How to use Kyverno CLI to validate k8s manifests?
Tags: kubernetes, devops, devsecops, cloudnative
Published: 2022-04-24 06:11:55

In the previous article, we have seen what is Kyverno, its features, its use-cases and hot it works. In this article we will install kyverno cli in our local machine and explore its usecases. 

## Install Kyverno CLI
- The Kyverno CLI is designed to validate and test policy behavior to resources prior to adding them to a cluster. 
- Used in CI/CD pipelines to validate manifests before they are deployed. 
- Can be integrated into precommit hooks

### Install Kyverno CLI via Krew
Krew is the plugin manager for kubectl command-line tool. If do not have krew installed already, please follow the instructions --> https://krew.sigs.k8s.io/docs/user-guide/setup/install/

```
# Install Kyverno CLI using kubectl krew plugin manager
kubectl krew install kyverno

# test the Kyverno CLI
kubectl kyverno version  
```

### Install Kyverno CLI via Brew (MacOS)
```
# Install Kyverno CLI using brew
brew install kyverno

# test the Kyverno CLI
kyverno version 
```

## Kyverno CLI Commands
### Apply
- Performs a dry run on one or more policies for the given manifest(s)
- Executes mutate policies and shows mutated resource as an output

```
kyverno apply /path/to/policy.yaml --resource /path/to/resource.yaml
```

### Test
- tests policy from a git repo or local directory
- recursively looks for YAML files in a directory and executes tests
- kyverno test definition consists of test name, policies, resources and expected results.

An example test would look like
```
name: disallow_latest_tag
policies:
  - policy.yaml
resources:
  - resource.yaml
results:
  - policy: disallow-latest-tag
    rule: require-image-tag
    resource: myapp-pod
    kind: Pod
    result: pass
  - policy: disallow-latest-tag
    rule: validate-image-tag
    resource: myapp-pod
    kind: Pod
    result: pass

```

To Run the test, 
```
kyverno test /path/to/yamls
```

### Validate
- check if a policy is syntactically valid. 
- can validate multiple policy resource description files or a folder containing policy resource description files.

```
kyverno validate /path/to/policy1.yaml /path/to/policy2.yaml /path/to/folderFullOfPolicies

```

### Jp 
Kyverno CLI also provides a utility called `jp` to work with JMESPath and expressions.

```
$ echo '{"foo": "BAR"}' | kyverno jp 'to_lower(foo)'
"bar"
```

```
$ cat pod.json
{
  "apiVersion": "v1",
  "kind": "Pod",
  "metadata": {
    "name": "mypod",
    "namespace": "foo"
  },
  "spec": {
    "containers": [
      {
        "name": "busybox",
        "image": "busybox"
      }
    ]
  }
}

$ kyverno jp -f pod.json 'spec.containers[0].name' -u
busybox
```

## Kyverno precommit hooks
Kyverno can be integrated into precommit hooks to test and validate policies. To setup precommit hook, checkout ->  https://github.com/kyverno/pre-commit-hook

.pre-commit-config.yaml
```
repos:
  - repo: https://github.com/kyverno/pre-commit-hook
    rev: v1.0.0
    hooks:
      - id: kyverno-test
        args: ["kyverno-policies"]
      - id: kyverno-validate
        args: ["kyverno-policies"]
```


> If you like this article, subscribe to the newsletter and Connect with me on [twitter](https://twitter.com/sureshdsk) to get updates on my future articles. ✅