Kogaro

What it is

Kogaro is an open-source Kubernetes hygiene validator run as an in-cluster agent (main.go, internal/, Helm charts/), with an optional Wails + Svelte desktop app (ui/) and a separately deployed website. The summary covers its scope; what the page adds is the granular check inventory and the fact that each validation category is gated behind an explicit CLI flag — nothing runs unless you turn it on.

How it works

Validation is opt-in per category. You enable groups of checks with flags, and each check emits a named error (mapped to the KOGARO-XXX-YYY codes). The category-to-flag mapping:

• Reference: --enable-ingress-validation, --enable-configmap-validation, --enable-secret-validation, --enable-pvc-validation, --enable-serviceaccount-validation
• Resource: --enable-resource-limits-validation
• Security: --enable-security-validation (pod/container SecurityContext, privileged mode, privilege escalation, writable root FS, added capabilities) and --enable-security-serviceaccount-validation (ClusterRoleBinding, excessive RoleBinding permissions)
• Image: --enable-image-validation, with --allow-missing-images and --allow-architecture-mismatch to downgrade those to warnings
• Networking: --enable-networking-validation (service selector/endpoint/port mismatches, ingress backend checks) and --networking-policy-validation (orphaned policies, missing default-deny, required-namespace coverage)

Resource checks distinguish QoS outcomes: qos_class_issue (BestEffort) for no constraints, qos_class_issue (Burstable) where requests ≠ limits, plus insufficient_cpu_request / insufficient_memory_request against minimum thresholds.

Preconditions / Affected

Targets running Kubernetes clusters. It ships leader election and HA support, so it's built to run continuously in-cluster rather than as a one-shot linter — though the CI/CD "scoped validation" mode supports pre-deployment scanning too.

What to do

If you adopt it, note that a bare install validates nothing useful until you enable the categories you care about — treat the flags above as the real configuration surface. For security posture specifically, --enable-security-validation plus --enable-security-serviceaccount-validation cover root/privileged containers and RBAC over-provisioning. For outage prevention, the Reference and Networking flags catch dangling refs and services with no ready endpoints. Prometheus metrics export validation error counts and run statistics for alerting.

Caveats

The page is largely the project's own pitch ("the only tool specifically designed for operational configuration hygiene"); treat comparative claims as marketing. Several networking and image checks are warning-only or require explicit allow-flags (pod_no_service, missing_image_warning, architecture_mismatch_warning), so they won't fail a pipeline unless configured to. No version numbers, thresholds, or install commands are given on the fetched page — check the repo for those before committing.