Kostral analyzes Kubernetes manifests before execution to find configuration problems, optimize where appropriate, and identify security risks — while everything is still just YAML.
$ koss explain ./examples/demo/bad.yaml 📦 Resource: backend ❌ HIGH privileged-container ⚠ MEDIUM no-readiness-probe ⚠ MEDIUM run-as-root ⚠ LOW under-provisioning
Kostral brings configuration analysis, optimization, and security assessment together before the manifest reaches execution.
Find configuration and operational problems in the state you provide.
Allow the Optimizer to make the changes it is responsible for.
Identify security risks without coupling security rules to optimization.
Engine independence and workflow order are separate concerns. A workflow may compose independent engines in the order required by the use case.
This is an example workflow, not a requirement that engines are permanently coupled.
A workflow can invoke the Optimizer, Validator, and Security engines as separate HTTP services while the Renderer stays local. Where an engine runs changes; what it is responsible for does not.
$ koss remote ./examples/demo/bad.yaml \ --exec ./examples/remote/workflow.py
A demonstration of remote invocation and workflow composition, using a static JSON registry and local HTTP endpoints. No dynamic discovery, authentication, or production-grade distributed execution yet. Read the remote engines guide →
Use the concise CLI reference with copy-and-paste commands.
Open CLI Reference →Start with the contributor guide and learn where rules and engines belong.
Start contributing →koss run ./examples/dsl/app.py
koss generate --name backend --cpu 500m --memory 512Mi --image nginx:1.27
Both workflows are currently on hold. Documentation for these secondary options is kept separate from the primary manifest analysis suite.