@monokle/cli

Monokle CLI for static Kubernetes analysis

Welcome to Monokle CLI

Monokle CLI is a command-line interface for static analysis of Kubernetes resources.

Use it to prevent misconfigurations within Kustomize, Helm or default Kubernetes resources. The output is available as a SARIF file which you can upload to GitHub CodeScan.

Under the hood it uses @monokle/validation which allows you to configure validation rules extensively.

Table of content

• Welcome to Monokle CLI
• Table of content
• Installation
  • Install as NPM package
  • Install as executable binary
• Usage
  • Validate a YAML file
  • Validate a directory
  • Validate a templated Helm chart
  • Validate a Kustomize build
  • Validate as SARIF analysis
• Configuration
  • Command-line arguments
  • @monokle/validation rules

Installation

You can install the CLI as an NPM package or as a executable binary (MacOS only).

Install as NPM package

Monokle CLI should be installed globally using the following method:

npm install --global @monokle/cli

We recommend using the LTS NodeJs version.

Install as executable binary

On MacOS you can simply install it with brew:

brew install @monokle/cli

You can expect a convenient binary for Windows and Linux soon.

Usage

Validate a YAML file

monokle validate bundle.yaml

Validate a directory

This will recursively scan all YAML files and parse them as plain Kubernetes resources.

monokle validate k8s-dir

Validate a templated Helm chart

helm template helm-dir | monokle validate -

Validate a Kustomize build

kustomize build kustomize-dir/overlays/local | monokle validate -

Validate as SARIF analysis

monokle validate --output sarif k8s-dir > results.sarif

Afterwards you could use VSC's SARIF Viewer or other tools to inspect the results.

Configuration

Command-line arguments

You can use --help to access help information directly from the CLI.

@monokle/validation rules

The Monokle Action looks for a Monokle Validation configuration.

The default path is found at ./monokle.validation.yaml. You can change this by using the --config flag.

Learn more about Monokle Validation configuration

Example

plugins:
  yaml-syntax: true
  kubernetes-schema: true
rules:
  yaml-syntax/no-bad-alias: "warn"
  yaml-syntax/no-bad-directive: false
  open-policy-agent/no-last-image: "err"
  open-policy-agent/cpu-limit: "err"
  open-policy-agent/memory-limit: "err"
  open-policy-agent/memory-request: "err"
settings:
  kubernetes-schema:
    schemaVersion: v1.24.2