The open-source Kubernetes Admission Policy Toolkit: a Go CLI to validate ValidatingAdmissionPolicies and Pod Security posture, scan your cluster for admission gaps, and manage curated policy bundles. Runs locally, ships nothing out.
$ go install github.com/cenroq/kubeapt/v2/cmd/kubeapt@latest
No account, no API key, nothing phoning home. Install the CLI, scan your cluster, then validate and enforce policy bundles.
A single go install, or grab a pre-built binary from GitHub Releases. Nothing is deployed to your cluster yet.
See Pod Security Admission posture, admission plugins and webhooks at a glance: read-only, nothing leaves.
Browse and download curated bundles like cenroq-best-practices. Air-gapped? Import a signed archive instead.
Evaluate workloads locally, then install the bundle and label a namespace to warn, audit or enforce.
Before you deploy them, evaluate ValidatingAdmissionPolicies and their bindings with CEL against a live cluster or local manifests.
Check every namespace against the baseline and restricted levels and get a clear pass/fail breakdown.
Discover built-in admission plugins and validating/mutating webhooks, and detect Kyverno or Gatekeeper, in one read-only pass.
Download, inspect, install and version curated bundles like cenroq-best-practices and pod-security-admission.
Export and import bundles as SHA-256-verified archives. Runs fully offline: no telemetry, no phone-home.
Run kubeapt validate --pipeline as a quality gate. It exits non-zero on violations. Table or JSON output for GitHub Actions, GitLab CI or Jenkins.
kubernetes-security-policies is a curated set of ValidatingAdmissionPolicies written in CEL, plus Istio and NetworkPolicy guardrails. There's no Kyverno or OPA to run: they're native Kubernetes objects. Install them with kubeapt, or apply them straight with kubectl.
cenroq-best-practices bundles all 178 policies for a strong baseline; pod-security-admission ships the Pod Security Standards as VAPs (baseline & restricted).
Pod & container hardening, RBAC, secrets, network, images, storage encryption, ingress/TLS and webhook hardening. Every policy is severity-rated.
Activate policies per namespace with security.cenroq.io labels. Start in warn, move to audit, then enforce when you're ready.
kubeapt and the policy bundles harden admission control, for free. cenroq Professional adds everything required to run security and compliance continuously: in production, under audit.
The admission policy toolkit CLI. Apache-2.0. Fork it, audit it, open a pull request.
Open kubeapt →178 admission policies as code. Propose a rule, add a test, extend the bundles.
Open the policies →Report a bug, request a policy or pick up a good first issue. Contributions welcome.
Open issues →Admission-time hardening has a limit. When you need continuous evidence, runtime protection and regulatory compliance, cenroq Professional picks up where kubeapt leaves off.