Performing static code analysis of your Kubernetes object definitions with a Github Action
Tags: actionshackathon, github, opensource, showdev
Published: 2020-09-14 18:28:36

---
title: Performing static code analysis of your Kubernetes object definitions with a Github Action
published: true
description: My submission to the GitHub Actions x DEV Hackathon!
tags: actionshackathon, github, opensource, showdev
cover_image: https://dev-to-uploads.s3.amazonaws.com/i/ymetwc7lznu33ontmtd6.png
canonical_url: https://piraces.dev/posts/kube-score-github-action/
---

[Instructions]: # (To submit to the GitHub Actions x DEV Hackathon, please fill out all sections.)

Nowadays, [Kubernetes](https://kubernetes.io/) is one of the [most popular and loved platforms](https://insights.stackoverflow.com/survey/2020#technology-most-loved-dreaded-and-wanted-platforms) used by the community, to run and orchestrate container workloads.

It is present in several open-source and private projects as the base of its infrastructure. They trust to use Kubernetes as a platform.

## The problem

The world of Kubernetes can be sometimes very complex and if we make use of it, we need to ensure we are doing it right.

{% twitter 1158764816426840064 %}

There are lots of tools that can ease that work for us to simplify the process to get Kubernetes working correctly as our platform.

As you may know, the Kubernetes workloads are most commonly defined as YAML formatted documents. Sometimes, it is rather hard to express constraints or relationships between manifests files.

### What can be done to help ease the process of using Kubernetes correctly?

There are existing tools to integrate static checking allowing catching errors and policy violations closer to the development lifecycle.

These tools gives us the guarantee around the validity and safety of the resource definitions is improved, therefore you can trust that production workloads are following best practices (which [is a must nowadays](https://www.sentinelone.com/blog/kubernetes-security-challenges-risks-and-attack-vectors/)).

As developers, we need to guarantee the validity and safety of our Kubernetes manifests to ensure the security and integrity of our production environments.

Here comes when the tool [kube-score](https://kube-score.com/) can help us.

Kube-score is an [open-source](https://github.com/zegl/kube-score) tool that performs Kubernetes object analysis with recommendations for improved reliability and security.

How can we introduce kube-score in our CI/CD processes?

**[GitHub Actions](https://github.com/features/actions) to the rescue!**

### My Workflow
[Note]: # (Make sure to include the name of your GitHub Action and share where it's being used!)

My developed GitHub action ([kube-score check](https://github.com/marketplace/actions/kube-score-check)), allows GitHub users to execute `kube-score` in their workflows along other actions and guarantee the validity and safety of their Kubernetes manifests. 

It is very simple to use, you only have to perform a checkout of the project repository and execute the action, which takes as input an array of manifests (or directories with manifests) which you want to validate and test (wildcards supported):

![How to use the action](https://dev-to-uploads.s3.amazonaws.com/i/c3dk8cvyettegcw5a19x.png)

Read [the full Readme of the project](https://github.com/piraces/kube-score-ga/blob/master/README.md) to see all options.

### Submission Category:
**Maintainer Must-Haves** / **DIY Deployments**

[Note]: # (Maintainer Must-Haves, DIY Deployments, Interesting IoT, Phone Friendly, or Wacky Wildcards)


### Yaml File or Link to Code

Please take a look at the action repository, and give any feedback if you want! 

Contributions are welcomed too!

{% github piraces/kube-score-ga %}

[Note]: # (Our markdown editor supports pretty embeds. Try this syntax: `{% github link_to_your_repo %}` to share a GitHub repository)

See the YAML file for the action: [action.yml](https://github.com/piraces/kube-score-ga/blob/master/action.yml)

### Additional Resources / Info

In the links below, you can see the GitHub action running with different forks of popular projects, such as the **[Application Gateway Ingress Controller](https://docs.microsoft.com/en-us/azure/application-gateway/ingress-controller-overview) (AGIC) of Azure**, or the examples provided in the **official repo of Kubernetes**.

Take a look and see how AGIC [Custom Resource Definitions](https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/#customresourcedefinitions) (CRDs), [are passing all validations and recommendations](https://github.com/piraces/application-gateway-kubernetes-ingress/runs/1113739099?check_suite_focus=true) (as is a ready to use in production controller).

- See the GitHub Action in use: 
  - [Kubernetes/examples](https://github.com/kubernetes/examples) repository (fork): https://github.com/piraces/examples/actions

  - [Azure/application-gateway-kubernetes-ingress](https://github.com/Azure/application-gateway-kubernetes-ingress) repository (fork): https://github.com/piraces/application-gateway-kubernetes-ingress/actions

- GitHub Repository: https://github.com/piraces/kube-score-ga

- GitHub Marketplace: https://github.com/marketplace/actions/kube-score-check

[Note]: # (Be sure to link to any open source projects that are using your workflow!)

[Note]: # (Be sure to include the DEV usernames of your collaborators, if any. )

[Reminder]: # (Submissions are due on September 12th (11:59 PM PDT) and winners will be announced on September 23!)