kubeval | Kubernetes configuration files , supports multiple | Configuration Management library

by instrumenta Go Version: v0.16.1 License: Non-SPDX

X-Ray Key Features Code Snippets Community Discussions(2)Vulnerabilities Install Support

kandi X-RAY | kubeval Summary

kubeval is a Go library typically used in Devops, Configuration Management applications. kubeval has no bugs, it has no vulnerabilities and it has medium support. However kubeval has a Non-SPDX License. You can download it from GitHub.

kubeval is a tool for validating a Kubernetes YAML or JSON configuration file. It does so using schemas generated from the Kubernetes OpenAPI specification, and therefore can validate schemas for multiple versions of Kubernetes. For full usage and installation instructions see kubeval.com.

Support

Quality

Security

License

Reuse

Support

kubeval has a medium active ecosystem.

It has 3068 star(s) with 227 fork(s). There are 27 watchers for this library.

It had no major release in the last 12 months.

There are 85 open issues and 130 have been closed. On average issues are closed in 271 days. There are 19 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of kubeval is v0.16.1

Quality

kubeval has 0 bugs and 0 code smells.

Security

kubeval has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

kubeval code analysis shows 0 unresolved vulnerabilities.

There are 0 security hotspots that need review.

License

kubeval has a Non-SPDX License.

Non-SPDX licenses can be open source with a non SPDX compliant license, or non open source licenses, and you need to review them closely before use.

Reuse

kubeval releases are available to install and integrate.

Installation instructions are not available. Examples and code snippets are available.

It has 1437 lines of code, 64 functions and 9 files.

It has high code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi's functional review helps you automatically verify the functionalities of the libraries and avoid rework.
Currently covering the most popular Java, JavaScript and Python libraries. See a Sample of kubeval

Get all kandi verified functions for this library.

kubeval Key Features

No Key Features are available at this moment for kubeval.

kubeval Examples and Code Snippets

No Code Snippets are available at this moment for kubeval.

Community Discussions

Trending Discussions on kubeval

Server-side Validation of Kubernetes yaml

Validate K8s YAML Files in a Git repo

QUESTION

Server-side Validation of Kubernetes yaml

Asked 2020-Oct-30 at 16:25

I would like to do server-side validation of Kubernetes yaml files before applying them.

I know that in my Jenkins agent, I could use the following kubectl command for validating yaml files at the server-side but I am a bit concerned about access-control:

Kubernetes < v1.18: kubectl apply --server-dry-run -f ...
Kubernetes >= v1.18: kubectl apply --dry-run=server -f ...

The Kubernetes documentation says the following:

Authorization for dry-run and non-dry-run requests is identical. Thus, to make a dry-run request, the user must be authorized to make the non-dry-run request.

I don't want any Jenkins agents to have super powers over my EKS cluster. A bad actor could use my Jenkins agent maliciously and apply any manifests they wanted. Right now for security/stability/management reasons, creating Kubernetes objects is done by a different system not Jenkins.

I checked a few other options but I can see drawbacks:

Kubeval is not aware of any CRDs installed in the actual cluster.
Client Validation is not really end-to-end validation
I could develop a rest api that exposes a validation rest endpoint and hits Kubernetes APIs or runs a kubectl --run-dry under the hood. However, this requires more dev work than we have capacity for.

Do you have any ideas or are you aware of any validation tools that I could use in our CI system securely for the purpose of validating end-2-end Kubernetes yaml files?

...

ANSWER

Answered 2020-Oct-28 at 17:46

I've been looking for this myself and did not find a sufficient tooling. However, there are few workarounds:

Deploy all objects to a temporary ci-job-id namespace in dev/stage clusters. They should be the same as a prod, but will not impose the security risks you mentioned. This gives an additional benefit - you can check if everything got created, all pods are running. It helps to catch issues like insufficient resource requests, missing images, misconfigured Service selectors, etc. Also it let's you add a smoke test on top.
Spin a small minikube with all the CRDs specifically for CI validations. This approach gives you less coverage, but it is much cheaper to maintain.

Source https://stackoverflow.com/questions/64578072

QUESTION

Validate K8s YAML Files in a Git repo

Asked 2020-May-11 at 14:34

I have a set of K8s YAML descriptors as part of a project and I'm using kustomization to build them. I'm also using GitOps to do pull based deployments to my K8s cluster.

I now want to add some tests for my YAML files so that if I have any errors, I want to avoid or prevent Flux from pulling my changes into the cluster. So basically I want to do some unit test like thingy for my YAML files. I came across Kubeval and this could serve my purpose well. I'm just not sure how to use it.

Anyone already tried this? I want to basically do the following:

As soon as I push some YAML files into my repo, Kubeval kicks in and validates all the YAML files in a set of folders that I specify
If all the YAML files passes lint validations, then I want to proceed to the next stage where I call kustomize to build the deployment YAML.
If the YAML files fail lint validation, then my CI fails and nothing should happen

Any ideas on how I could do this?

...

ANSWER

Answered 2020-May-11 at 14:34

Since my project is hosted on GitHub, I was able to get what I want using GitHub actions and kube-tools

So basically here is what I did!

In my GitHub project, added a main.yaml under project-root/.github/workflows/main.yml
The contents of my main.yaml is:

name: ValidateKubernetesYAML

Source https://stackoverflow.com/questions/61730802

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install kubeval

You can download it from GitHub.

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: