Does it support CRD validation?

Absolutely. It generates x-kubernetes-validations rules for Custom Resource Definitions to enforce schema constraints and business logic at the API level.

How does it handle optional fields in Kubernetes objects?

The skill prioritizes production safety by using the has() function to check for field existence before access, preventing runtime evaluation errors when optional fields are missing.

Can I use it for security enforcement?

Yes, it includes patterns for Pod Security Standards, including dropping capabilities, restricting registries, blocking hostPath volumes, and preventing privileged containers.

What is CEL in the context of Kubernetes?

Common Expression Language (CEL) is a non-Turing complete language used by Kubernetes for fast, portable, and safe policy evaluation in ValidatingAdmissionPolicies and Custom Resource Definitions.

Can this skill help me migrate from OPA Gatekeeper?

Yes, this skill provides patterns and expressions to help you transition from external policy engines like OPA or Kyverno to native Kubernetes CEL policies.

CEL for Kubernetes Policy Generator

Name: CEL for Kubernetes Policy Generator
Author: tyrchen

bytyrchen

•

セキュリティとテスト

Generates production-ready Common Expression Language (CEL) for Kubernetes admission control, CRD validation rules, and security policy enforcement.

概要

This skill enables developers to create robust Kubernetes policies using native Common Expression Language (CEL). It provides specialized guidance for writing ValidatingAdmissionPolicies and CRD validation rules without the need for external webhooks. Users can generate comprehensive security constraints—such as Pod Security Standards, resource limits, and registry restrictions—while following production best practices like safe field access with the has() function and performance-optimized expressions to minimize API server overhead.

主な機能

11 GitHub stars
Create schema-level CRD validation rules using x-kubernetes-validations
Implement Pod Security Standards and container image restrictions
Migrate existing OPA/Gatekeeper or Kyverno policies to native CEL
Optimize CEL expressions for performance and safe field access
Generate production-ready ValidatingAdmissionPolicy resources

ユースケース

Replacing complex admission webhooks with lightweight native Kubernetes CEL policies
Validating resource configurations for mandatory labels, annotations, and naming conventions
Enforcing security constraints like disallowing privileged containers or specific registries

概要

主な機能

11 GitHub stars
Create schema-level CRD validation rules using x-kubernetes-validations
Implement Pod Security Standards and container image restrictions
Migrate existing OPA/Gatekeeper or Kyverno policies to native CEL
Optimize CEL expressions for performance and safe field access
Generate production-ready ValidatingAdmissionPolicy resources

ユースケース

Replacing complex admission webhooks with lightweight native Kubernetes CEL policies
Validating resource configurations for mandatory labels, annotations, and naming conventions
Enforcing security constraints like disallowing privileged containers or specific registries