What is kubesplaining?

Kubesplaining is a command line security tool for Kubernetes, the platform many companies use to run and manage containerized applications at scale. The tool acts like a simulated attacker, reading your cluster's configuration and mapping out every possible path a real attacker could follow to gain full control. Instead of just flagging individual misconfigurations one at a time, it builds a graph showing how several small issues chain together, tracing the exact sequence of steps from a low-privilege account all the way to complete cluster takeover, host root access, or read access to sensitive system secrets. It checks a wide range of problems: overly permissive access controls, containers running with too many privileges, missing network isolation rules, security checks that can be bypassed, and weak handling of secrets and service account tokens. For each finding, it names the specific technique, shows the supporting evidence pulled from your cluster, and gives concrete remediation steps, including ready-to-apply patches or policy files. Results can be exported as an HTML report for human review, or as JSON, CSV, and SARIF for feeding into other tools and GitHub's code scanning. You can run Kubesplaining directly against a live cluster using your existing kubectl connection, capture a snapshot and analyze it later offline for audits, or check a single Kubernetes manifest file without needing cluster access at all. It also supports a continuous integration mode that fails a pipeline only when new high severity findings appear compared to a previous baseline, so it can run automatically on every change. A security engineer, DevOps team, or developer responsible for a Kubernetes environment would use this to audit a cluster before an important release, prepare for a security review, run penetration testing engagements, or reconstruct how an attacker moved through the cluster after an incident. It is written in Go, ships as a single binary, and installs via a prebuilt release, Go install, Docker, or a clone-and-build workflow.