vamp-k8s-audit

Kubernetes Security Auditor — part of the VampSecure Labs toolkit.

Detects dangerous configurations in Kubernetes clusters through kubectl queries (no SDK required). Produces structured findings with remediation guidance, JSON output, and a professional HTML report for client delivery.

Prerequisites

• Python 3.8+
• kubectl installed and reachable in PATH
• Active cluster access — the current kubectl context must point to the target cluster
• Sufficient RBAC permissions to read: pods, services, secrets, configmaps, clusterrolebindings, rolebindings, networkpolicies, ingresses, namespaces, nodes

Optional, for PDF export:

pip install fpdf2>=2.7

Installation

git clone <repo-url> vamp-k8s-audit
cd vamp-k8s-audit
pip install -r requirements.txt   # optional, only needed for PDF

No additional dependencies beyond Python stdlib are required for JSON and HTML output.

Usage

# Basic audit — current kubectl context, all namespaces
python3 vamp_k8s_audit.py

# Specific context and namespace
python3 vamp_k8s_audit.py --context prod-cluster --namespace production

# Save findings as JSON
python3 vamp_k8s_audit.py --output findings.json

# Generate professional HTML report for client delivery
python3 vamp_k8s_audit.py \
  --report-html report.html \
  --client "Acme Corp S.A." \
  --engagement "Kubernetes Security Review Q3-2026" \
  --auditor "VampSecure Labs"

# Custom kubeconfig path
python3 vamp_k8s_audit.py --kubeconfig ~/.kube/custom-config --context staging

# Skip image analysis (faster)
python3 vamp_k8s_audit.py --skip-images --output findings.json

# Verbose mode (show evidence in console)
python3 vamp_k8s_audit.py --verbose

# Full example
python3 vamp_k8s_audit.py \
  --context production \
  --namespace app-prod \
  --client "Client Name" \
  --engagement "K8S-Audit-2026" \
  --auditor "Analyst Name" \
  --output results.json \
  --report-html report.html \
  --verbose

CLI Arguments

Audit Phases and Finding IDs

Finding Severity Distribution

Exit Codes

These codes are suitable for use in CI/CD pipelines to gate deployments.

Output Formats

Console — Color-coded ANSI output with severity badges, affected resources, and a summary table.

JSON (--output FILE) — Structured VSL schema with metadata, summary by severity, and full finding detail.

HTML (--report-html FILE) — Standalone professional report for client delivery. Includes cover page, executive summary with risk bars, findings table, and detailed cards. No external dependencies (fully self-contained).

Required RBAC Permissions

The tool requires read-only access to cluster resources. A minimal ClusterRole:

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: vamp-k8s-audit-reader
rules:
- apiGroups: [""]
  resources:
  - pods
  - services
  - secrets
  - configmaps
  - namespaces
  - nodes
  - serviceaccounts
  verbs: ["get", "list"]
- apiGroups: ["rbac.authorization.k8s.io"]
  resources:
  - clusterroles
  - clusterrolebindings
  - roles
  - rolebindings
  verbs: ["get", "list"]
- apiGroups: ["networking.k8s.io"]
  resources:
  - networkpolicies
  - ingresses
  verbs: ["get", "list"]

Legal Notice

This tool is intended for authorized security audits only. Using it against clusters you do not have explicit permission to test is illegal and unethical.

© VampSecure Studios — VampSecure Labs Security Research Division
All rights reserved. Authorized use only.