Scan Kubernetes manifests in the pull request, before anything reaches a cluster, by checking each workload against a written baseline such as the Pod Security Standards. The scan reads YAML, needs no cluster access, and fails the build on settings like privileged containers or host path mounts.
What a manifest scan checks
The Kubernetes Pod Security Standards define three cumulative levels: Privileged, Baseline and Restricted. Baseline blocks known privilege escalations. Restricted applies current hardening practice.
| Setting | Baseline | Restricted |
|---|---|---|
| privileged container | Must be unset or false | Same |
| hostNetwork, hostPID, hostIPC | Must be unset or false | Same |
| hostPath volumes | Forbidden | Only non host volume types |
| Seccomp profile | Must not be Unconfined | RuntimeDefault or Localhost |
| Run as non-root | Not required | Required |
| Allow privilege escalation | Not required | Must be false |
| Capabilities | Limited add list | Drop ALL, add only NET_BIND_SERVICE |
A container that passes Restricted
securityContext:
runAsNonRoot: true
allowPrivilegeEscalation: false
seccompProfile:
type: RuntimeDefault
capabilities:
drop: ["ALL"]
Steps
- Pick the level you will enforce. Baseline is a realistic first target for most teams. Restricted suits new services.
- Run a manifest scanner in CI on every changed YAML file.
- Fail the check on violations of your chosen level. Report the rest as warnings.
- Also flag Secret manifests with real values. Kubernetes states that base64 is encoding, not encryption, and that Secret manifests should be kept out of source control.
- Add an admission check in the cluster as the second line of defense, because a pre-deploy scan can be bypassed by a direct apply.
Limits
A manifest scan cannot see what is in the image, who has RBAC rights, or how the cluster is configured. It sees only what the YAML says. Rendered output matters too: for Helm charts, scan the rendered templates, covered in how to scan a Helm chart.
How Safeguard helps
Safeguard provides SBOM and dependency scanning with reachability analysis, and policies, gates and guardrails you can apply before merge. You can try the free scan on a repository.
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how a pull request is blocked by a policy gate and what the reviewer sees.
Quick check
Does a manifest scan replace cluster admission control?
No. The scan runs in CI and can be skipped by a direct apply. Admission control enforces at the cluster.
Which Pod Security level should I start with?
Baseline is a common first step. Move workloads to Restricted as you fix them.
Sources
- Kubernetes documentation, Pod Security Standards (fetched 19 October 2026).
- Kubernetes documentation, Good practices for Kubernetes Secrets (fetched 19 October 2026).
Last reviewed: 19 October 2026.
