Kubesec analyzes Kubernetes resource manifests and reports security
risks and scoring against a set of built-in rules. It scans YAML or JSON
files from disk or standard input, and can also run as an HTTP server.

Requires google-go-lang for building. The SlackBuild compiles offline
using the supplied vendor archive, and the resulting binary needs no Go
runtime. Kubernetes schema validation uses kubeconform, which downloads
the Kubernetes JSON schemas on demand. Use the --schema-location option
with local schema files for offline validation.

Run "kubesec scan file.yaml" to scan a manifest. Output formats are
json, table, and template. List the available rules with "kubesec
print-rules". The example SARIF report template is installed as
/usr/share/kubesec/sarif.tpl. Use it with "kubesec scan --format
template --template /usr/share/kubesec/sarif.tpl".

Scanning exits with status 0 when every scanned resource scores zero or
more points, and with status 2 otherwise. Use the --exit-code option to
choose a different failure status.

Documentation: https://kubesec.io/
