DevSecOps scripts
DevSecOps
The devsecops scripts and packages I've written, with their source shown directly below — no need to open GitHub to read them.
Kyverno policy schema validator
PythonRead-onlyPinned Kyverno v1.18.2 CRD validation
validate-kyverno-policy.py Python · 36 lines
scripts/validate-kyverno-policy.py
1"""Validate the lab image policy against the pinned Kyverno v1.18.2 CRD structural schema.
2
3Usage: python scripts/validate-kyverno-policy.py <crd.yaml> <policy.yaml>
4
5This is offline schema validation only. It does not execute signature,
6certificate, registry, transparency-log, or admission verification.
7"""
8import sys
9
10import jsonschema
11import yaml
12
13crd_path, policy_path = sys.argv[1], sys.argv[2]
14
15with open(crd_path, encoding="utf-8") as handle:
16 crd = yaml.safe_load(handle)
17with open(policy_path, encoding="utf-8") as handle:
18 policy = yaml.safe_load(handle)
19
20names = crd["spec"]["names"]
21group = crd["spec"]["group"]
22versions = {v["name"]: v for v in crd["spec"]["versions"]}
23
24api_group, _, api_version = policy["apiVersion"].partition("/")
25assert api_group == group, f"group mismatch: {api_group} != {group}"
26assert policy["kind"] == names["kind"], f"kind mismatch: {policy['kind']} != {names['kind']}"
27assert api_version in versions, f"version {api_version} not served by CRD"
28
29schema = versions[api_version]["schema"]["openAPIV3Schema"]
30jsonschema.validate(instance=policy, schema=schema)
31
32print(
33 f"PASS: {policy_path} conforms to {names['kind']} ({policy['apiVersion']}) "
34 f"structural schema from the pinned Kyverno v1.18.2 CRD."
35)
36print("NOTE: schema validation only; no signature, registry, transparency, or admission test was run.")What it does
Validates a Kyverno policy against a pinned CRD structural schema without requiring a live cluster.
Why it exists
The Kubernetes lab needs a deterministic structural check for its admission-policy examples.
Permissions and safety
None. It reads two local files and never contacts a cluster.
Usage
python scripts/validate-kyverno-policy.py <crd.yaml> <policy.yaml>What was tested
CI checks the published Kubernetes lab policy against the pinned CRD.
Limitations
- Schema validity does not prove signature verification or live admission behavior.
- Results apply to the pinned CRD version only.
Tetragon policy schema validator
PythonRead-onlyPinned Tetragon v1.7.0 CRD validation
validate-tetragon-policy.py Python · 38 lines
scripts/validate-tetragon-policy.py
1"""Validate the published Tetragon policy against the pinned v1.7.0 CRD structural schema.
2
3Usage: python scripts/validate-tetragon-policy.py <crd.yaml> <policy.yaml>
4
5Kubernetes CRD structural schemas are a restricted subset of JSON Schema, so a
6JSON Schema validator gives a faithful offline schema check. This is schema
7validation only; it is not a live admission or enforcement test.
8"""
9import sys
10
11import jsonschema
12import yaml
13
14crd_path, policy_path = sys.argv[1], sys.argv[2]
15
16with open(crd_path, encoding="utf-8") as handle:
17 crd = yaml.safe_load(handle)
18with open(policy_path, encoding="utf-8") as handle:
19 policy = yaml.safe_load(handle)
20
21names = crd["spec"]["names"]
22group = crd["spec"]["group"]
23versions = {v["name"]: v for v in crd["spec"]["versions"]}
24
25api_group, _, api_version = policy["apiVersion"].partition("/")
26assert api_group == group, f"group mismatch: {api_group} != {group}"
27assert policy["kind"] == names["kind"], f"kind mismatch: {policy['kind']} != {names['kind']}"
28assert api_version in versions, f"version {api_version} not served by CRD"
29assert crd["spec"]["scope"] == "Namespaced", "expected a namespaced CRD"
30
31schema = versions[api_version]["schema"]["openAPIV3Schema"]
32jsonschema.validate(instance=policy, schema=schema)
33
34print(
35 f"PASS: {policy_path} conforms to {names['kind']} ({policy['apiVersion']}) "
36 f"structural schema from the pinned Tetragon v1.7.0 CRD."
37)
38print("NOTE: schema validation only; no live cluster enforcement test was run.")What it does
Validates a namespaced Tetragon tracing policy against a pinned CRD structural schema.
Why it exists
The runtime-protection research needs an offline structural check before any live enforcement test.
Permissions and safety
None. It reads local files and never contacts a cluster.
Usage
python scripts/validate-tetragon-policy.py <crd.yaml> <policy.yaml>What was tested
CI checks the published policy against the pinned Tetragon CRD.
Limitations
- Schema validity does not prove live eBPF enforcement behavior.
- Results apply to the pinned CRD version only.