Skip to content

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

[0.0.36] - 2026-08-13

Added

  • Added 20 native Kubernetes checks to the CLI and Headlamp plugin, bringing the generated Kubernetes check catalog to 146 checks:
  • CFG004 - Detects deprecated Kubernetes API usage.
  • CFG005 - Detects missing or unavailable metrics-server.
  • CFG006 - Detects risky CoreDNS rewrite, hosts, proxy, or broad forwarding configuration.
  • CFG007 - Detects duplicate environment variable keys in containers.
  • CFG008 - Detects deprecated spec.serviceAccount usage and recommends spec.serviceAccountName.
  • NET023 - Detects NetworkPolicy selectors that currently match no pods or namespaces.
  • NET024 - Detects publicly exposed sensitive admin interfaces.
  • NODE004 - Detects node taints that no current pod tolerates.
  • RBAC011 - Detects Roles and ClusterRoles that can delete Kubernetes Events.
  • SEC037 - Detects containers that appear to run or expose SSH.
  • SEC038 - Detects sensitive writable hostPath mounts.
  • SEC040 - Detects projected ServiceAccount tokens with weak audience or expiration scoping.
  • WRK022 - Detects HPA burst settings that can exceed cluster CPU or memory capacity.
  • WRK023 - Detects multiple PodDisruptionBudgets matching the same workload.
  • WRK024 - Detects PodDisruptionBudgets that cannot currently allow voluntary disruptions.
  • WRK025 - Detects identical readiness and liveness probes.
  • WRK026 - Detects missing ephemeral-storage requests or limits.
  • WRK027 - Detects StatefulSets missing a valid headless Service.
  • WRK028 - Detects HorizontalPodAutoscalers with missing target workloads.
  • WRK029 - Detects PodDisruptionBudgets without intentional unhealthy pod eviction policy settings.
  • Added the new security/networking signals to CLI and Headlamp risk paths:
  • SEC038 now contributes to Container Isolation Risk.
  • NET023 and NET024 now contribute to Namespace Isolation Risk.
  • SEC040 now contributes to ServiceAccount Trust Risk.

Changed

  • Bumped Go dependencies from open Dependabot updates:
  • cloud.google.com/go/container from 1.53.0 to 1.53.1.
  • k8s.io/apimachinery and k8s.io/client-go from 0.36.2 to 0.36.3.
  • Updated the pinned docker/login-action SHA used by the Docker build workflow.

Fixed

  • Updated the Headlamp plugin lockfile to resolve Dependabot alerts for fast-uri, js-yaml, postcss, and undici.

[0.0.35] - 2026-07-22

Fixed

  • Bumped google.golang.org/grpc from 1.81.1 to 1.82.1, including upstream security fixes for HTTP/2 frame flood handling and xDS RBAC parsing/matching behavior.
  • Updated the Headlamp plugin lockfile to resolve high and critical npm audit findings for brace-expansion, fast-uri, js-yaml, and tar.

[0.0.34] - 2026-07-22

Added

  • Added additional Kubernetes risk checks for secrets, ConfigMaps, workload resilience, pod isolation, networking, and RBAC correlation:
  • SEC031 – Detects private key and secret-like material in Kubernetes Secrets while avoiding expected TLS and service-account token fields.
  • SEC032 – Detects expired or soon-to-expire TLS certificates in kubernetes.io/tls Secrets.
  • SEC033 – Flags sensitive-looking values stored in ConfigMaps.
  • SEC034 – Flags workloads using end-of-life base image families.
  • SEC035 – Flags container images that are not pinned to immutable digests.
  • SEC036 – Detects Docker-in-Docker style workload patterns.
  • NET021 – Detects workload egress exposure to cloud metadata APIs.
  • NET022 – Detects Endpoints that point at cloud metadata IPs.
  • RBAC007 – Detects anonymous or broad authenticated subject bindings.
  • RBAC008 – Detects cross-namespace ServiceAccount RoleBindings.
  • RBAC009 – Detects default ServiceAccounts with dangerous permissions.
  • RBAC010 – Detects sensitive ServiceAccounts bound to workloads.
  • WRK017 – Flags single-replica workloads.
  • WRK018 – Flags Deployments using the Recreate strategy.
  • WRK019 – Flags Deployments with revision history disabled.
  • WRK020 – Flags workload DNS and host alias overrides.
  • WRK021 – Flags workloads missing a PriorityClass.
  • POD011 – Detects shared process namespace usage.
  • POD012 – Detects zero termination grace periods.
  • POD013 – Detects bidirectional mount propagation.
  • Added Risk Paths to correlate individual findings into direct risk paths and chained paths:
  • RISK001 – Container Isolation Risk.
  • RISK002 – Namespace Isolation Risk.
  • RISK003 – RBAC Privilege Risk.
  • RISK004 – ServiceAccount Trust Risk.
  • RISK007 – Secret Exposure Risk.
  • CHAIN001 – Workload to Cluster Control Path.
  • CHAIN002 – Cross-Namespace Privilege Path.
  • CHAIN003 – ServiceAccount to Cluster Control Path.
  • CHAIN005 – Secret Exposure to Cluster Control Path.
  • Added Risk Paths output to JSON reports, the HTML report, and the Headlamp plugin export.
  • Added validation-proof commands, evidence links, and attack graph data for Risk Paths results.
  • Added user-facing Risk Paths documentation explaining RISK###, CHAIN###, validation proof, evidence, and remediation flow.
  • Added a Risk Paths planning document covering future RISK004-RISK010 direct paths and CHAIN003-CHAIN010 chained paths.

Changed

  • Improved the Headlamp plugin and HTML report Risk Paths UX so triggered risk areas are shown first, clear risk areas are optional, and compound attack paths only appear when multiple active risk areas create a higher-impact route.
  • Improved the Headlamp plugin with KubeBuddy status pills on resource tables and detail views, including resource-scoped finding drawers and cluster-aware navigation back to the KubeBuddy summary or check details.
  • Aligned new networking checks with the existing Networking category and new RBAC checks with the existing RBAC/Security grouping.
  • Improved TLS Secret and Secret material checks to reduce false positives for expected TLS, service-account token, and platform-managed secret formats.

[0.0.33] - 2026-07-15

Security

  • Bumped golang.org/x/crypto from 0.51.0 to 0.52.0 to address CVE-2026-39834, which could cause an infinite loop on large channel writes.

Changed

  • Bumped golang.org/x/term from 0.44.0 to 0.45.0.

[0.0.32] - 2026-07-02

Added

  • Added additional Kubernetes risk checks:
  • JOB003 – Flags CronJobs with risky scheduling or retention settings.
  • POD010 – Detects naked Pods that are not owned by a workload controller.
  • RBAC006 – Detects bound Roles and ClusterRoles that grant dangerous verbs or subresources such as impersonate, bind, escalate, pods/exec, pods/portforward, or broad Secret access.
  • SEC029 – Detects sensitive hostPath mounts such as container runtime sockets and broad host filesystem paths.
  • SEC030 – Flags admission webhooks that fail open, omit sideEffects, or apply too broadly.
  • WRK016 – Adds an advisory check for workloads missing the recommended app.kubernetes.io label set.
  • Added Headlamp plugin native handlers for the new Kubernetes risk checks and test coverage for the generated check catalog.
  • Added resource-level check suppressions with kubebuddy.io/ignore-checks annotations, including wildcard * support and optional reason/expiry metadata.

Changed

  • Improved the KubeBuddy Headlamp plugin finding experience:
  • Findings tables now show captured evidence separately from the reason KubeBuddy flagged the issue.
  • YAML-backed findings show the affected path and captured value, such as spec.hostPID: true.
  • Finding detail drawers now show a focused YAML snippet and highlight the affected config line.
  • CSV exports now include the captured evidence plus YAML path/snippet fields for offline review.
  • Sensitive hostPath findings now show the matched hostPath.path value directly in the evidence column and detail drawer.
  • Check cards in section tabs now sort naturally by check ID, such as POD001 through POD010.
  • Added a Score trend panel to the KubeBuddy Headlamp plugin:
  • Completed scan scores are kept as a short per-cluster trend in the browser local cache.
  • Trend points and lines use the same score bands as the main score chart.
  • The panel labels the history as local-only and links to KubeBuddy Radar for shared, long-term, and cross-cluster history.
  • Improved remediation guidance for SEC027, SEC028, SEC029, SEC030, RBAC005, RBAC006, POD010, JOB003, NET020, and PVC005 with more concrete operator next steps.
  • Updated the CLI JSON report and Headlamp plugin JSON export to keep suppressed findings in separate suppression metadata while excluding them from active findings and score calculations.

Fixed

  • Fixed CFG002 so Kubernetes-managed kube-root-ca.crt ConfigMaps are ignored when checking for duplicate ConfigMap names across namespaces.
  • Refined NET001, SEC001, RBAC002, and RBAC006 handling for closer CLI and Headlamp plugin parity.

[0.0.31] - 2026-06-23

Added

  • KubeBuddy Headlamp plugin
  • Added the first KubeBuddy Headlamp plugin release.
  • Runs Kubernetes checks from inside Headlamp using the active cluster resources Headlamp can already read.
  • Provides a summary score, severity counts, namespace exclusions, grouped finding cards, recommendations, and resource links.
  • Supports JSON report export and CSV findings export.
  • Supports importing and exporting browser-supported kubebuddy-config.yaml settings.
  • Publishes with the main KubeBuddy release and records both the plugin package version and the KubeBuddy checks version included in the plugin.
  • Added Headlamp plugin documentation covering install, scope, configuration, exports, and release versioning.

Fixed

  • Fixed NET019 so Services that omit spec.externalIPs no longer fail the external IP check.

Changed

  • Updated Headlamp plugin npm dependency overrides:
  • Bumped form-data from 4.0.5 to 4.0.6.
  • Bumped undici from 7.27.2 to 7.28.0.

[0.0.30] - 2026-05-26

Added

  • Kubernetes best-practice checks for current platform risks
  • NET019 – Flags Services that use spec.externalIPs, which can bypass normal load balancer ownership and create traffic interception risk.
  • NET020 – Detects Ingress-NGINX controller components so teams can review maintenance and Gateway API migration plans.
  • POD009 – Flags pods whose allocated device resources report Unhealthy or Unknown status.
  • PVC005 – Detects PVC volume expansion failure signals from claim status and resize events.
  • RBAC005 – Flags bound Roles and ClusterRoles that grant broad nodes/proxy kubelet access.
  • SEC027 – Flags pods using legacy gitRepo volumes.

  • SEC028 – Flags Pods and ServiceAccounts using imagePullSecrets so long-lived registry credentials can be reviewed and rotated.

  • Embedded check catalog fallback

  • The native binary now embeds the default Kubernetes, AKS, and GKE check catalogs so fresh PowerShell Gallery and standalone binary installs can run even if external checks/ files are missing.

  • kubebuddy checks now reports whether the active catalog was loaded from the filesystem or the embedded fallback.

  • Advisory check metadata

  • Added check_type: advisory support for softer review items such as Ingress-NGINX detection and image pull secret review.

  • Validating Admission Policy checks (SEC024–SEC026)

  • ValidatingAdmissionPolicy and ValidatingAdmissionPolicyBinding resources are now collected as part of the standard Kubernetes data collection pass.
  • SEC024 – Flags ValidatingAdmissionPolicy resources with spec.failurePolicy: Ignore. When CEL evaluation errors occur the admission request is silently allowed, bypassing enforcement.
  • SEC025 – Flags ValidatingAdmissionPolicy resources that have no associated ValidatingAdmissionPolicyBinding. Without a binding the policy is never applied to any resource.
  • SEC026 – Flags ValidatingAdmissionPolicy resources with an empty spec.validations list. A policy with no CEL rules enforces nothing and is a no-op.

  • Both resource types are treated as cluster-scoped and are silently skipped on clusters that do not support them (pre-1.26).

  • Runtime check exclusions

  • Added --excluded-checks to kubebuddy run, kubebuddy scan, kubebuddy scan-aks, and kubebuddy scan-gke for comma-separated one-off check exclusions.
  • Added -ExcludedChecks to the PowerShell wrapper and EXCLUDED_CHECKS to Docker/container env mode.
  • Runtime exclusions are merged with excluded_checks from kubebuddy-config.yaml, and JSON report metadata now includes the applied excludedChecks list.

Changed

  • Added aks-command to the default namespace exclusion list.
  • Consolidated default namespace exclusions so the collector and config loader share the same source of truth.
  • Reduced noise for SEC028 by flagging direct Pod imagePullSecrets and the default ServiceAccount only.
  • Reduced RBAC false positives by ignoring Kubernetes default/system bindings, excluded-namespace ServiceAccount subjects, and valid RoleBindings to existing ClusterRoles.
  • Fixed namespace exclusion handling so additional excluded namespaces enable filtering for the run and collector filtering respects the resolved config list instead of re-adding defaults.
  • Fixed SEC015 so pods that omit spec.serviceAccountName are treated as using the default ServiceAccount.
  • Fixed SEC018 so ServiceAccounts that omit automountServiceAccountToken are treated as token automounting being enabled.

[0.0.29] - 2026-04-22

Added

  • GKE support
  • 22 new GKE best practice checks across Best Practices, Security, Monitoring, and Networking categories.
  • New --gke flag on the run command for live GKE cluster scanning via Application Default Credentials.
  • --input flag for offline scanning from a previously collected GKE JSON snapshot.
  • GKE tab in HTML reports with per-check pass/fail results, a cluster score, and an A–F letter rating.

  • New documentation page covering GKE setup, required IAM permissions, and the full check catalog.

  • Prometheus compatibility for GKE Managed Prometheus (GMP)

  • Prometheus metric collection (--include-prometheus) now works with GKE clusters using Google Managed Prometheus without node-exporter.
  • When node-exporter is not deployed, CPU and memory metrics fall back to cAdvisor (container_cpu_usage_seconds_total, container_memory_working_set_bytes) and kubelet machine metrics (machine_cpu_cores, machine_memory_bytes), which are always available in GMP managed collection.
  • Query fallback is applied at the Go level (node-exporter → Anthos recording rules → cAdvisor) so a missing or unsupported metric name on one provider never blocks results from another.
  • PROM006 (Node Sizing) and the 24-hour metrics snapshot both use the same layered fallback strategy.

  • Prometheus query failures are now logged clearly rather than silently producing "metrics": null in the JSON report.

  • PROM008 – Node Exporter Not Deployed check

  • New check that flags when node-exporter is not found as a DaemonSet, explaining that PROM006 node sizing and node-level metrics depend on it.
  • Includes platform-specific remediation guidance for GKE with GMP, OSS kube-prometheus-stack, and AKS Managed Prometheus.

Changed

  • Each check now renders as its own card in HTML reports
  • Checks on all standard tabs (Security, Networking, Workloads, Pods, Configuration, Events, etc.) now each appear in a separate card, consistent with the layout already used on the Node Conditions tab.
  • PROM008 on the Nodes tab now uses the same card layout and heading style as NODE001–PROM006 rather than a different fallback style.

[0.0.28] - 2026-04-15

Added

  • Go-first release packaging
  • Added native release packaging for macOS and Linux through the local release build script.
  • Added GitHub release workflow support for publishing native tarballs, checksums, and the PowerShell wrapper package.
  • Added a hardened Go-native container image workflow and direct Azure token support for AKS and Azure-authenticated Prometheus flows in containerized runs.

  • Added Windows native release artifacts and bundled native binaries in the PowerShell Gallery package.

  • Native interactive terminal UI

  • Added a unified kubebuddy tui entrypoint for guided report generation and interactive check browsing.
  • Added PowerShell wrapper support for -Tui, -Guided, and -Menu so the compatibility module can launch the native terminal UI directly.

Changed

  • Native runtime is now the primary product
  • The Go CLI is now the main KubeBuddy runtime for local use, container use, and report generation.
  • The PowerShell Gallery package is now a backwards-compatible wrapper over the native kubebuddy binary instead of a separate PowerShell runtime.
  • All shipped Kubernetes and AKS checks now live in the native checks/ catalog layout.
  • Report CSS and JavaScript assets now live under the native Go reports package instead of the old PowerShell-era path.
  • AKS live collection and container AKS auth now use native Go Azure token handling and bearer-token kubeconfig wiring instead of depending on az or kubelogin.
  • The container image is now intentionally non-interactive and supports the native run-env flow only.

Removed

  • Legacy PowerShell runtime
  • Removed the old PowerShell scan engine, AKS check runner, report generators, helper modules, and container entrypoint.
  • Removed the legacy Private/yamlChecks catalog after switching the native runtime to checks/kubernetes.
  • Removed migration-only documentation and stale PowerShell-only tests that no longer reflect the supported runtime model.

Docs

  • Updated installation, PowerShell wrapper, Docker, Radar, and release documentation for the Go-first release model.

[0.0.27] - 2026-04-09

Added

  • CSV report support in container runs
  • Added CSV_REPORT support to run.ps1 so the Docker image can generate CSV output in the same way as the PowerShell module.
  • Added a regression test for Docker entrypoint report forwarding and a PR Pester workflow so report-format wiring issues are caught before merge.

Thanks

  • Thanks to @martinpronk for the CSV report support contribution in PR #38.

[0.0.26] - 2026-03-31

Added

  • AKS Automatic migration readiness derived from shared checks
  • Added a derived AKS Automatic migration readiness view to HTML, text, CLI, and JSON outputs when running KubeBuddy with -Aks.
  • Added a standalone *-aks-automatic-action-plan.html artifact focused on migration work, with a suggested migration sequence, blocker-driven actions, warning-driven actions, and Microsoft Learn links for creating a new AKS Automatic cluster.
  • Added JSON output fields for metadata.aksAutomaticSummary and aksAutomaticReadiness.*.
  • Added affected-resource resolution back to owning workloads and Helm-managed sources where possible so findings point users to the manifest or chart that actually needs to change.
  • Added skip logic so the readiness view is not generated when the source AKS cluster already uses sku.name = Automatic.

  • Added structured affected-resource tables and manifest examples to the standalone action plan.

  • New shared Kubernetes checks used by AKS Automatic readiness

  • Added WRK014 for missing memory limits.
  • Added WRK015 for replicated workloads missing anti-affinity or topology spread constraints.
  • Added AKS Automatic migration relevance to NET013 for Ingress-to-Gateway API planning.
  • Added NET018 for duplicate Service selectors.
  • Added SEC020 for workloads that do not explicitly configure a seccomp profile.

Changed

  • AKS Automatic readiness now follows observed cluster admission behavior
  • Updated shared checks and AKS Automatic metadata to reflect observed AKS Automatic behavior rather than treating all AKS best-practice issues as migration blockers.
  • WRK005 now focuses on missing resource requests, while missing memory limits remain a separate best-practice warning via WRK014.
  • POD007 now detects both :latest images and images without an explicit version tag.
  • Added AKS Automatic blocker/warning metadata to relevant shared checks for host namespaces, privileged containers, hostPath, hostPort, seccomp, procMount, AppArmor, Linux capabilities, probes, storage provisioners, and AKS alignment checks.
  • Updated the standalone action plan layout from a compact table to full-width action cards for readability.
  • Split standalone migration actions into blocker and warning sections so only blocker items are treated as mandatory before migration.
  • Added Gateway API migration guidance for clusters still relying on Ingress assumptions.
  • Removed the target-cluster build section from the rendered AKS Automatic reports so the feature stays focused on migration blockers and warnings.

Docs

  • Updated documentation for:
  • AKS Automatic migration readiness under the AKS usage page
  • shared checks reference entries for the new and updated checks

[0.0.25] - 2026-03-12

Added

  • Radar report upload support for storage and comparison
  • Added support to upload KubeBuddy JSON scan reports to Radar so teams can keep report history over time.
  • Uploaded reports can now be used for comparison workflows and trend tracking across cluster runs.

  • https://radar.kubebuddy.io

  • Radar profile pull support in KubeBuddy CLI

  • Added -RadarFetchConfig and -RadarConfigId so KubeBuddy can pull a saved profile before running checks.

  • Added run.ps1 support for Radar config pull so containerized runs can use the same profile-driven workflow.

  • Improved cluster metadata in JSON output

  • Added stronger propagation of cluster name, AKS resource group, and subscription metadata into generated JSON report payloads.

Changed

  • Cluster identity consistency in CLI flows

  • Updated CLI data flow to prioritize explicit cluster identity fields so scan metadata stays consistent across runs.

  • Namespace exclusion output behavior

  • Improved how excluded namespaces are represented in JSON output and downstream report-processing flows.

Fixed

  • AKS cached metadata reuse

  • Fixed cached AKS metadata behavior to reduce incorrect value carry-over between different cluster runs.

  • Gateway API noise in scan output

  • Reduced noisy output when Gateway API CRDs are not installed by suppressing unnecessary missing resource-type errors.

[0.0.24] - 2026-02-26

Enhanced

  • Comprehensive AKS check improvements and message quality
  • Improved all AKS best-practice checks with more actionable recommendations (Azure CLI snippets, implementation guidance, and remediation context).
  • Expanded AKS failure messages with clearer risk/impact context (security, availability, performance, and compliance implications).

Technical Details

  • AKS check files updated:
  • Private/aks/checks/SecurityChecks.ps1
  • Private/aks/checks/IdentityAndAccessChecks.ps1
  • Private/aks/checks/NetworkingChecks.ps1
  • Private/aks/checks/ResourceManagementChecks.ps1
  • Private/aks/checks/BestPracticesChecks.ps1
  • Private/aks/checks/DisasterRecoveryChecks.ps1
  • Private/aks/checks/MonitoringLoggingChecks.ps1

Added

  • Radar report upload support for storage and comparison
  • Added support to upload KubeBuddy JSON scan reports to Radar so teams can keep report history over time.

  • Uploaded reports can now be used for comparison workflows and trend tracking across cluster runs.

  • Radar profile pull support in KubeBuddy CLI

  • Added -RadarFetchConfig and -RadarConfigId so KubeBuddy can pull a saved profile before running checks.

  • Added run.ps1 support for Radar config pull so containerized runs can use the same profile-driven workflow.

  • Improved cluster metadata in JSON output

  • Added stronger propagation of cluster name, AKS resource group, and subscription metadata into generated JSON report payloads.

Changed

  • Minimum Prometheus history gate for sizing recommendations
  • PROM006 and PROM007 now require at least 7 days of Prometheus history before recommendations are emitted.
  • When history is insufficient, reports show explicit informational rows indicating required vs available days.

  • Improved history-span detection to use cluster-level coverage queries, reducing false low Available Days values in high pod-churn environments.

  • PROM007 output simplification and UX

  • Reduced pod sizing findings columns to core current-vs-recommended CPU/memory request/limit values.
  • Removed action/rationale columns from findings table; CPU-limit rationale remains in the recommendation section.
  • Kept multi-profile comparison support and improved profile selector behavior in HTML reports.
  • Updated sizing analysis to a fixed 7-day window for Prometheus reliability, and surfaced the active window in check summaries.
  • Added PROM007 findings filters for Namespace and Profile in HTML; pagination now respects these filters.
  • Updated PROM007 current request/limit values to read directly from live pod specs, improving reliability when kube-state-metrics resource series are unavailable.
  • Updated all HTML paginations to compact mode with ellipses for large page counts, reducing oversized pager rows.
  • Updated PROM007 to suppress rows where recommendations do not materially differ from current values, and sort remaining rows by highest potential sizing impact first.

  • Optimized Prometheus sizing queries to reduce query-memory pressure (429 responses): added label aggregation for pod sizing and fixed lower-cost 7-day query windows.

  • AKS best-practice output improvements

  • Added ObservedValue to AKS check results and surfaced it in CLI, text, HTML, and JSON outputs.
  • Updated AKS HTML view to group findings by category in collapsible sections for easier remediation workflows.

  • Removed the extra outer "Show Findings" wrapper so category sections are visible immediately.

  • Multi-output report generation

  • Updated Invoke-KubeBuddy to support generating multiple outputs (-HtmlReport, -txtReport, -jsonReport) in a single run using one shared data collection pass.

  • Added YAML check-result caching across output modes to avoid re-running checks when generating HTML + JSON in the same invocation.

  • Networking deprecation handling

  • Switched data collection/check flow to prefer EndpointSlice and avoid always querying deprecated v1 Endpoints on modern Kubernetes versions.

  • Retained legacy Endpoints fallback only when needed.

  • HTML dark-mode readability fixes

  • Improved contrast for overview cards and summary surfaces:
    • black text on orange backgrounds
    • black text on blue info/default cards
    • fixed warning progress-bar label contrast
    • fixed low-contrast hover text in passed/failed status box
    • improved Top-5 + pts text visibility
  • fixed compatibility warning banner text contrast on orange backgrounds

  • updated PROM007 filter labels/dropdowns and pagination controls to use on-brand styling with light/dark theme support

  • Namespace exclusion controls

  • -ExcludeNamespaces now correctly honors configured excluded_namespaces.
  • Added -AdditionalExcludedNamespaces to merge extra runtime namespaces with configured exclusions for a single invocation.

Fixed

  • Module import parser issue
  • Fixed truncated syntax in Private/aks/checks/NetworkingChecks.ps1 that prevented Import-Module .\KubeBuddy.psm1 -Force.
  • WRK001 findings table rendering
  • Removed Format-Table from WRK001 script output so HTML/JSON render proper columns instead of PowerShell formatting metadata fields.
  • Recommendation URL rendering stability
  • Fixed a null-array indexing error in recommendation docs-link display-name parsing when a URL has an empty/short path.
  • PROM007 memory unit conversion
  • Fixed decimal memory quantity conversion (K/M/G/T/P/E) to MiB for current request/limit display, correcting values like 1500M from 1.5 Mi to ~1430.5 Mi.
  • AKS cached object reuse error
  • Fixed duplicate-member error by making AKS KubeData note-property assignment idempotent (Add-Member -Force) during multi-output runs.
  • Secret reference false positives (SEC016)
  • Updated check logic to ignore optional secret references (optional: true) for secretKeyRef, envFrom.secretRef, and volume.secret.
  • Prometheus timeout resiliency
  • Standardized Prometheus query behavior to use configurable timeout and retry settings across summary metrics, YAML Prometheus checks, and sizing insights (PROM006/PROM007).
  • Added consistent retry logging so timeout failures are clearer in CLI output.
  • Prometheus sizing history gate accuracy
  • Updated PROM006/PROM007 history coverage queries to use cluster-level series for day-span detection, avoiding false low Available Days values in high pod-churn environments.

Docs

  • Updated docs for:
  • Prometheus integration and sizing guidance (PROM006 / PROM007)
  • new sizing thresholds and profile options in kubebuddy-config.yaml
  • checks reference entries for new Prometheus sizing checks

[0.0.23] – 2025-06-18

Added

  • Radar report upload support for storage and comparison
  • Added support to upload KubeBuddy JSON scan reports to Radar so teams can keep report history over time.

  • Uploaded reports can now be used for comparison workflows and trend tracking across cluster runs.

  • Radar profile pull support in KubeBuddy CLI

  • Added -RadarFetchConfig and -RadarConfigId so KubeBuddy can pull a saved profile before running checks.

  • Added run.ps1 support for Radar config pull so containerized runs can use the same profile-driven workflow.

  • Improved cluster metadata in JSON output

  • Added stronger propagation of cluster name, AKS resource group, and subscription metadata into generated JSON report payloads.

Changed

  • Updated Recommendations for All Checks:
  • Added links to relevant documentation in the recommendations for all checks across all categories (Best Practices, Disaster Recovery, Identity & Access, Monitoring & Logging, Networking, Resource Management, and Security), providing actionable guidance for each check.
  • Replaced Cluster Health Score Donut with Passed/Failed Chip:
  • Removed the circular progress bar (donut) for the Cluster Health Score in the dashboard.
  • Replaced it with a chip-style element for "Passed / Failed Checks" (e.g., "45 / 92 Passed"), aligning with the existing chip design for consistency.
  • Updated Chip Color Logic in Dashboard:
  • Adjusted the pass rate thresholds for the "Passed / Failed Checks" chip to better reflect cluster health:
    • Red (Critical): <48% pass rate (lowered from 50% to account for near-threshold states).
    • Yellow (Warning): 48%–79% pass rate.
    • Green (Healthy): ≥80% pass rate.
  • With the current pass rate of 48.91% (45/92), the chip now displays as yellow instead of red, aligning with the updated threshold.

Fixed

  • NET003 Check:
  • Fixed an issue with the AKSNET003 ("Web App Routing Enabled") check to ensure it correctly evaluates the configuration and reports accurate results.

Notes

  • HTML Report Update:
  • Improved the visual design of the HTML report for better readability and user experience, as part of ongoing enhancements to the reporting interface.

[0.0.17] - 2025-04-25

Added

  • Migrated to YAML-based Checks:
  • Replaced pure PowerShell checks with YAML-defined checks for better maintainability and scalability.
  • Each check now has a unique ID for easier identification and referencing in reports (e.g., AKSNET001, NS001).
  • New Alerts:
  • Added new YAML-based alerts to enhance cluster monitoring.
  • Custom Checks HTML Tab
    Automatically gathers any YAML‑defined checks whose section names aren’t in the standard list (Nodes, Namespaces, Workloads, etc.) into a new “Custom Checks” tab. Only shows the tab if there’s at least one real <tr>…</tr> snippet.
  • Exclude Checks Support
    You can now explicitly exclude checks by their ID using the ExcludedChecks parameter. Excluded checks are skipped during evaluation and omitted from reports.
  • Multi-Architecture Docker Container:
  • Updated the Dockerfile to support both linux/amd64 and linux/arm64 architectures using Docker Buildx.
  • Dynamically downloads architecture-specific kubectl and kubelogin binaries based on the target platform ($TARGETARCH).
  • Updated GitHub Action for Multi-Architecture Builds:
  • Modified the GitHub Action workflow to use Docker Buildx for building and pushing multi-architecture images (linux/amd64 and linux/arm64) to GHCR.
  • Added support for tagging and pushing a latest tag for multi-architecture images.

Changed

  • Updated HTML Report:
  • Replaced single-page layout with a tab-based interface for better structure and usability.
  • Improved visuals, section separation, and print/export support.
  • AKS Results in Text Report:
  • Updated Generate-K8sTextReport to properly capture and write AKS results to the text report, including detailed check results and the summary table ("Summary & Rating").
  • Ensured the AKS summary table is consistently included in the text report output.
  • Improved Check Processing:
  • Refactored Invoke-AKSBestPractices to return structured data for text reports, removing direct Write-ToReport calls and allowing the caller (Generate-K8sTextReport) to handle file writing.

Fixed

  • Text Report AKS Summary Table:
  • Fixed an issue where the AKS summary table was not appearing in the text report by ensuring the TextOutput property is correctly written to the file.
  • File Path Scoping in Write-ToReport:
  • Updated Write-ToReport to accept a file path parameter, ensuring proper scoping and avoiding reliance on a global $ReportFile variable.S

[0.0.16] - 2025-04-16

Fixed

  • CRD JSON Parsing Error: Fixed an issue when fetching Custom Resource Definitions (CRDs) where ConvertFrom-Json failed due to key casing conflicts (proxyUrl vs proxyURL). CRDs are now parsed using -AsHashtable to avoid this conflict and allow consistent key access.
  • AKS Parameter Logic: Fixed incorrect AKS metadata fetch behavior. Previously, AKS metadata was fetched even if the -AKS switch was not passed. Now the call only runs when -AKS is explicitly set.

[0.0.15] - 2025-04-14

Added

  • Docker Container Support for KubeBuddy:
  • Created a multi-stage Dockerfile to build the KubeBuddy container image:
    • Build stage: Uses mcr.microsoft.com/powershell:7.5-Ubuntu-22.04 for reliable setup of kubectl, powershell-yaml, Azure CLI, and the KubeBuddy module.
    • Runtime stage: Uses mcr.microsoft.com/powershell:7.5-Ubuntu-22.04 to avoid dependency issues and ensure compatibility with the Azure CLI and kubeconfig setups.
  • Added adduser and coreutils to the build stage for file operations and permissions setup.
  • Added support for passing Azure SPN details and kubeconfig via environment variables and volume mounts, allowing for a smoother integration with AKS and other Kubernetes clusters.
  • Support for an optional thresholds YAML file: The file can be mounted at /home/kubeuser/.kube/kubebuddy-config.yaml (equivalent to $HOME/.kube/kubebuddy-config.yaml for the container user). This file allows customizing thresholds for alerts (e.g., CPU usage, pod age).
  • Created the /app/Reports directory during the build process (rather than copying from the host) to ensure a clean, fresh output directory for reports.
  • Copied KubeBuddy module files (KubeBuddy.psm1, KubeBuddy.psd1, Private, and Public) from the Git repository to /usr/local/share/powershell/Modules/KubeBuddy/, preserving module structure.
  • Ensured reports are accessible by mounting /app/Reports to a local volume for clean report generation.
  • AKS-Specific Checks:
  • Added a check to see if Vertical Pod Autoscaler (VPA) is enabled, as it is now part of Azure Advisor recommendations.
  • Kubernetes checks
  • Introduced new RBAC checks:
    • Check-RBACMisconfigurations: Detects missing roleRef in RoleBindings and ClusterRoleBindings.
    • Check-RBACOverexposure: Flags ServiceAccounts with excessive permissions like cluster-admin or wildcard access, and identifies roles with dangerous verbs (e.g., create, update, delete).
    • Check-OrphanedRoles: Flags RoleBindings/ClusterRoleBindings with no subjects and Roles/ClusterRoles with no rules.
  • Added Severity and Recommendation columns to RBAC check outputs to provide actionable insights and prioritize findings.

Fixed

  • AKS Results: Fixed URL to be a clickable link in the AKS results.
  • ServiceAccount Detection: Corrected handling of the namespace field in RoleBinding and ClusterRoleBinding subjects within Check-RBACMisconfigurations.
  • Azure CLI Compatibility: Fixed Azure CLI installation by switching to Ubuntu 22.04, ensuring compatibility with the Azure CLI and its dependencies.
  • Validation Logic in run.ps1:
  • Corrected AKS mode validation to ensure $ClusterName, $ResourceGroup, and $SubscriptionId are only required when AKS mode is enabled.
  • Fixed validation check logic by adding parentheses to group conditions properly.
  • Updated $Aks to default to $false unless AKS_MODE is explicitly set to "true".

[0.0.14] - 2025-04-10

Added

  • Added cluster health checks and scoring:
  • Pod health evaluation based on Running and Ready conditions.
  • Node health assessment using Ready condition status.
  • Resource utilization scoring from kubectl top nodes data.
  • Comprehensive health report with total score and detected issues.
  • Added event analysis for cluster health:
  • Analyzes Kubernetes events to identify critical errors and warnings.
  • Reports significant issues (e.g., pod failures, scheduling issues) in the health summary.
  • Improved cluster validation:
  • Introduced robust validation for kubectl availability and connectivity to the current Kubernetes context.
  • Added AKS connectivity checks using az aks show, ensuring the cluster exists and the user is authenticated.
  • Enhanced error handling:
  • Clearer user feedback on failed or unauthorized cluster access with user-friendly Write-Host messages instead of raw exceptions.
  • Fail-fast logic now halts script execution gracefully if core checks fail.
  • New Get-KubeData logic:
  • Now verifies communication with the Kubernetes API server before fetching resources.
  • Graceful fallback if kubectl is present but cluster access is misconfigured.
  • Added support for silent script termination without full exception stack traces using Write-Host and return.

Changed

  • Replaced all direct throw calls in nested modules with friendly error messages and early exit patterns to improve UX.
  • Reorganized cluster validation into a single pre-check block within Get-KubeData for clarity and maintainability.

Fixed

  • Fixed inconsistent behavior where failed parallel resource fetches did not always halt script execution as expected.
  • Corrected exit behavior from AKS metadata fetch section to avoid crashing on partial failure.
  • Fixed Check-IngressHealth function to reliably detect and report ingress issues:
  • Corrected ingress fetching logic to work consistently with or without pre-fetched KubeData.
  • Added checks for missing ingress class, TLS secret validation, duplicate host/path detection, and invalid path types, beyond just service existence.

[0.0.13] - 2025-04-08

Added

  • 11 new checks added to the JSON and HTML reports:
  • Resource configuration:
    • Check-ResourceQuotas
    • Check-NamespaceLimitRanges
    • Check-MissingResourceLimits
    • Check-HPAStatus
    • Check-PodDisruptionBudgets
    • Check-MissingHealthProbes
  • Workload health:
    • Check-DeploymentIssues
    • Check-StatefulSetIssues
  • Networking
    • Check-IngressHealth
  • RBAC and identity:
    • Check-OrphanedRoles
    • Check-OrphanedServiceAccounts
  • HTML report now includes collapsible recommendations for all checks
  • Ingress health check detects references to missing backend services
  • New logic in the HTML report to add pagination when needed

Changed

  • Check-OrphanedRoles filtering updated to properly exclude namespaces during binding resolution
  • JSON report mode now uses $KubeData cache to speed up execution by avoiding duplicate kubectl calls
  • HTML report section order and navigation updated to include new categories and findings

Fixed

  • Fixed logic for HTML checks showing no findings — now prints the ✅ message consistently
  • Corrected orphaned role detection to handle exclusion before usage analysis

[0.0.12] - 2025-03-30

Added

  • Major performance improvement: report generation is now significantly faster due to parallelised kubectl resource fetching in Get-KubeData. This applies to HTML, text, and new JSON reports only, not interactive checks.
  • Added support for -Json output across key functions and checks, enabling structured machine-readable exports.
  • New -Yes parameter added to bypass interactive prompts in non-interactive or CI contexts.
  • Improved HTML report with optional hiding of ✅ sections when no issues are found.

Fixed

  • Fixed incorrect exclusion of stuck jobs due to filtering logic.

Changed

  • Error output during resource fetch and report generation is now cleaner and more informative.

[0.0.11] - 2025-03-28

Fixed

  • Table output now displays correctly when pagination is enabled.

[0.0.10] - 2025-03-26

Added

  • Added Check-PodsRunningAsRoot to identify pods that run with UID 0 or no runAsUser set.
  • Added Check-PrivilegedContainers to detect containers running with privileged: true.
  • Added Check-HostPidAndNetwork to find pods using hostPID or hostNetwork.
  • Added Check-RBACOverexposure to flag direct or indirect access to cluster-admin privileges, including wildcard permissions via custom roles.
  • Added -ExcludeNamespaces switch to most checks and report generators.
  • Automatically uses custom list from kubebuddy-config.yaml if present.
  • Falls back to default list of common system namespaces.
  • Integrated all the above checks into:
  • The RBAC & Security interactive menu
  • The HTML report with collapsible sections
  • The floating sidebar navigation (TOC)
  • Added contextual tooltips to HTML report headers for better inline explanation of metrics and checks.

Fixed

  • Quitting from sub menus does not kill the PowerShell session now.

Changed

  • Updated Show-RBACMenu to include the new security checks as menu options.
  • Updated HTML report to include additional security findings in the Security section.

[0.0.9] - 2025-03-20

Added

  • Added support for specifying custom report filenames with -OutputPath, allowing users to save reports with specific names instead of the default timestamped filename.
  • Reports now automatically include timestamps (YYYYMMDD-HHMMSS) when saved in a directory, preventing accidental overwrites.
  • The documentation has been updated to reflect these changes.

Fixed

  • Improved cross-platform path handling for PowerShell scripts, ensuring compatibility with both Windows and Linux file structures.
  • Ensured that directories are created correctly when specifying an output path.

[0.0.8] - 2025-03-20

Fixed

  • Fixed an issue with where we were importing modules twice.

[0.0.7] - 2025-03-20

Fixed

  • Fixed an issue with folder case to allow linux to import the correct modules.

[0.0.6] - 2025-03-19

Fixed

  • Fixed issue where $moduleVersion was not being correctly updated in the kubebuddy.ps1 script when setting the version dynamically.
  • Corrected the PowerShell script logic to handle version updates reliably using $tagVersion.
  • Resolved an error where the replace operation in the script failed due to incorrect concatenation of the $tagVersion variable.

[0.0.5] - 2025-03-19

Added

  • AKS best practices check with -aks, -SubscriptionId, -ResourceGroup, and -ClusterName, performing 34 different configuration and security checks tailored for Azure Kubernetes Service.

[0.0.4] - 2025-03-12

Added

  • Added new logo to html report.

[0.0.3] - 2025-03-06

Added

  • Initial release of KubeBuddy, providing snapshot-based monitoring, resource usage insights, and health checks for Kubernetes clusters.