Package: iac-validate
iac-validateA CLI tool to perform syntactic and semantic validation of YAML files.$ iac-validate -h
Usage: iac-validate [OPTIONS] [PATHS]...

  A CLI tool to perform syntactic and semantic validation of YAML files.

Options:
  --version              Show the version and exit.
  -v, --verbosity LVL    Either CRITICAL, ERROR, WARNING, INFO or DEBUG
  -s, --schema FILE      Path to schema file. (optional, default:
                         '.schema.yaml', env: IAC_VALIDATE_SCHEMA)
  -r, --rules DIRECTORY  Path to semantic rules. (optional, default:
                         '.rules/', env: IAC_VALIDATE_RULES)
  -o, --output FILE      Write merged content from YAML files to a new YAML
                         file. (optional, env: IAC_VALIDATE_OUTPUT)
  --non-strict           Accept unexpected elements in YAML files.
  -h, --help             Show this message and exit.Syntactic validation is done by basic YAML syntax validation (e.g., indentation) and by providing aYamaleschema and validating all YAML files against that schema. Semantic validation is done by providing a set of rules (implemented in Python) which are then validated against the YAML data. Every rule is implemented as a Python class and should be placed in a.pyfile located in the--rulespath.Each.pyfile must have a single class namedRule. This class must have the following attributes:id,descriptionandseverity. It must implement aclassmethod()namedmatchthat has a single function argumentdatawhich is the data read from all YAML files. It should return a list of strings, one for each rule violation with a descriptive message. A sample rule can be found below.classRule:id="101"description="Verify child naming restrictions"severity="HIGH"@classmethoddefmatch(cls,data):results=[]try:forchildindata["root"]["children"]:ifchild["name"]=="FORBIDDEN":results.append("root.children.name"+" - "+str(child["name"]))exceptKeyError:passreturnresultsInstallationPython 3.7+ is required to installiac-validate. Don't have Python 3.7 or later? SeePython 3 Installation & Setup Guide.iac-validatecan be installed in a virtual environment usingpip:pip install iac-validatePre-Commit HookThe tool can be integrated via apre-commithook with the following config (.pre-commit-config.yaml), assuming the default values (.schema.yaml,.rules/) are appropriate:repos:
  - repo: https://github.com/netascode/iac-validate
    rev: v0.1.6
    hooks:
      - id: iac-validateIn case the schema or validation rules are located somewhere else the required CLI arguments can be added like this:repos:
  - repo: https://github.com/netascode/iac-validate
    rev: v0.1.6
    hooks:
      - id: iac-validate
        args:
          - '-s'
          - 'my_schema.yaml'
          - '-r'
          - 'rules/'Ansible Vault SupportValues can be encrypted usingAnsible Vault. This requires Ansible (ansible-vaultcommand) to be installed and the following two environment variables to be defined:export ANSIBLE_VAULT_ID=dev
export ANSIBLE_VAULT_PASSWORD=Password123ANSIBLE_VAULT_IDis optional, and if not defined will be omitted.Additional TagsReading Environment VariablesThe!envYAML tag can be used to read values from environment variables.root:name:!envVAR_NAME