@monokle/cli

Welcome to Monokle CLI

Monokle CLI is a command-line interface for static analysis of Kubernetes resources.

Use it to prevent misconfigurations within Kustomize, Helm or default Kubernetes resources. The output is available as a SARIF file which you can upload to GitHub CodeScan.

Monokle CLI includes built-in validators for

• YAML Syntax
• Kubernetes Schema compliance
• Resource links between Kubernetes resources
• OPA Security policies

Under the hood it uses @monokle/validation which allows you to configure validation rules extensively.

Check out the announcement blog-post for an overview of all features.

Table of contents

• Installation
• Usage
  • Validate a YAML file
  • Validate a directory
  • Validate a templated Helm chart
  • Validate a Kustomize build
  • Generate SARIF analysis
• Configuration
  • Command-line arguments
  • @monokle/validation rules
  • Custom validators
• GitHub Action

Installation

You can install the CLI using brew (if you're on MacOS)

brew install kubeshop/monokle/monokle-cli

or as an NPM package (more installers coming up...).

npm install --global @monokle/cli

(We recommend using the LTS NodeJs version)

Usage

Once installed, using the CLI is straight-forward.

Validate a YAML file

monokle validate bundle.yaml

Validate a directory

This will recursively scan all YAML files and parse them as plain Kubernetes resources.

monokle validate k8s-dir

Validate a templated Helm chart

helm template helm-dir | monokle validate -

Validate a Kustomize build

kustomize build kustomize-dir/overlays/local | monokle validate -

Generate SARIF analysis

The Monokle CLI can output its results in SARIF format.

monokle validate --output sarif k8s-dir > results.sarif

Afterwards you could use VSC's SARIF Viewer or other tools to inspect the results.

Configuration

Command-line arguments

You can use --help to access help information directly from the CLI.

@monokle/validation rules

The Monokle CLI looks for a Monokle Validation configuration file at ./monokle.validation.yaml. You can change this by using the --config flag.

All rules are enabled by default and are described in the Monokle Validation configuration documentation.

Example

plugins:
  yaml-syntax: true
  kubernetes-schema: true
rules:
  yaml-syntax/no-bad-alias: "warn"
  yaml-syntax/no-bad-directive: false
  open-policy-agent/no-last-image: "err"
  open-policy-agent/cpu-limit: "err"
  open-policy-agent/memory-limit: "err"
  open-policy-agent/memory-request: "err"
settings:
  kubernetes-schema:
    schemaVersion: v1.24.2

Custom validators

It is easy to extend the Monokle CLI with custom validators that can be shared with others using our Monokle Community Plugins repository.

GitHub Action

The Monokle GitHub Action can be used to validate your resources as part of your CI/CD pipelines on GitHub