Checks
28 rules for what's quietly misconfigured — each explaining why it matters, suppressible as accepted risk, with groups you choose per cluster.
Triage is for what's broken; Checks are for what's quietly wrong — the misconfigurations that cost nothing today and everything during the next incident. The rule engine runs over the live cache and grades what it finds, and every finding links to the object it's about.
The groups
| Group | What it watches |
|---|---|
| Pod security | Privileged containers, host namespaces and mounts, dangerous capabilities, root users, writable root filesystems |
| RBAC | cluster-admin bindings, wildcard grants, escalating verbs, cluster-wide Secret reads |
| Resources | Missing requests and memory limits — the difference between one restarted pod and a whole-node eviction |
| Health probes | Workloads with no readiness or liveness probe |
| Availability | Single replicas, missing disruption budgets, everything that turns a node drain into downtime |
| Images | Tags that float, pull policies that surprise |
| Hygiene | The leftovers — suspended CronJobs, finished Jobs, config nothing references |
| Right-sizing | Requests far from observed usage, in either direction |
28 rules ship built in, and the catalog documents every one in terms of why
it's worth your time — what the setting does and what it costs to leave
alone — not just a name and a severity. cluster-wide-secret-read, for
instance, explains that read access to Secrets everywhere turns one
compromised pod into a full credential dump, and that a few operators
legitimately need exactly that.
Accepted risk, on the record
Some findings are deliberate — the CNI agent really does need host networking. Suppressing a finding records that a human accepted it: the finding leaves the score, the record stays listable, and unsuppressing is one click. That's different from ignoring a page of yellow until it becomes wallpaper — the list stays short enough to mean something.
Which groups run is a per-cluster setting: run everything against production, and spare your kind cluster the availability lectures.
Beyond the built-ins
Team-specific policy — required labels, forbidden registries, your naming rules — belongs in custom rules: the same engine, your CEL.