{"id":50770713,"url":"https://github.com/joemunene-by/ghostaudit","last_synced_at":"2026-06-11T18:01:41.832Z","repository":{"id":363847070,"uuid":"1213069738","full_name":"joemunene-by/ghostaudit","owner":"joemunene-by","description":"Kubernetes Security Auditor — 23 CIS-based checks for RBAC, pod security, secrets, network policies, resource limits, and image security. CLI with HTML/JSON reports.","archived":false,"fork":false,"pushed_at":"2026-06-10T15:27:27.000Z","size":50,"stargazers_count":0,"open_issues_count":8,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-06-10T17:08:39.687Z","etag":null,"topics":["audit","cis-benchmark","cli","cloud-security","devsecops","kubernetes","kubernetes-security","pod-security","rbac","security"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/joemunene-by.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-04-17T02:33:52.000Z","updated_at":"2026-06-10T15:15:32.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/joemunene-by/ghostaudit","commit_stats":null,"previous_names":["joemunene-by/ghostaudit"],"tags_count":null,"template":false,"template_full_name":null,"purl":"pkg:github/joemunene-by/ghostaudit","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joemunene-by%2Fghostaudit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joemunene-by%2Fghostaudit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joemunene-by%2Fghostaudit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joemunene-by%2Fghostaudit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/joemunene-by","download_url":"https://codeload.github.com/joemunene-by/ghostaudit/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/joemunene-by%2Fghostaudit/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34211067,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-11T02:00:06.485Z","response_time":57,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["audit","cis-benchmark","cli","cloud-security","devsecops","kubernetes","kubernetes-security","pod-security","rbac","security"],"created_at":"2026-06-11T18:01:41.747Z","updated_at":"2026-06-11T18:01:41.815Z","avatar_url":"https://github.com/joemunene-by.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# GhostAudit\n\nKubernetes Security Auditor CLI. Scans clusters for security misconfigurations based on the CIS Kubernetes Benchmark and real-world security best practices, then generates actionable reports.\n\nThink `kube-bench` but focused, Python-based, and with clean HTML reports.\n\n## Install\n\n```bash\npip install .\n\n# Development\npip install -e \".[dev]\"\n```\n\n## Usage\n\n```bash\n# Full scan using default kubeconfig\nghostaudit scan\n\n# Specify kubeconfig\nghostaudit scan --kubeconfig ~/.kube/config\n\n# Scan a specific namespace\nghostaudit scan --namespace production\n\n# Generate HTML report\nghostaudit scan --output report.html\n\n# Generate JSON report\nghostaudit scan --output report.json\n\n# Run only specific check categories\nghostaudit scan --checks rbac,pods\n\n# List all available checks\nghostaudit checks\n\n# Show version\nghostaudit --version\n```\n\n## Exit Codes\n\n| Code | Meaning |\n|------|---------|\n| 0 | Scan completed, no CRITICAL or HIGH findings |\n| 1 | Configuration or connection error |\n| 2 | Scan completed with CRITICAL or HIGH findings |\n\n## Security Checks\n\n| ID | Category | Title | Severity |\n|----|----------|-------|----------|\n| RBAC-001 | RBAC | Cluster-admin bound to non-system account | CRITICAL |\n| RBAC-002 | RBAC | Overly permissive role (wildcards) | HIGH |\n| RBAC-003 | RBAC | ServiceAccount auto-mounts API token | MEDIUM |\n| RBAC-004 | RBAC | Workload running in default namespace | MEDIUM |\n| POD-001 | Pod Security | Privileged container | CRITICAL |\n| POD-002 | Pod Security | Container may run as root | HIGH |\n| POD-003 | Pod Security | Missing security context | MEDIUM |\n| POD-004 | Pod Security | Host namespace sharing enabled | HIGH |\n| POD-005 | Pod Security | Writable root filesystem | MEDIUM |\n| POD-006 | Pod Security | Privilege escalation allowed | MEDIUM |\n| POD-007 | Pod Security | Dangerous capabilities added | HIGH |\n| SEC-001 | Secrets | Secret exposed as environment variable | MEDIUM |\n| SEC-002 | Secrets | ConfigMap contains sensitive-looking keys | HIGH |\n| SEC-003 | Secrets | Secret in default namespace | LOW |\n| NET-001 | Network | Namespace without NetworkPolicy | HIGH |\n| NET-002 | Network | Service exposed via LoadBalancer/NodePort | MEDIUM |\n| NET-003 | Network | External service without documentation annotation | LOW |\n| RES-001 | Resources | Container without resource limits | MEDIUM |\n| RES-002 | Resources | Container without resource requests | LOW |\n| RES-003 | Resources | No PodDisruptionBudget for scaled deployment | LOW |\n| IMG-001 | Images | Container using :latest tag | MEDIUM |\n| IMG-002 | Images | Public registry image without digest | MEDIUM |\n| IMG-003 | Images | Missing imagePullPolicy: Always for mutable tag | LOW |\n\n## Sample Console Output\n\n```\n╭──────────── GhostAudit ─────────────╮\n│ GhostAudit Security Report          │\n│ Cluster: my-cluster                  │\n│ Time: 2026-04-16 12:00:00 UTC       │\n│ Security Score: 42/100               │\n╰──────────────────────────────────────╯\n\n     Findings Summary\n┏━━━━━━━━━━┳━━━━━━━┓\n┃ Severity ┃ Count ┃\n┡━━━━━━━━━━╇━━━━━━━┩\n│ CRITICAL │     2 │\n│ HIGH     │     5 │\n│ MEDIUM   │     8 │\n│ LOW      │     3 │\n│ INFO     │     0 │\n│ TOTAL    │    18 │\n└──────────┴───────┘\n\n╭─ [!!!] [POD-001] Privileged container ───────────╮\n│ Resource: Pod/bad-pod/app (ns: default)          │\n│                                                   │\n│ Container 'bad-pod/app' in namespace 'default'   │\n│ is running in privileged mode...                  │\n│                                                   │\n│ Remediation: Set securityContext.privileged: false│\n╰───────────────────────────────────────────────────╯\n```\n\n## HTML Report\n\nThe HTML report features a dark theme with:\n- Security score gauge (0-100)\n- Severity summary cards\n- Expandable findings grouped by category\n- Remediation steps for each finding\n- Fully self-contained (all CSS embedded, no external dependencies)\n\n## Architecture\n\n```\nsrc/ghostaudit/\n├── cli.py              # Typer CLI\n├── config.py           # Settings\n├── scanner.py          # Main orchestrator\n├── client.py           # K8s API client wrapper\n├── models.py           # Finding, Severity, ScanReport\n├── checks/\n│   ├── base.py         # BaseCheck ABC\n│   ├── rbac.py         # RBAC checks\n│   ├── pods.py         # Pod security checks\n│   ├── secrets.py      # Secrets \u0026 config checks\n│   ├── network.py      # Network policy checks\n│   ├── resources.py    # Resource limits checks\n│   └── images.py       # Image security checks\n└── report/\n    ├── console.py      # Rich console output\n    ├── html.py         # HTML report (Jinja2)\n    └── json_report.py  # JSON report\n```\n\nEach check module accepts pre-loaded K8s resource dicts via `KubeResources`, allowing testing with fixture data without a live cluster.\n\n## Development\n\n```bash\n# Install dev dependencies\nmake dev\n\n# Run tests\nmake test\n\n# Run tests with coverage\nmake test-cov\n\n# Lint\nmake lint\n```\n\n## License\n\nMIT - Joe Munene 2026\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjoemunene-by%2Fghostaudit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjoemunene-by%2Fghostaudit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjoemunene-by%2Fghostaudit/lists"}