{"id":22238017,"url":"https://github.com/accuknox/kubernetes-cel-validator","last_synced_at":"2026-03-18T01:35:01.484Z","repository":{"id":168615416,"uuid":"637777742","full_name":"accuknox/kubernetes-cel-validator","owner":"accuknox","description":"Library to validate Kubernetes cluster resources against a set of rules defined using the CEL language.","archived":false,"fork":false,"pushed_at":"2023-05-24T11:16:05.000Z","size":47,"stargazers_count":7,"open_issues_count":1,"forks_count":3,"subscribers_count":3,"default_branch":"main","last_synced_at":"2025-07-15T13:16:44.961Z","etag":null,"topics":["cel-go","common-expression-language","kubernetes","validation"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/accuknox.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-05-08T11:43:11.000Z","updated_at":"2024-01-11T06:23:34.000Z","dependencies_parsed_at":"2023-06-11T17:31:57.573Z","dependency_job_id":null,"html_url":"https://github.com/accuknox/kubernetes-cel-validator","commit_stats":null,"previous_names":["accuknox/kubernetes-cel-validator"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/accuknox/kubernetes-cel-validator","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/accuknox%2Fkubernetes-cel-validator","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/accuknox%2Fkubernetes-cel-validator/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/accuknox%2Fkubernetes-cel-validator/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/accuknox%2Fkubernetes-cel-validator/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/accuknox","download_url":"https://codeload.github.com/accuknox/kubernetes-cel-validator/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/accuknox%2Fkubernetes-cel-validator/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":30640244,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-03-18T00:09:27.587Z","status":"ssl_error","status_checked_at":"2026-03-18T00:09:26.123Z","response_time":56,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["cel-go","common-expression-language","kubernetes","validation"],"created_at":"2024-12-03T03:14:38.025Z","updated_at":"2026-03-18T01:35:01.460Z","avatar_url":"https://github.com/accuknox.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Kubernetes CEL Validator\n\n## Description\n\nThis is a library to validate Kubernetes cluster resources against a set of rules defined using the [CEL](https://github.com/google/cel-spec) language.\n\nThe CEL used uses both [CEL community libraries](https://kubernetes.io/docs/reference/using-api/cel/#cel-community-libraries) and [Kubernetes CEL libraries](https://kubernetes.io/docs/reference/using-api/cel/#kubernetes-cel-libraries).\n\nPlease read the CEL Introduction at https://kubernetes.io/docs/reference/using-api/cel/ to know about working with CEL.\n\n[![Go Build and Test](https://github.com/accuknox/kubernetes-cel-validator/actions/workflows/go.yml/badge.svg)](https://github.com/accuknox/kubernetes-cel-validator/actions/workflows/go.yml)\n\n## Usage\n\nThis is a library that can be used in your own Go code. You can use it in your own code by importing it:\n\n```go\npackage testvalidate\n\nimport (\n\tcelvalidator \"github.com/accuknox/kubernetes-cel-validator/resource-cel-validator/pkg\"\n\tcelvalidatortypes \"github.com/accuknox/kubernetes-cel-validator/resource-cel-validator/pkg/types\"\n\tmetav1 \"k8s.io/apimachinery/pkg/apis/meta/v1\"\n\t\"k8s.io/apimachinery/pkg/runtime/schema\"\n\t\"k8s.io/client-go/rest\"\n)\n\nfunc ValidateResource(config *rest.Config) (bool, []celvalidatortypes.ValidationFailure, celvalidatortypes.ValidationFailure, error) {\n\tkubernetesResourcePrecondition := celvalidatortypes.KubernetesResourcePrecondition{\n\t\tName: \"test-precondition\",\n\t\tMatchResources: \u0026celvalidatortypes.MatchResources{\n\t\t\tNamespaceSelector: \u0026metav1.LabelSelector{\n\t\t\t\tMatchLabels: map[string]string{\n\t\t\t\t\t\"test\": \"test\",\n\t\t\t\t},\n\t\t\t},\n\t\t\tObjectSelector: \u0026metav1.LabelSelector{\n\t\t\t\tMatchLabels: map[string]string{\n\t\t\t\t\t\"test\": \"test\",\n\t\t\t\t},\n\t\t\t},\n\t\t\tResourceRules: []schema.GroupVersionResource{\n\t\t\t\t{\n\t\t\t\t\tGroup:    \"apps\",\n\t\t\t\t\tVersion:  \"v1\",\n\t\t\t\t\tResource: \"deployments\",\n\t\t\t\t},\n\t\t\t},\n\t\t\tSelectionPreconditions: []celvalidatortypes.Validation{\n\t\t\t\t{\n\t\t\t\t\tKey:               \"test-label-using-cel\",\n\t\t\t\t\tExpression:        \"object.metadata.labels.foo == 'bar'\",\n\t\t\t\t\tMessageExpression: \"resource.metadata.name + ' does not have label foo=bar'\",\n\t\t\t\t},\n\t\t\t},\n\t\t},\n\t\tValidations: []celvalidatortypes.Validation{\n\t\t\t{\n\t\t\t\tKey:               \"test-replicas\",\n\t\t\t\tExpression:        \"object.spec.replicas \u003e 1\",\n\t\t\t\tMessageExpression: \"resource.metadata.name + ' has more than 1 replica'\",\n\t\t\t},\n\t\t},\n\t}\n\n\tvalidationResult, selectionPreconditionValidationFailures, validationFailure, err := celvalidator.GetKubernetesResourcePreconditionResult(\u0026kubernetesResourcePrecondition, config)\n\treturn validationResult, selectionPreconditionValidationFailures, validationFailure, err\n}\n```\n\nThe method `celvalidator.GetKubernetesResourcePreconditionResult(..)` returns:\n1. A boolean value indicating the result of the validation.\n2. A list of `celvalidatortypes.ValidationFailure` objects which contain details of object that failed the `**SelectionPreconditions**`.\n3. A `celvalidatortypes.ValidationFailure` object which contains details of the object that failed the `**Validations**`.\n4. An error that might be encountered during validation phase, resource selection phase or during the creation of the Kubernetes client.\n\n## Field Specification\n\nIt is really common to use YAML to specify the rules and then unmarshal it into the `celvalidatortypes.KubernetesResourcePrecondition` object. The following is an example of the YAML specification:\n\n```yaml\nname: replicas-precondition # Mandatory, name of the precondition\nmatchResources:             # Mandatory, resource selection criteria\n  namespaceSelector:        # Optional, namespace selection criteria\n    matchExpressions:       # Optional, namespace selection criteria\n      - key: hoo\n        operator: DoesNotExist\n    matchLabels:            # Optional, namespace selection criteria\n      kubernetes.io/metadata.name: validation-test-ns\n  objectSelector:           # Optional, object selection criteria\n    matchExpressions:       # Optional, object selection criteria\n      - key: hoo\n        operator: DoesNotExist\n    matchLabels:            # Optional, object selection criteria\n      app: nginx\n  resourceRules:            # Mandatory, resource selection criteria, at least one resource rule is required\n    - Group: apps\n      Version: v1\n      Resource: deployments\n  selectionPreconditions:   # Optional, selection preconditions\n    - key: \"nginx-name\"     # Optional, key of the precondition\n      messageExpression: \"'resource: ' + object.metadata.name + ' is not nginx'\" # Optional, message to be displayed when the precondition fails\n      expression: \"object.metadata.name == 'nginx'\"                              # Mandatory, CEL expression to be evaluated\nvalidations:                                # Mandatory, validations, at least one validation is required\n  - expression: \"object.spec.replicas == 1\" # Mandatory, CEL expression to be evaluated\n    key: \"single-replica\"                   # Optional, key of the validation\n    messageExpression: \"'resource: ' + object.metadata.name + ' does not have 1 replica, it has ' + string(object.spec.replicas)\" \n                                            # ⬆ Optional, message to be displayed when the validation fails\n```\n\n## Contributing\n\n1. Fork it\n2. Create your feature branch (`git checkout -b my-new-feature`)\n3. Commit your changes (`git commit -s -m'Add some feature'`) (Commits need to be signed)\n4. Push to the branch (`git push origin my-new-feature`)\n5. Create new Pull Request\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faccuknox%2Fkubernetes-cel-validator","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faccuknox%2Fkubernetes-cel-validator","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faccuknox%2Fkubernetes-cel-validator/lists"}