Repository Analysis

kubernetes-sigs/kubespray

Deploy a Production Ready Kubernetes Cluster

3.7 Likely human-written View on GitHub
3.7
Adjusted Score
3.7
Raw Score
100%
Time Factor
2026-05-29
Last Push
18,511
Stars
Jinja
Language
50,829
Lines of Code
822
Files
174
Pattern Hits
2026-05-31
Scan Date

Score History

Severity Breakdown

CRITICAL 0HIGH 0MEDIUM 5LOW 169

Pattern Findings

174 matches across 7 categories. Click a row to expand file-level details.

Over-Commented Block150 hits · 150 pts
SeverityFileLineSnippet
LOWtests/scripts/vagrant-install.sh1#!/bin/bash
LOWtests/scripts/vagrant-install.sh21# echo \
LOWtests/scripts/vagrant-install.sh41PYTHONDONTWRITEBYTECODE=1
LOWtests/files/custom_cni/cilium.yaml41 # nodes by setting how they are stored. The options are "crd", "kvstore" or
LOWtests/files/custom_cni/cilium.yaml81 # address.
LOWtests/files/custom_cni/cilium.yaml101
LOWtests/files/custom_cni/cilium.yaml121 bpf-lb-algorithm-annotation: "false"
LOWtests/files/custom_cni/cilium.yaml141 #
LOW…es/kubernetes-apps/csi_driver/cinder/defaults/main.yml21cinder_domain_id: "{{ lookup('env', 'OS_USER_DOMAIN_ID') }}"
LOWroles/kubernetes-apps/ansible/defaults/main.yml41# local
LOWroles/kubernetes-apps/ansible/defaults/main.yml81# dns_autoscaler_extra_tolerations: [{effect: NoSchedule, operator: "Exists"}]
LOWroles/network_plugin/calico_defaults/defaults/main.yml101# Calico NFTable Mode Support (tech preview 3.29)
LOWroles/network_plugin/flannel/defaults/main.yml1---
LOWroles/network_plugin/cilium/defaults/main.yml41cilium_enable_portmap: false
LOWroles/network_plugin/cilium/defaults/main.yml61# You wil also have to specify the variable `cilium_native_routing_cidr` to
LOWroles/network_plugin/cilium/defaults/main.yml81# Enable transparent network encryption.
LOWroles/network_plugin/cilium/defaults/main.yml161
LOWroles/network_plugin/cilium/defaults/main.yml221
LOWroles/network_plugin/cilium/defaults/main.yml241# Available for Cilium v1.12 and up.
LOWroles/network_plugin/cilium/defaults/main.yml261# Available for Cilium v1.10 and up
LOWroles/kubespray_defaults/defaults/main/main.yml221# Deploy cilium even if kube_network_plugin is not cilium.
LOWroles/kubespray_defaults/defaults/main/main.yml261#
LOWroles/kubespray_defaults/defaults/main/main.yml281ipv6_stack: "{{ enable_dual_stack_networks | default(false) }}"
LOWroles/kubespray_defaults/defaults/main/main.yml321kube_api_aggregator_routing: false
LOWroles/kubespray_defaults/defaults/main/main.yml401# Rotate container stderr/stdout logs at 50m and keep last 5
LOWroles/kubespray_defaults/defaults/main/main.yml481gateway_api_enabled: false
LOWroles/kubespray_defaults/defaults/main/main.yml521
LOWroles/kubespray_defaults/defaults/main/main.yml541 enabled: "{{ kube_api_anonymous_auth }}"
LOWroles/kubespray_defaults/defaults/main/main.yml561## 'RBAC' modes are tested. Order is important.
LOWroles/kubespray_defaults/defaults/main/main.yml581# webhook:
LOWroles/etcd_defaults/defaults/main.yml41
LOWroles/etcd_defaults/defaults/main.yml81# Maximum number of snapshot files to retain (0 is unlimited)
LOWroles/etcd_defaults/defaults/main.yml101# - TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
LOWroles/kubernetes/node/defaults/main.yml101
LOWroles/kubernetes/node/defaults/main.yml141kube_read_only_port: 0
LOWroles/kubernetes/node/defaults/main.yml161# - TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
LOWroles/kubernetes/kubeadm_common/defaults/main.yml1---
LOW…/kubernetes/control-plane/defaults/main/kube-proxy.yml61kube_proxy_min_sync_period: 0s
LOWroles/kubernetes/control-plane/defaults/main/main.yml61audit_log_maxage: 30
LOWroles/kubernetes/control-plane/defaults/main/main.yml101kube_apiserver_pod_eviction_unreachable_timeout_seconds: "300"
LOWroles/kubernetes/control-plane/defaults/main/main.yml161kube_webhook_authorization: false
LOWroles/kubernetes/control-plane/defaults/main/main.yml201kube_encrypt_token: "{{ lookup('password', credentials_dir + '/kube_encrypt_token.creds length=32 chars=ascii_letters,di
LOWroles/kubernetes/control-plane/defaults/main/main.yml221# - TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
LOWroles/container-engine/containerd/defaults/main.yml81containerd_cfg_dir: /etc/containerd
LOWroles/container-engine/cri-o/defaults/main.yml21# mirrors:
LOWdocs/calico_peer_example/new-york.yml1# ---
LOWdocs/calico_peer_example/paris.yml1# ---
LOWcontrib/terraform/terraform.py1#!/usr/bin/env python3
LOWinventory/sample/inventory.ini1# This inventory describe a HA typology with stacked etcd (== same nodes as control plane)
LOWinventory/sample/group_vars/all/azure.yml1## When azure is used, you need to also set the following variables.
LOWinventory/sample/group_vars/all/azure.yml21## Azure Disk CSI credentials and parameters
LOWinventory/sample/group_vars/all/cri-o.yml1# Registries defined within cri-o.
LOWinventory/sample/group_vars/all/hcloud.yml1## Values for the external Hcloud Cloud Controller
LOWinventory/sample/group_vars/all/hcloud.yml21# load_balancers_enabled:
LOWinventory/sample/group_vars/all/containerd.yml1---
LOWinventory/sample/group_vars/all/containerd.yml21# options:
LOWinventory/sample/group_vars/all/containerd.yml41
LOWinventory/sample/group_vars/all/all.yml1---
LOWinventory/sample/group_vars/all/all.yml21# valid options are "nginx" or "haproxy"
LOWinventory/sample/group_vars/all/all.yml41# - 8.8.4.4
90 more matches not shown…
Self-Referential Comments4 hits · 12 pts
SeverityFileLineSnippet
MEDIUMcontrib/terraform/aws/modules/nlb/main.tf1# Create a new AWS NLB for K8S API
MEDIUMcontrib/terraform/aws/modules/nlb/main.tf14# Create a new AWS NLB Instance Target Group
MEDIUMcontrib/terraform/aws/modules/nlb/main.tf31# Create a new AWS NLB Listener listen to target group
MEDIUM…b/terraform/upcloud/modules/kubernetes-cluster/main.tf2 # Create a list of all disks to create
Redundant / Tautological Comments6 hits · 9 pts
SeverityFileLineSnippet
LOWroles/kubespray_defaults/defaults/main/main.yml9# Check if access_ip responds to ping. Set false if your firewall blocks ICMP.
LOWcontrib/aws_inventory/kubespray-aws-inventory.py21 ##Check if VPC_VISIBILITY is set, if not default to private
LOWinventory/sample/group_vars/all/all.yml94## Set true to download and cache container
LOWinventory/sample/group_vars/all/all.yml112## Check if access_ip responds to ping. Set false if your firewall blocks ICMP.
LOWinventory/sample/group_vars/all/etcd.yml15# Set this to docker if you are using container_manager: docker
LOWscripts/gen_docs_sidebar.sh16 # Check if it is a directory
Deep Nesting6 hits · 6 pts
SeverityFileLineSnippet
LOWplugins/modules/kube.py310
LOWtests/scripts/md-table/main.py55
LOWlibrary/kube.py310
LOWcontrib/terraform/terraform.py41
LOWcontrib/terraform/terraform.py62
LOWscripts/openstack-cleanup/main.py27
Unused Imports4 hits · 4 pts
SeverityFileLineSnippet
LOWplugins/modules/kube.py364
LOWlibrary/kube.py364
LOWcontrib/aws_inventory/kubespray-aws-inventory.py3
LOWscripts/openstack-cleanup/main.py6
AI Slop Vocabulary1 hit · 3 pts
SeverityFileLineSnippet
MEDIUMtests/files/custom_cni/cilium.yaml52 # for seamless migrations from the kvstore mode to the crd mode. Consult the
Excessive Try-Catch Wrapping3 hits · 2 pts
SeverityFileLineSnippet
LOWplugins/modules/kube.py160 except Exception as exc:
LOWlibrary/kube.py160 except Exception as exc:
LOWscripts/openstack-cleanup/main.py50 except Exception as ex: