Source: ADT Magazine (adtmag.com), April 2020. Original reporting covers Alcide’s product announcement.
What Is sKan?
Alcide, an Israel-based Kubernetes security vendor, released sKan — a free, open-source command-line tool designed to help developers, DevOps engineers, and Kubernetes application builders scan their Kubernetes configuration and deployment files for security issues early in the development lifecycle. The tool is intended to be embedded directly into continuous integration (CI) pipelines, making security a standard part of the build process rather than an afterthought.
The Problem sKan Solves
Kubernetes adoption has outpaced security expertise in many engineering teams. While scanning application source code for vulnerabilities is now a common practice, Kubernetes-specific configuration errors in YAML manifests, Helm charts, and custom resource definitions are frequently overlooked. These misconfigurations can quietly introduce serious vulnerabilities into production environments — long before a security team ever reviews them.
According to Alcide CTO and co-founder Gadi Naor, customers and prospects consistently asked for a way to bring Kubernetes security insights to developers at the earliest possible stage:
“This is why we created sKan, to serve as a checkpoint tool for developers that is available in their comfort zone without interrupting their development workflow.”
— Gadi Naor, CTO and Co-founder, Alcide
How sKan Works
sKan is powered by the same technology that underpins Alcide Advisor and the Open Policy Agent (OPA) — a widely adopted, open-source policy engine used for enforcing security and compliance rules across cloud-native environments. This foundation gives sKan a flexible, policy-driven approach to detecting misconfigurations.
The tool scans Kubernetes deployment files and provides actionable security feedback across a broad range of risk categories, including:
- Privileged container checks — Verifying that deployment files are not configured to run containers with elevated privileges.
- Worker node risk assessment — Identifying configurations that could introduce risks to Kubernetes worker nodes.
- RBAC sanitation — Reviewing Role-Based Access Control definitions for overly permissive or dangerous rules.
- Secret leak detection — Identifying secrets or sensitive values that may have been inadvertently included in manifests.
- General hardening and best practices — Flagging configurations that deviate from established Kubernetes security recommendations.
For each detected risk, sKan presents actionable insights rather than simply reporting errors — helping teams understand what needs to change and why.
Deployment Framework Compatibility
sKan is designed to complement the deployment tooling teams already use. It supports scanning of:
- Helm charts — for teams using the Kubernetes package manager
- Plain Kubernetes resource files — YAML and JSON manifests
- Customized resources — including Custom Resource Definitions (CRDs)
It can assess both first-party application deployment files developed in-house and third-party software manifests, giving teams visibility into the full scope of what they are deploying.
Shifting Security Left in Kubernetes Pipelines
The concept of “shifting security left” means introducing security checks as early as possible in the software development lifecycle — ideally before code is even committed. By integrating sKan into a CI pipeline, teams can automatically scan Kubernetes configurations on every pull request or build, catching misconfigurations before they ever reach staging or production.
Alcide describes this approach as a “software translation of DevSecOps culture” — moving Kubernetes security responsibility to the people building applications, rather than relying exclusively on a dedicated security team to catch issues at the end of the pipeline. This framing positions sKan as a guardrail rather than a gate: developers get immediate feedback without blocking their workflow.
Where sKan Fits in the Broader Alcide Platform
sKan is a standalone, free entry point into Alcide’s broader Kubernetes security ecosystem. The company’s commercial platform is described as a Kubernetes-native, AI-driven security solution that provides:
- Security visibility across multiple Kubernetes clusters
- Runtime security event monitoring
- A unified policy framework for enforcement across environments
sKan addresses the pre-deployment phase, complementing these runtime capabilities with shift-left checks that catch problems before workloads are ever scheduled.
Key Takeaways
- sKan is a free, open-source CLI tool from Alcide for scanning Kubernetes deployment files.
- It is powered by Open Policy Agent (OPA) and Alcide Advisor technology.
- It targets misconfigurations in YAML manifests, Helm charts, and CRDs — gaps often missed by standard source code scanning tools.
- It supports integration into CI/CD pipelines to automate Kubernetes security checks.
- Risk categories covered include privilege escalation, RBAC issues, node security, and secret leaks.
- The tool was released in April 2020 and was available from the Alcide website at the time of announcement.
DevOps and platform engineering teams looking to harden their Kubernetes delivery pipelines should evaluate sKan alongside other static analysis tools such as kube-score, Trivy, and Checkov, which serve overlapping but distinct purposes in the Kubernetes security toolchain.