Back to feed
Dev.to
Dev.to
7/19/2026
Building kube-radar: Learning Go by shipping a Kubernetes RBAC security scanner

Building kube-radar: Learning Go by shipping a Kubernetes RBAC security scanner

Original: I Learned Go by Hacking Kubernetes RBAC Security (And Nearly Quit 5 Times)

Short summary

A Kubernetes engineer at Siemens shares the journey of learning Go from scratch by building kube-radar, a CLI tool that detects RBAC wildcard violations in Kubernetes clusters. The article covers the motivation (wildcard rules are silent security risks), design challenges, and lessons learned about Go's error handling, interfaces, and composition. Includes code snippets and practical insights on shipping a real project in an unfamiliar language.

  • •kube-radar scans K8s RBAC for wildcard over-permissions and reports in SARIF for GitHub security integration
  • •Key lessons: perfect designs you can't ship are worthless; you can't paste your way to understanding Go
  • •Wildcard RBAC rules (verbs: ["*"], resources: ["*"]) bypass most CNAPP tools because they're technically valid

Generated with AI, which can make mistakes.

#open-source
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

The original title is "Building GateKeeper: Designing a Role-Based Access Control Library in Pure Go"
Dev.to
Building a Hybrid Docker Orchestrator in Go: The Journey from Single VM to Multi-Node Cluster
Dev.to
From Terminal to Container: The Evolution and Dockerization of an ASCII Art Web Application.
Dev.to
The original title is "Building NetZero: Automated Zero-Trust K8s Network Policies Using Go and eBPF"
Dev.to