You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* 🚀 **[NEW]** Added **[Kubeconform](https://github.com/yannh/kubeconform)**, a Kubernetes manifests validation tool.
7
+
8
+
It is inspired by, contains code from and is designed to stay close to Kubeval, but with the following improvements:
9
+
10
+
* high performance: will validate & download manifests over multiple routines, caching downloaded files in memory
11
+
* configurable list of remote, or local schemas locations, enabling validating Kubernetes custom resources (CRDs) and offline validation capabilities
12
+
* uses by default a self-updating fork of the schemas registry maintained by the kubernetes-json-schema project - which guarantees up-to-date schemas for all recent versions of Kubernetes.
13
+
14
+
* 🚀 **[NEW]** Added **[Kubeaudit](https://github.com/Shopify/kubeaudit)**, a command line tool and a Go package to audit Kubernetes clusters for various different security concerns.
15
+
16
+
### Updates 📝
17
+
* Update Python from 3.9.0 to 3.9.5 on Alpine 3.13
18
+
* Update Kubectl from 1.19.3 to [v1.21.1](https://github.com/kubernetes/kubernetes/blob/master/CHANGELOG/CHANGELOG-1.21.md), now installed via [Alpine package manager](https://pkgs.alpinelinux.org/package/edge/testing/x86_64/kubectl)
19
+
* Update Yamllint from 1.25.0 to [1.26.0](https://github.com/adrienverge/yamllint/blob/master/CHANGELOG.rst#1260-2021-01-29)
20
+
* Update Kustomize from 3.8.6 to [v4.1.0](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv4.1.0)
21
+
* Update OPA Conftest from 0.21.0 to [v0.25.0](https://github.com/open-policy-agent/conftest/releases/tag/v0.25.0)
22
+
* Update Kube-Score to [v1.11.0](https://github.com/zegl/kube-score/releases/tag/v1.11.0)
23
+
* Update Polaris to [3.2.1](https://github.com/FairwindsOps/polaris/releases/tag/3.2.1)
24
+
* Update Kube-Linter to [0.2.1](https://github.com/stackrox/kube-linter/releases/tag/0.2.1)
* 📝 Updated base Python to [v3.9.1-alpine3.12](https://hub.docker.com/layers/python/library/python/3.9.1/images/sha256-758539bea3c58d4b0bf09bfa97c633cd657599e58648f5eb791b25d95cb854c2?context=explore)
4
-
* 📝 Updated Kubectl to [v1.20.0](https://github.com/kubernetes/kubectl/releases/tag/kubernetes-1.20.2)
5
-
* 📝 Updated Kubeval to [v1.15.0](https://github.com/instrumenta/kubeval/releases/tag/0.15.0)
6
-
* 📝 Updated YAMLLint to [v1.25.0](https://pypi.org/project/yamllint/)
7
-
* 📝 Updated Kustomize to [v3.9.2](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv3.9.2)
8
-
* 📝 Updated Conftest to [v0.23.0](https://github.com/open-policy-agent/conftest/releases/tag/v0.23.0)
9
-
* 📝 Updated Config-Lint to [v1.6.0](https://github.com/stelligent/config-lint/releases/tag/v1.6.0)
30
+
* 🚀 **[NEW]** Added [Kube-Score](https://github.com/zegl/kube-score), a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient.
31
+
* 🚀 **[NEW]** Added [Polaris](https://github.com/FairwindsOps/polaris), Polaris runs a variety of checks to ensure that Kubernetes pods and controllers are configured using best practices. Polaris is included as a CLI tool to test local YAML files, e.g. as part of a CI/CD process.
32
+
* 🚀 **[NEW]** Added [Kube Linter](https://github.com/stackrox/kube-linter), a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best practices. KubeLinter accepts YAML files as input and runs a series of checks on them. If it finds any issues, it reports them and returns a non-zero exit code.
33
+
34
+
### Updates
35
+
* 📝 Updated Python from 3.8.4 to 3.9.0
36
+
* 📝 Updated Kubectl from 1.18.6 to 1.19.3
37
+
* 📝 Updated Yamllint from 1.24.2 to 1.25.0
38
+
* 📝 Updated Kustomize from 3.8.1 to 3.8.6
39
+
* 📝 Updated Conftest from 0.20.0 to 0.21.0
10
40
11
41
v2.3
12
42
----
13
-
* 🚀 [NEW] Added [Config-lint](https://stelligent.github.io/config-lint/#/?id=%f0%9f%94%8d-config-lint-%f0%9f%94%8e), A CLI tool to validate config files (JSON, Terraform, YAML + Kubernetes), using rules specified in YAML.
43
+
* 🚀 **[NEW]** Added [Config-lint](https://stelligent.github.io/config-lint/#/?id=%f0%9f%94%8d-config-lint-%f0%9f%94%8e), A CLI tool to validate config files (JSON, Terraform, YAML + Kubernetes), using rules specified in YAML.
44
+
45
+
### Updates
14
46
* 📝 Updated Kubectl to [v1.18.6](https://kubernetes.io/docs/setup/release/notes/)
15
47
* 📝 Updated YAMLLint to [v1.24.2](https://github.com/adrienverge/yamllint/blob/master/CHANGELOG.rst)
16
48
* 📝 Updated Kustomize to [v3.8.1](https://github.com/kubernetes-sigs/kustomize/releases/tag/kustomize%2Fv3.8.1)
Copy file name to clipboardExpand all lines: README.md
+90-1Lines changed: 90 additions & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,7 +1,7 @@
1
1
Kubernetes Validation Tools
2
2
===========================
3
3
4
-
Common validation and linting tools for structured configuration data, including Kubernetes YAML Manifests.
4
+
An all-in-one collection of tools to run linting, common validation, static code analysis, security scanning, configuration tests, auditing, kustomize build, and dry run configuration for structured Kubernetes YAML Manifests. Designed to run in a CI (Continuious Integration) process as part of validation and testing, especially useful for Kubernetes clusters that are managed through GitOps.
5
5
6
6
Why?
7
7
----
@@ -17,6 +17,24 @@ Grab the latest image from Docker hub: [Deck15/kubeval-tools](https://hub.docker
17
17
docker run --rm -it deck15/kubeval-tools /bin/sh
18
18
```
19
19
20
+
Ideally the kubeval-tools container should be used in a CI process to validate and lint Kubernetes configs and manifests. It's optimal to run these tools as part of a [GitOps](https://www.gitops.tech/) CI workflow.
21
+
22
+
Tools List
23
+
----------
24
+
25
+
26
+
Kubeaudit
27
+
---------
28
+
[Kubeaudit](https://github.com/Shopify/kubeaudit) is a command line tool and a Go package to audit Kubernetes clusters for various different security concerns, such as:
29
+
30
+
* run as non-root
31
+
* use a read-only root filesystem
32
+
* drop scary capabilities, don't add new ones
33
+
* don't run privileged
34
+
* and more!
35
+
36
+
kubeaudit makes sure you deploy secure containers!
[Kube-Score](https://github.com/zegl/kube-score), a tool that performs static code analysis of your Kubernetes object definitions. The output is a list of recommendations of what you can improve to make your application more secure and resilient.
85
+
86
+
kube-score can run in your CI/CD environment and will exit with exit code 1 if a critical error has been found. The trigger level can be changed to warning with the --exit-one-on-warning argument.
87
+
88
+
The input to kube-score should be all applications that you deploy to the same namespace for the best result.
[Polaris](https://github.com/FairwindsOps/polaris), Polaris runs a variety of checks to ensure that Kubernetes pods and controllers are configured using best practices. Polaris is included as a CLI tool to test local YAML files, e.g. as part of a CI/CD process.
109
+
110
+
Polaris can be run in a few different modes:
111
+
112
+
* As a dashboard, so you can audit what's running inside your cluster.
113
+
* As a validating webhook, so you can automatically reject workloads that don't adhere to your organization's policies.
114
+
* As a command-line tool, so you can test local YAML files, e.g. as part of a CI/CD process.
115
+
116
+
You can run audits on the command line and see the output as JSON, YAML, or a raw score:
117
+
118
+
```sh
119
+
polaris audit --format yaml > report.yaml
120
+
polaris audit --format score
121
+
# 92
122
+
```
123
+
124
+
Audits can run against a local directory or YAML file rather than a cluster:
125
+
```sh
126
+
polaris audit --audit-path ./deploy/
127
+
128
+
# or to use STDIN
129
+
cat pod.yaml | polaris audit --audit-path -
130
+
```
131
+
You can also run the audit on a single resource instead of the entire cluster:
You can integrate Polaris into CI/CD for repositories containing infrastructure-as-code. For example, to fail if polaris detects any danger-level issues, or if the score drops below 90%:
138
+
139
+
```sh
140
+
polaris audit --audit-path ./deploy/ \
141
+
--set-exit-code-on-danger \
142
+
--set-exit-code-below-score 90
143
+
```
144
+
145
+
For more usage options for CLI, see the [Usage Doc](https://github.com/FairwindsOps/polaris/blob/master/docs/usage.md)
146
+
147
+
Kube Linter
148
+
-----------
149
+
150
+
[Kube Linter](https://github.com/stackrox/kube-linter) is a static analysis tool that checks Kubernetes YAML files and Helm charts to ensure the applications represented in them adhere to best practices. KubeLinter accepts YAML files as input and runs a series of checks on them. If it finds any issues, it reports them and returns a non-zero exit code.
0 commit comments