KubeLinter, Four Findings On A Bare Deployment
kube-linter on EL 10 from the GitHub release, pinned by a SHA-256 the role carries (the vendor publishes no checksum file), re-checked by the live test, which then lints a Deployment with one container and nothing else, expecting run-as-non-root, no-read-only-root-fs and the two unset-resource checks with exit 1. Pinned. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-09-21 · podman 4.9.3 · ansible 2.21.4 · how we verify
Documentation
kube-linter
The StackRox CLI (kube-linter) on EL 10 from the vendor's GitHub release,
checked against a SHA-256 pinned beside the version, installed as root's
binary in /usr/local/bin. Original role for EL 10, live-tested with
podman on Rocky Linux 10.
No package, and no checksum file to speak of. EL 10 carries no
kube-linter. StackRox publishes sigstore bundles beside the assets and no checksum file; the bundles need cosign to check. This role pins the SHA-256 per architecture
beside the version, has Ansible's get_url refuse the asset unless it
matches, and the live test checksums the asset on disk again. A new
release is a new pair, on purpose.
Proven to do its work. The live test runs kube-linter lint /tmp/kube-linter-p/deploy.yaml and
expects "found 4 lint errors" - the binary did the manifest-linting work it is
installed for, on an input the test wrote.
Four findings on a bare Deployment. The live test writes a
Deployment with one container and nothing else and expects kube-linter lint to exit 1 naming run-as-non-root, no-read-only-root-fs and the two
unset-resource checks; checks list is expected to describe dozens of
checks. The amd64 asset has no architecture suffix and the arm64 one
does; the defaults carry that map.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-argocd-cli
The argocd client on EL 10 from the GitHub release, refused by Ansible's get_url unless its SHA-256 is the one in the vendor's cli_checksums.txt, and re-checked with sha256sum -c by the live test, which then runs argocd app list with no server and expects 'server address unspecified'. The server is a cluster install, not this role. Original role, live-tested on Rocky Linux 10.
ansible-argo
argo on EL 10 from the GitHub release; the asset is a bare gzip; get_url refuses it unless its SHA-256 is in the vendor's checksums file, and the live test re-checks it, then has lint --offline pass a valid Workflow and fail one whose entrypoint is missing (exit 1); list stops at the missing cluster. Pinned. Original role, live-tested on Rocky Linux 10.
ansible-cilium-cli
cilium on EL 10 from the GitHub release, refused by Ansible's get_url unless its SHA-256 is the one in the per-asset .sha256sum Cilium publishes, and re-checked with sha256sum -c by the live test, which then runs cilium config view with no cluster and expects the refused connection. Installing Cilium into a cluster stays yours. Original role, live-tested on Rocky Linux 10.
ansible-flux-cli
flux on EL 10 from the GitHub release, refused by Ansible's get_url unless its SHA-256 is the one in the vendor's checksums file, and re-checked with sha256sum -c by the live test, which then runs flux check --pre with no cluster and expects the refused connection. Flux also signs the checksums with cosign; this role checks the hash. Original role, live-tested on Rocky Linux 10.
ansible-helm
helm on EL 10 from get.helm.sh, refused by Ansible's get_url unless its SHA-256 is the one in the .sha256sum file published beside the tarball, and re-checked with sha256sum -c by the live test, which then runs helm list with no cluster and expects 'kubernetes cluster unreachable'. Pinned; a newer release is a variable change. Original role, live-tested on Rocky Linux 10.
ansible-helmfile
helmfile on EL 10 from the GitHub release, refused by Ansible's get_url unless its SHA-256 is the one in the project's checksums file, and re-checked with sha256sum -c by the live test, which then runs helmfile list on a one-release file with no helm on the host and expects it to read the file and stop at the missing helm; pair it with the helm role. Original role, live-tested on Rocky Linux 10.