GPT-4.1 Kubernetes PR Manifest Scanner & Auto Remediation

Automatically Scan Kubernetes Pull Requests and Remediate Securely—With GPT-4.1

This n8n workflow reviews Kubernetes manifest changes inside your GitHub pull requests using OpenAI (GPT-4.1), applies policy-driven analysis, posts security findings back to the PR, and—after Slack approval—creates a remediation branch with secure fixes and opens a remediation PR.

What this workflow does

• Triggers on PR activity: Starts when a GitHub pull_request is opened or updated.
• Collects changed Kubernetes YAML: Reads PR context and fetches the changed files and their Kubernetes manifest contents from GitHub.
• Runs an OpenAI policy RAG analysis: Uses an OpenAI agent with session memory to evaluate each manifest, calling HTTP scanner tools for checks like privileged settings, RBAC permissions, exposed services, and resource limits, and querying a vector store for internal Kubernetes security policies.
• Produces structured results: Parses the agent’s JSON output into findings, risk, verdict, and proposed secure manifest changes.
• Audits to Postgres: Logs every review to a Postgres audit table.
• Comments back on the PR: Posts a detailed security review comment to the originating GitHub pull request, including proposed fixes.
• Remediation with human approval: If issues are found, requests approval in Slack; once approved, it commits secure changes to a remediation branch and opens a remediation PR—then notifies Slack.

Use cases

• SaaS and platform teams enforcing Kubernetes security standards before merges.
• Automation engineers reducing manual review time for privileged settings, RBAC, and exposed services.
• Teams that want traceable Kubernetes security audits via Postgres and clear PR feedback loops.

Technical details

• n8n nodes used: if, set, slack, github, postgres, sticky note
• Integrations: GitHub (PR file access + branch/commit/PR creation), OpenAI (GPT-4.1 model via Chat Model), HTTP scanner tools, vector store for policy RAG, Slack for approval workflow, Postgres for audit logging