Original reporting sourced from ADTmag. Original post date: 2020-05-21.
Overview
DevSecOps vendor Alcide released a beta version of sKan, a free, open command-line tool designed to give developers and DevOps teams direct access to Kubernetes security scanning capabilities without requiring a paid platform subscription. The tool surfaces security issues, misconfigurations, and hardening recommendations at the earliest possible stage of the development lifecycle — before code is committed or workloads are deployed.
What Is sKan?
sKan is powered by the same technology that underlies Alcide Kubernetes Advisor, the company’s multi-cluster vulnerability scanner, combined with the Open Policy Agent (OPA) policy engine. Together these components let sKan evaluate Kubernetes configuration artifacts against a rich set of security best practices and compliance checks — including those covering Kubernetes itself and Istio service mesh configurations.
According to Alcide CTO and co-founder Gadi Naor:
“sKan stretches our main security platform into the comfort zone of the developers who are building applications running on Kubernetes in the most automated and seamless manner, without interrupting their development workflow.”
Gadi Naor, CTO & Co-founder, Alcide
What sKan Can Scan
sKan is designed to integrate directly into CI pipelines and can evaluate several types of Kubernetes delivery artifacts:
- Kubernetes YAML configuration files — raw manifests for Deployments, Services, NetworkPolicies, and other resource types
- Helm charts — including published or community charts pulled from a repository
- Kustomize overlays — configurations produced by the Kustomize command-line tool
For each artifact, sKan provides immediate feedback on:
- Security vulnerabilities and risk exposure
- Misconfiguration and configuration drift
- Hardening opportunities (e.g., dropping unnecessary Linux capabilities, enforcing read-only root filesystems)
- Kubernetes and Istio security best practices
Why Configuration Scanning Matters
Source code scanning for vulnerabilities is a well-established practice in modern DevSecOps pipelines. Kubernetes configuration security, however, is frequently overlooked. Misconfigured manifests — overly permissive RBAC roles, containers running as root, missing resource limits, or exposed secrets — can introduce serious vulnerabilities that reach production undetected.
sKan acts as a pre-commit and pre-deploy checkpoint, catching these issues at the point where they are cheapest to fix: during development, not after a production incident.
Shifting Security Left in Kubernetes Workflows
The tool is a concrete implementation of the “shift left” security principle applied specifically to Kubernetes infrastructure-as-code. By embedding security checks directly into a developer’s local workflow or CI stage, engineering teams can:
- Reduce the volume of security findings that reach staging or production
- Shorten remediation cycles by surfacing issues when context is fresh
- Build institutional knowledge about Kubernetes security best practices through repeated, actionable feedback
- Reduce reliance on dedicated security teams for routine configuration review
Naor framed this as addressing a broader Kubernetes security skills gap: many development teams adopting Kubernetes lack deep security expertise, and a tool that provides immediate, contextual guidance helps close that gap organically.
Pricing and Availability
At the time of the announcement, sKan was released as a free, open tool with no licensing cost. Alcide stated its intention to keep the core tool free, with the possibility of a paid support tier in the future. The beta was made available to developers, DevOps engineers, and Kubernetes application builders.
Context: Alcide and Kubernetes Advisor
Alcide, headquartered in Tel Aviv, Israel, built its primary commercial product — Alcide Kubernetes Advisor — as a multi-cluster scanner covering Kubernetes and Istio security posture at the platform level. sKan can be thought of as a developer-facing extension of that platform, exposing a subset of Advisor’s policy engine capabilities through a CLI interface suitable for local development and CI integration.
Key Takeaways
- sKan is a free CLI tool from Alcide for scanning Kubernetes configuration files, Helm charts, and Kustomize outputs
- It is powered by Alcide Kubernetes Advisor technology and the Open Policy Agent engine
- The tool is designed to integrate into CI pipelines and local developer workflows without disruption
- It addresses the common gap where source code is scanned but Kubernetes manifests are not
- The tool was positioned as a “shift left” solution to reduce Kubernetes security misconfigurations before they reach production