Does it support CRD validation?

Absolutely. It generates x-kubernetes-validations rules for Custom Resource Definitions to enforce schema constraints and business logic at the API level.

How does it handle optional fields in Kubernetes objects?

The skill prioritizes production safety by using the has() function to check for field existence before access, preventing runtime evaluation errors when optional fields are missing.

Can I use it for security enforcement?

Yes, it includes patterns for Pod Security Standards, including dropping capabilities, restricting registries, blocking hostPath volumes, and preventing privileged containers.

What is CEL in the context of Kubernetes?

Common Expression Language (CEL) is a non-Turing complete language used by Kubernetes for fast, portable, and safe policy evaluation in ValidatingAdmissionPolicies and Custom Resource Definitions.

Can this skill help me migrate from OPA Gatekeeper?

Yes, this skill provides patterns and expressions to help you transition from external policy engines like OPA or Kyverno to native Kubernetes CEL policies.

CEL for Kubernetes Policy Generator

Name: CEL for Kubernetes Policy Generator
Author: tyrchen

bytyrchen

•

安全与测试

Generates production-ready Common Expression Language (CEL) for Kubernetes admission control, CRD validation rules, and security policy enforcement.

This skill enables developers to create robust Kubernetes policies using native Common Expression Language (CEL). It provides specialized guidance for writing ValidatingAdmissionPolicies and CRD validation rules without the need for external webhooks. Users can generate comprehensive security constraints—such as Pod Security Standards, resource limits, and registry restrictions—while following production best practices like safe field access with the has() function and performance-optimized expressions to minimize API server overhead.

主要功能

0111 GitHub stars

02Create schema-level CRD validation rules using x-kubernetes-validations

03Implement Pod Security Standards and container image restrictions

04Migrate existing OPA/Gatekeeper or Kyverno policies to native CEL

05Optimize CEL expressions for performance and safe field access

06Generate production-ready ValidatingAdmissionPolicy resources

使用场景

01Replacing complex admission webhooks with lightweight native Kubernetes CEL policies

02Validating resource configurations for mandatory labels, annotations, and naming conventions

03Enforcing security constraints like disallowing privileged containers or specific registries

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add tyrchen/claude-skills cel

For use in Claude.ai and ChatGPT

Download Skill