discover Kubesplaining

You hear about a friendly tool that checks your Kubernetes setup for hidden security risks like sneaky permission paths.

2
📥 Get it set up quickly

Download and install the tool in moments, no complicated steps needed.

3
🔗 Point it at your cluster

Tell the tool about your Kubernetes setup so it can peek inside safely.

4
🚀 Run your security check

Hit go and watch it scan for ways someone could climb from small permissions to big power.

5
📊 Open the colorful report

See a clear list of issues with pictures of the risky paths and simple fixes.

✅ Make your cluster safer

Follow the easy steps to block the risks, re-check, and rest easy knowing your setup is stronger.

Sign up to see the full architecture

4 more

Sign Up Free

Star Growth

See how this repo grew from 19 to 19 stars Sign Up Free
Repurpose This Repo

Repurpose is a Pro feature

Generate ready-to-use prompts for X threads, LinkedIn posts, blog posts, YouTube scripts, and more -- with full repo context baked in.

Unlock Repurpose
AI-Generated Review

What is kubesplaining?

Kubesplaining is a Go-based CLI for Kubernetes security assessment, scanning RBAC bindings, workloads, and configs to map privilege-escalation paths from every subject to cluster-admin, host root, or kube-system secrets. It analyzes live clusters or offline snapshots, producing prioritized HTML reports with visualized attack graphs, plus JSON/CSV/SARIF for automation. Like Cloudsplaining for AWS IAM, it explains attacker movement chains, not just isolated misconfigs.

Why is it gaining traction?

Unlike basic kubernetes security scanners that flag "privileged: true," it graphs full BFS paths (e.g., SA → pod create → wildcard role → admin) with evidence and remediations, plus pod-escape surfaces like hostPath mounts. SARIF output integrates with kubernetes github actions for PR scanning, CI budgets fail builds on critical paths, and exclusions filter noise—ideal for kubernetes security best practices checklists. Offline mode and standard presets make audits repeatable without cluster access.

Who should use this?

Platform engineers auditing RBAC sprawl before prod deploys, pentesters tracing escape-to-host vectors, and SecOps teams enforcing kubernetes security policy via GitHub runners or dashboards. Suits kubernetes security tools users wanting path analysis over raw scans, especially for privesc in multi-tenant setups.

Verdict

Promising early tool for targeted kubernetes securitycontext analysis, but 19 stars and 1.0% credibility score signal immaturity—docs shine, but test it in staging first. Grab binaries from kubernetes github releases for quick cluster scans.

(198 words)

Sign up to read the full AI review Sign Up Free

Similar repos coming soon.