DEV Community

Cover image for How to develop Kyverno CLI locally?
Pritish Samal
Pritish Samal

Posted on

How to develop Kyverno CLI locally?

"The Kyverno Command Line Interface (CLI) is designed to validate and test policy behaviour to resources prior to adding them to a cluster. The CLI can be used in CI/CD pipelines to assist with the resource authoring process to ensure they conform to standards prior to them being deployed."

You can install and use the kyverno cli using krew, yay or by directly building it from source. But here, we will see how to use kyverno CLI in development mode. Basically the usage remains the same except that here, you've to execute the Go package i.e. cmd/cli/kubectl-kyverno/main.go which essentially calls the kyverno CLI.

Prerequisite

The only pre-requisite is that you need to have Go installed and set-up correctly in your local development workspace. Also, your Go version must be greater than 1.16 thus it is recommended to install the latest release. Here's a great set of resources that can help you set-up Go development in your local environment.

Example

Let's say you've to run the test command to validate the Disallow Latest Tag policy.
To do this using the kyverno CLI, you run:

kyverno test ../policies/best-practices/disallow_latest_tag
Enter fullscreen mode Exit fullscreen mode

But to use the kyverno CLI in the development mode, follow these steps:

  1. Make sure you've cloned the fork of kyverno/kyverno and kyverno/policies in the same directory. Your workspace should be looking something like this:
/kyverno
    api
    charts
    cmd
    definitions
    docs...

/policies
    best-practices
    cert-manager
    other
    pod-security...
Enter fullscreen mode Exit fullscreen mode
  1. cd into kyverno directory (which is your local fork of kyverno/kyverno)
  2. Run the below mentioned command:
go run ./cmd/cli/kubectl-kyverno/main.go test ../policies/best-practices/disallow_latest_tag
Enter fullscreen mode Exit fullscreen mode
  1. On executing the above command, you'll get an output as follows:
Executing disallow_latest_tag...
applying 1 policy to 1 resource... 
│───│─────────────────────│────────────────────│───────────│────────│
│ # │ POLICY              │ RULE               │ RESOURCE  │ RESULT │
│───│─────────────────────│────────────────────│───────────│────────│
│ 1 │ disallow-latest-tag │ require-image-tag  │ myapp-pod │ Pass   │
│ 2 │ disallow-latest-tag │ validate-image-tag │ myapp-pod │ Pass   │
│───│─────────────────────│────────────────────│───────────│────────│
Enter fullscreen mode Exit fullscreen mode

Oldest comments (0)