Home

Awesome

Codefresh build status

Kubevious Rules Library

This repository represents a library of rules for Kubevious CLI project to validate errors (typos, conflicts, misconfigurations) and violations of compliance and security best practices in Kubernetes and related cloud-native projects.

Kubevious rules are expressed in a domain-specific language called Kubik.

Kubevious CLI Video

Library Contents

Total Rules: 36

Locations:

Rules:

📂 ARGO-ROLLOUT

📜 Validate Argo Rollout to Analysis Template reference.

📂 CERT-MANAGER

📜 Validate CertManager Certificate to Issuer reference.

📜 Validate Ingress to CertManager Issuer reference.

📂 GCP-CONFIG-CONNECTOR/SQL

📜 Validate GCP Config Connector SQL Database to Instance reference.

📜 Validate GCP Config Connector SQL User to Instance reference.

📜 Validate GCP Config Connector SQL User to Password Secret reference.

📂 ISTIO

📜 Validate Istio VirtualService to IstioGateway reference.

📂 K8S/CONTAINER

📜 Validate ContainerSpec environment variable ConfigMap reference.

📜 Validate ContainerSpec envFrom variables projection ConfigMap reference.

📜 Validate ContainerSpec envFrom variables projection Secret reference.

📜 Validate ContainerSpec environment variable Secret reference.

📜 Validate ContainerSpec image to have non latest tag.

📜 Validate ContainerSpec resource requests to be less or equal to the limits.

📜 Validate ContainerSpec volume mount to PodSpec volume reference.

📂 K8S/GATEWAY-API/GATEWAY

📜 Validate Gateway to Certificate Secret reference.

📜 Validate Gateway to GatewayClass reference.

📜 Validate Gateway to have unique listeners.

📂 K8S/GATEWAY-API/HTTP-ROUTE

📜 Validate HTTPRoute to Backend reference.

📜 Validate HTTPRoute to Gateway reference.

📂 K8S/HPA

📜 Validate HorizontalPodAutoscaler to scale target reference.

📂 K8S/INGRESS

📜 Validate Ingress (extension) to Service reference.

📜 Validate Ingress to Service reference.

📜 Validate Ingress TLS and rule domain match.

📜 Validate Ingresses to have unique routing rules.

📜 Validate IngressClasses to have at most only one default.

📂 K8S/NETWORK-POLICY

📜 Validate NetworkPolicy to PodSpec reference.

📂 K8S/POD-SPEC

📜 Validate PodSpec to ServiceAccount reference.

📜 Validate PodSpec volume mount ConfigMap reference.

📜 Validate PodSpec volume mount PersistentVolumeClaim reference.

📜 Validate PodSpec volume mount Secret reference.

📂 K8S/RBAC

📜 Validate RoleBinding and ClusterRoleBinding to Role and ClusterRole reference.

📜 Validate RoleBinding and ClusterRoleBinding to ServiceAccount subject reference.

📂 K8S/SERVICE

📜 Validate Service to PodSpec label selector reference.

📂 K8S/WORKLOAD

📜 Checks Deployments to have min/max replicas - with or without HPAs.

📂 KONG

📜 Validate KongConsumer to Credential Secret reference.

📜 Validate Ingress and Service to Kong Plugin reference

Contributing

To submit your rules to the library follow the steps:

  1. Find the right place for the rule under root directory.
  2. Index the library using:
$ kubevious index-library .
  1. Submit a pull request.