Datree

https://hub.datree.io/
Admin
Datree is a Kubernetes security tool that prevents the deployment of misconfigured resources by...
Tokens:1,217,561
Snippets:5,168
Trust Score:9.7
Update:1 year ago
Show doc for...
Tokens:
Raw
### Datree Quickstart Guide

Source: https://hub.datree.io/index

This guide provides instructions on installing Datree to gain insights into your Kubernetes cluster's status and enforce desired policies on new resources. It explains how to enable enforcement mode.

```APIDOC
Functionality: Install Datree and enforce policies

Description: Install Datree to get insights on the status of your cluster and enforce your desired policies on new resources.

Default Behavior: By default, Datree does not block misconfigured resources; it only monitors and alerts about them.

Enforcement Mode: To enable **enforcement mode**, see the [behavior](https://hub.datree.io/configuration/behavior) page.
```

--------------------------------

### Datree values.yaml example

Source: https://hub.datree.io/index

A minimal example of a values.yaml file for Datree installation, specifying the required token and cluster name.

```yaml
#values.yaml
datree:
token: 1234-abcd-5678-efgh
clusterName: MyAwesomeCluster
```

--------------------------------

### Install Datree CLI

Source: https://hub.datree.io/cli/getting-started

Provides commands for installing the Datree CLI on Linux, macOS, Windows, and via Docker. Includes instructions for Homebrew and MacPorts.

```bash
curl https://get.datree.io | /bin/bash
```

```powershell
iwr -useb https://get.datree.io/windows_install.ps1 | iex
```

```bash
brew tap datreeio/datree
brew install datreeio/datree/datree
```

```docker
docker pull datree/datree
```

```bash
sudo port install datree
```

--------------------------------

### Datree CI/CD Publish Policies Example

Source: https://hub.datree.io/dashboard/policy-as-code

An example GitHub Actions workflow that checks out code, installs Datree, and publishes a policies.yaml file as part of a CI/CD pipeline. This ensures policies are validated and updated automatically.

```bash
name: CI

on:
push:
branches:[main]

env:
DATREE_TOKEN: ${{ secrets.DATREE_TOKEN }}

jobs:
publish-policy-as-code:
runs-on: ubuntu-latest

steps:
-name: Checkout
uses: actions/checkout@v2

-name: Install Datree
run: curl https://get.datree.io | /bin/bash

-name: Publish Policies
run: datree publish policies.yaml

```

--------------------------------

### GitLab CI/CD Configuration Example

Source: https://hub.datree.io/cicd-examples/gitLab-ci-cd

This example demonstrates how to add Datree to your GitLab CI script. It includes steps to download the Datree CLI and run a test against a Kubernetes configuration file.

```yaml
image: node:14

stages:
- test

test:
stage: test
script:
- curl https://get.datree.io | /bin/bash
- datree test ~/.datree/k8s-demo.yaml

```

--------------------------------

### Install Datree using Helm

Source: https://hub.datree.io/index

Installs the Datree admission webhook using Helm. This involves adding the Datree Helm repository and then installing the chart with specified token and cluster name.

```sh
helm repo add datree-webhook https://datreeio.github.io/admission-webhook-datree
helm repo update
helm install -n datree datree-webhook datree-webhook/datree-admission-webhook --debug \
--create-namespace \
--set datree.token=<DATREE_TOKEN> \
--set datree.clusterName=$(kubectl config current-context)
```

```sh
helm repo add datree-webhook https://datreeio.github.io/admission-webhook-datree
helm repo update
helm install -n datree datree-webhook datree-webhook/datree-admission-webhook --debug \
--create-namespace \
--set datree.token=<DATREE_TOKEN> \
--set datree.clusterName=$(kubectl config current-context) \
--set securityContext.runAsUser=null \
--set datree.labelKubeSystem=false
kubectl label ns kube-system datree admission.datree/validate=skip --overwrite
```

--------------------------------

### GitLab CI/CD Example

Source: https://hub.datree.io/cicd-examples/gitLab-ci-cd

An example of how Datree can be integrated into a GitLab CI/CD pipeline to enforce policies during the deployment process.

```YAML
stages:
  - validate

validate-k8s-config:
  stage: validate
  image: datreeio/datree
  script:
    - datree test k8s-manifests/*.yaml --policy my-datree-policy
  artifacts:
    when: always
    reports:
      junit: datree-report.xml

```

--------------------------------

### CircleCI Configuration Example

Source: https://hub.datree.io/cicd-examples/circle-ci

This example demonstrates how to configure a CircleCI pipeline to use Datree. It includes steps for checking out code, building the project, and running Datree tests.

```yaml
version:2.1
jobs:
build:
docker:
-image: circleci/node
steps:
- checkout
-run: npm run build
test:
docker:
-image: circleci/node
steps:
- checkout
-run: curl https://get.datree.io | /bin/bash
-run: datree test ~/.datree/k8s-demo.yaml

workflows:
main:
jobs:
- build
- test

```

--------------------------------

### Example policies.yaml Configuration

Source: https://hub.datree.io/dashboard/policy-as-code

An example of a Kubernetes Policy as Code configuration file (policies.yaml) defining policies with rules and failure messages.

```yaml
apiVersion: v1
policies:
-name: Default
isDefault:true
rules:
-identifier: CONTAINERS_MISSING_IMAGE_VALUE_VERSION
messageOnFailure: Incorrect value for key `image` - specify an image version to avoid unpleasant "version surprises" in the future
-identifier: DEPLOYMENT_MISSING_LABEL_ENV_VALUE
messageOnFailure:'Missing label object `env` - add a proper environment description (e.g. "prod", "testing", etc.) to the Deployment config'
```

--------------------------------

### CI/CD Platform Examples

Source: https://hub.datree.io/cicd-examples

Examples of integrating Datree into popular CI/CD platforms. This section provides links to specific workflow configurations for each platform, enabling users to quickly set up Datree checks in their pipelines.

```APIDOC
CI/CD Platform Workflows:

- GitHub Actions: [Link to GitHub workflow example]
- CircleCI: [Link to CircleCI example]
- Travis CI: [Link to Travis CI example]
- GitLab CI/CD: [Link to GitLab CI/CD example]
- Jenkins Pipeline: [Link to Jenkins pipeline example]
- Drone Pipeline: [Link to Drone pipeline example]
- Azure Pipeline: [Link to Azure pipeline example]
- Codefresh: [Link to Codefresh example]

Note: If your preferred CI/CD platform is not listed, you can request support by opening an issue on the Datree GitHub repository.
```

--------------------------------

### Datree Sitemap

Source: https://hub.datree.io/dashboard/repairing

Lists the sitemap for Datree, including links to getting started, built-in rules, custom rules, integrations, CI/CD examples, data privacy, and troubleshooting.

```Markdown
Sitemap
  * [Getting started](https://hub.datree.io/)
  * [Built in rules](https://hub.datree.io/built-in-rules)
  * [Custom rules](https://hub.datree.io/custom-rules)
  * [Integrations](https://hub.datree.io/integrations)
  * [CI/CD examples](https://hub.datree.io/cicd-examples)
  * [Data Privacy](https://hub.datree.io/data-privacy)
  * [Troubleshooting](https://hub.datree.io/troubleshooting)
```

--------------------------------

### Install Datree using Flux

Source: https://hub.datree.io/index

Installs Datree using Flux by creating a HelmRepository source and a HelmRelease resource. Requires specifying the Helm repository URL, chart name, values file, and namespace.

```sh
kubectl create namespace datree
flux create source helm admission-webhook-datree --url https://datreeio.github.io/admission-webhook-datree --namespace datree
flux create hr admission-webhook-datree --chart=datree-admission-webhook --source=HelmRepository/admission-webhook-datree --values=<path-to-values-file.yaml> --namespace=datree
```

--------------------------------

### Fish Autocompletion Setup

Source: https://hub.datree.io/cli/cli-arguments

Provides instructions for enabling Datree CLI autocompletion in the Fish shell. It shows how to load completions for the current session and how to save them for future sessions.

```fish
datree completion fish | source

# To load completions for each session:
datree completion fish > ~/.config/fish/completions/datree.fish
```

--------------------------------

### Datree Webhook Installation Debug Script

Source: https://hub.datree.io/troubleshooting

This script helps debug issues during Datree webhook installation by generating a troubleshoot.log file. It fetches the script from GitHub and executes it, redirecting output to a log file.

```bash
curl https://raw.githubusercontent.com/datreeio/admission-webhook-datree/main/scripts/troubleshoot.sh | /bin/bash > troubleshoot.logs 2>&1
cat troubleshoot.logs
```

--------------------------------

### Datree Skip Patterns Examples

Source: https://hub.datree.io/configuration/behavior

Examples of regular expression patterns for the `customSkipList` to skip resources based on namespace, kind, or name.

```yaml
myNs;(.*);(.*)
```

```yaml
(.*);ServiceAccount;(.*)
```

```yaml
(.*);(.*);(^appName-.*)
```

--------------------------------

### Datree.io Project Navigation

Source: https://hub.datree.io/dashboard/activity-log

Provides links to key sections of the Datree.io project, including custom rules, integrations, CLI documentation, CI/CD examples, data privacy information, troubleshooting guides, and community resources.

```APIDOC
Datree.io Project Sections:

- Custom rules: https://hub.datree.io/dashboard/activity-log
- Integrations: https://hub.datree.io/integrations
- CLI: https://hub.datree.io/dashboard/activity-log
- CI/CD examples: https://hub.datree.io/cicd-examples
- Data privacy: https://hub.datree.io/data-privacy
- Troubleshooting: https://hub.datree.io/troubleshooting
- Guides & articles: https://hub.datree.io/dashboard/activity-log
- Resources: https://github.com/datreeio/awesome-datree/blob/main/README.md
```

--------------------------------

### Datree CLI Rule Output Example

Source: https://hub.datree.io/built-in-rules/ensure-seccomp-profile-default

This example shows the output from the Datree CLI when testing Kubernetes YAML files. It indicates a failure for the seccomp profile rule, specifying the invalid key and suggesting the correct values.

```bash
$ datree test *.yaml

>> File: failExample.yaml
❌ Ensure seccomp profile is set to docker/default or runtime/default [1 occurrence]
💡 Invalid value for key `seccomp.security.alpha.kubernetes.io/pod` - set to docker/default or runtime/default to ensure restricted privileges

```

--------------------------------

### PowerShell Autocompletion Setup

Source: https://hub.datree.io/cli/cli-arguments

Details how to set up Datree CLI autocompletion for PowerShell. It includes commands to load completions for the current session and to save them for all future sessions.

```powershell
PS> datree completion powershell | Out-String | Invoke-Expression

# To load completions for every new session:
PS> datree completion powershell > datree.ps1

# Then, source this file from your PowerShell profile.
```

--------------------------------

### Bash Autocompletion Setup

Source: https://hub.datree.io/cli/cli-arguments

Enables Datree CLI autocompletion for Bash. It provides commands to load completions for the current session and permanently for future sessions on Linux and macOS.

```bash
source <(datree completion bash)

# To load completions for each session:
# Linux:
datree completion bash > /etc/bash_completion.d/datree
# MacOS:
datree completion bash > /usr/local/etc/bash_completion.d/datree
```

--------------------------------

### Zsh Autocompletion Setup

Source: https://hub.datree.io/cli/cli-arguments

Configures Datree CLI autocompletion for Zsh. It includes steps to enable shell completion if not already active and instructions to load completions for each session.

```zsh
echo "autoload -U compinit; compinit" >> ~/.zshrc

# To load completions for each session:
datree completion zsh > "${fpath[1]}/_datree"

# Start a new shell for this setup to take effect.
```

--------------------------------

### Datree CLI Rule Output

Source: https://hub.datree.io/built-in-rules/ensure-initial-probe-delay

Example output from the Datree CLI when the rule fails, indicating the specific issue with 'initialDelaySeconds' and providing a hint for correction.

```cli
$ datree test *.yaml

>> File: failExample.yaml
❌ Ensure each container probe has an initial delay configured [1 occurrence]
💡 Incorrect value for key `initialDelaySeconds` - set explicitly to control the start time before a probe is initiated (min 0)
```

--------------------------------

### Datree Sitemap

Source: https://hub.datree.io/dashboard/activity-log

Provides a sitemap for the Datree.io website, outlining the main sections and their corresponding URLs for easy navigation. Includes links to getting started, built-in rules, custom rules, integrations, CI/CD examples, data privacy, and troubleshooting.

```APIDOC
Datree.io Sitemap:

- Getting started: https://hub.datree.io/
- Built in rules: https://hub.datree.io/built-in-rules
- Custom rules: https://hub.datree.io/custom-rules
- Integrations: https://hub.datree.io/integrations
- CI/CD examples: https://hub.datree.io/cicd-examples
- Data Privacy: https://hub.datree.io/data-privacy
- Troubleshooting: https://hub.datree.io/troubleshooting
```

--------------------------------

### Travis CI Configuration Example

Source: https://hub.datree.io/cicd-examples/travis-ci

This snippet shows a basic Travis CI configuration for a Node.js project. It includes steps to download and run the Datree CLI, and then execute Datree tests on a Kubernetes configuration file.

```yaml
language: node_js
node_js:'14'
script:
- curl https://get.datree.io | /bin/bash
- datree test ~/.datree/k8s-demo.yaml

```

--------------------------------

### Datree Navigation Links

Source: https://hub.datree.io/dashboard/clusters

Provides links to various sections of the Datree platform, including custom rules, integrations, CLI, CI/CD examples, data privacy, troubleshooting, guides, and resources.

```Markdown
* [🤖 Custom rules](https://hub.datree.io/dashboard/clusters)
* [🔌 Integrations](https://hub.datree.io/integrations)
* [🖥️ CLI](https://hub.datree.io/dashboard/clusters)
* [⏩ CI/CD examples](https://hub.datree.io/cicd-examples)
* [🔐 Data privacy](https://hub.datree.io/data-privacy)
* [🗃️ Troubleshooting](https://hub.datree.io/troubleshooting)
* [📕 Guides & articles](https://hub.datree.io/dashboard/clusters)
* [📚 Resources](https://github.com/datreeio/awesome-datree/blob/main/README.md)
```

--------------------------------

### Datree Navigation Links

Source: https://hub.datree.io/dashboard/repairing

Provides links to different sections of the Datree platform, including custom rules, integrations, CLI documentation, CI/CD examples, data privacy information, troubleshooting guides, and resources.

```Markdown
* [🤖 Custom rules](https://hub.datree.io/dashboard/repairing)
* [🔌 Integrations](https://hub.datree.io/integrations)
* [🖥 CLI](https://hub.datree.io/dashboard/repairing)
* [⏩ CI/CD examples](https://hub.datree.io/cicd-examples)
* [🔐 Data privacy](https://hub.datree.io/data-privacy)
* [🗃️ Troubleshooting](https://hub.datree.io/troubleshooting)
* [📕 Guides & articles](https://hub.datree.io/dashboard/repairing)
* [📚 Resources](https://github.com/datreeio/awesome-datree/blob/main/README.md)
```

--------------------------------

### Datree Token Management Recommendations

Source: https://hub.datree.io/guides/integration-guide

Recommendations for setting up tokens for Datree integration, including read and write tokens for CI, cluster integration, and policy-as-code.

```English
* 1 read token for your CI machine.
* 1 read token for your cluster integration.
* 1 write token if using [policy-as-code](https://hub.datree.io/dashboard/policy-as-code).
```

--------------------------------

### Datree CLI Arguments and Configuration

Source: https://hub.datree.io/cli/cli-arguments

This section details the various arguments and configuration options available for the Datree CLI. It covers how to set up Datree, manage its behavior, and integrate it into workflows.

```APIDOC
Datree CLI Arguments:

--config <path>
  Specifies the path to the Datree configuration file.

--output <format>
  Sets the output format for Datree's results (e.g., json, yaml, table).

--verbose
  Enables verbose logging for detailed output.

--no-color
  Disables colored output in the terminal.

Configuration Options:

policy:
  Specifies the policy to be enforced. Can be a built-in rule or a custom policy.

exclude:
  A list of files or directories to exclude from scanning.

plugins:
  Configuration for custom plugins to extend Datree's functionality.
```

--------------------------------

### Kubernetes Readiness Probe Configuration

Source: https://hub.datree.io/built-in-rules/ensure-readiness-probe

This rule checks for the absence of a readinessProbe in Kubernetes container definitions. It provides examples of how to configure readiness probes using HTTP GET requests, TCP sockets, and exec commands to ensure pods are ready to receive traffic.

```yaml
spec:
  containers:
  - name: app
    image: nginx:1.19.8

```

```yaml
spec:
  containers:
  - name: app
    image: nginx:1.19.8
    readinessProbe:
      httpGet:
        path: /healthz
        port: 8080

```

```yaml
spec:
  containers:
  - name: app
    image: nginx:1.19.8
    readinessProbe:
      tcpSocket:
        port: 8080

```

```yaml
spec:
  containers:
  - name: app
    image: nginx:1.19.8
    readinessProbe:
      exec:
        command:
        - cat
        - /tmp/healthy

```

--------------------------------

### Datree Open Documentation

Source: https://hub.datree.io/cli/cli-arguments

Opens the Datree documentation website in the default web browser.

```bash
datree docs
```

--------------------------------

### Kubernetes v1.21 Deprecated API Usage Example

Source: https://hub.datree.io/built-in-rules/prevent-deprecated-api-121

Example of a Kubernetes CronJob resource using a deprecated API version (batch/v1beta1) which will fail validation.

```yaml
apiVersion: batch/v1beta1
kind: CronJob
```

--------------------------------

### Kubernetes v1.21 Supported API Usage Example

Source: https://hub.datree.io/built-in-rules/prevent-deprecated-api-121

Example of a Kubernetes CronJob resource using a supported API version (batch/v1) as recommended for Kubernetes v1.21.

```yaml
apiVersion: batch/v1
kind: CronJob
```

--------------------------------

### Datree Kustomize Support

Source: https://hub.datree.io/cli/cli-arguments

Renders resources from a kustomization.yaml file and runs policy checks against them. Requires specifying the path to the kustomization.yaml file.

```bash
datree kustomize test [path]
```

--------------------------------

### Helm Command Not Found Error

Source: https://hub.datree.io/troubleshooting

Error message indicating that the Helm command is not installed or not found in the system's PATH. This is a prerequisite for installing Datree via Helm.

```text
helm: command not found  
```

--------------------------------

### Install Datree using Argo CD CLI

Source: https://hub.datree.io/index

Creates a new Argo CD application to deploy Datree. Requires specifying the repository, chart, revision, namespace, and setting the Datree token and cluster name.

```sh
argocd app create datree --repo https://datreeio.github.io/admission-webhook-datree --helm-chart datree-admission-webhook --revision 0.3.83 --dest-namespace datree --dest-server https://kubernetes.default.svc --helm-set datree.token=<DATREE_TOKEN> --helm-set datree.clusterName=$(kubectl config current-context) --sync-option CreateNamespace=true
```

--------------------------------

### Fixing Missing Dependencies on Alpine Linux

Source: https://hub.datree.io/troubleshooting

To resolve missing dependencies when running Datree on Alpine Linux, add this command to your CI to install curl and bash, which are required by Datree's installation scripts.

```bash
apk add curl bash
```

--------------------------------

### Kubernetes Configuration and Best Practices

Source: https://hub.datree.io/guides/integration-guide

Rules for ensuring proper configuration of Kubernetes resources, including labels, replicas, and restart policies.

```Kubernetes
Ensure Deployment has a configured `env` label
Ensure workload has valid label values
Ensure Deployment has more than one replica configured
Ensure workload has a configured `owner` label
Ensure deployment-like resource is using a valid restart policy
Prevent workload from using the default namespace
```

--------------------------------

### Deployment Configuration Best Practices

Source: https://hub.datree.io/dashboard/activity-log

These rules ensure proper configuration of deployments and related resources, including labels, replica counts, restart policies, and namespace usage.

```Kubernetes
☑️ Ensure Deployment has a configured `env` label
☑️ Ensure workload has valid label values
☑️ Ensure Deployment has more than one replica configured
☑️ Ensure workload has a configured `owner` label
☑️ Ensure deployment-like resource is using a valid restart policy
☑️ Prevent workload from using the default namespace
```

--------------------------------

### Codefresh CI Configuration with Datree

Source: https://hub.datree.io/cicd-examples/codefresh

This snippet shows a sample Codefresh CI configuration file that includes a step to run Datree policy checks. It demonstrates how to define stages, steps, and arguments, including passing the DATREE_TOKEN and specifying the input file path.

```YAML
version:"1.0"
stages:
  -"clone"
  -"datree-policy-check"

steps:
clone:
  title:"Cloning repository"
  type:"git-clone"
  repo:"myOrg/myRepo"
  revision:"${{CF_BRANCH}}"
  git:"github"
  stage:"clone"

datree-policy-check:
  title: Run Datree policy check
  type: datree/datree-policy-check
  stage:"datree-policy-check"
  arguments:
    DATREE_TOKEN:"${{DATREE_TOKEN}}"
    INPUT_PATH:'fileName.yaml'

```

--------------------------------

### Kubernetes Schema Validation Example

Source: https://hub.datree.io/troubleshooting

Example output showing Datree's schema validation status for a Kubernetes cluster. It indicates whether the validation passed or failed based on the cluster's schema version.

```text
(Summary)  
- Passing YAML validation: 1/1  
- Passing Kubernetes (1.20.0) schema validation: 0/1  
```

--------------------------------

### Kubernetes Configuration Best Practices

Source: https://hub.datree.io/custom-rules/cel-support

Rules to ensure proper configuration of Kubernetes resources, including labels, replicas, namespaces, and restart policies.

```Kubernetes
apiVersion: datree.io/v1
kind: Policy
metadata:
  name: ensure-env-label
spec:
  rules:
    - name: Ensure Deployment has a configured `env` label
      message: "Deployments should have an 'env' label for environment identification."
      policy: |
        """
        package datree

        deny {
          input.kind = "Deployment"
          not input.metadata.labels.env
        }
        """

```

```Kubernetes
apiVersion: datree.io/v1
kind: Policy
metadata:
  name: ensure-labels-value-valid
spec:
  rules:
    - name: Ensure workload has valid label values
      message: "Workload labels must adhere to valid naming conventions."
      policy: |
        """
        package datree

        deny {
          input.kind = "Pod"
          label := input.metadata.labels[_]
          not label =~ "^[a-z0-9A-Z._/-]+"
        }
        """

```

```Kubernetes
apiVersion: datree.io/v1
kind: Policy
metadata:
  name: ensure-minimum-two-replicas
spec:
  rules:
    - name: Ensure Deployment has more than one replica configured
      message: "Deployments should have more than one replica for high availability."
      policy: |
        """
        package datree

        deny {
          input.kind = "Deployment"
          input.spec.replicas <= 1
        }
        """

```

```Kubernetes
apiVersion: datree.io/v1
kind: Policy
metadata:
  name: ensure-owner-label
spec:
  rules:
    - name: Ensure workload has a configured `owner` label
      message: "Workloads should have an 'owner' label for accountability."
      policy: |
        """
        package datree

        deny {
          input.kind = "Pod"
          not input.metadata.labels.owner
        }
        """

```

```Kubernetes
apiVersion: datree.io/v1
kind: Policy
metadata:
  name: ensure-valid-restart-policy
spec:
  rules:
    - name: Ensure deployment-like resource is using a valid restart policy
      message: "Deployment-like resources must use a valid restart policy."
      policy: |
        """
        package datree

        deny {
          input.kind = "Pod"
          input.spec.restartPolicy != "Always"
        }
        """

```

```Kubernetes
apiVersion: datree.io/v1
kind: Policy
metadata:
  name: prevent-default-namespace
spec:
  rules:
    - name: Prevent workload from using the default namespace
      message: "Workloads should not be deployed in the 'default' namespace for better organization."
      policy: |
        """
        package datree

        deny {
          input.kind = "Pod"
          input.metadata.namespace = "default"
        }
        """

```

--------------------------------

### Datree Schema Validation Error Example

Source: https://hub.datree.io/troubleshooting

This example shows the error message encountered when Datree's Kubernetes schema validation fails, indicating potential issues with schema versions, deprecated API versions, or missing CRD schemas.

```bash
❌  k8s schema validation error: could not find schema for [kindName]
```

--------------------------------

### Datree CLI Rule Output Example

Source: https://hub.datree.io/built-in-rules/prevent-system-call-privileges

This example shows the output from the Datree CLI when the 'Prevent containers from having unnecessary system call privileges' rule is violated. It indicates the file, the rule that failed, the number of occurrences, and provides a hint for remediation.

```shell
$ datree test *.yaml

>> File: failExample.yaml
❌ Prevent containers from having unnecessary system call privileges [1 occurrence]
💡 Incorrect value for key `seccompProfile` - set an explicit value to prevent malicious use of system calls within the container
```

--------------------------------

### CEL Custom Rule Example - ServiceAccount Token

Source: https://hub.datree.io/custom-rules/cel-support

This example demonstrates a Datree custom rule written in CEL that enforces a specific policy on ServiceAccount resources, ensuring 'automountServiceAccountToken' is set to false. It includes the rule's expression and an optional message for violations.

```APIDOC
schema:
CELDefinition:
- expression: "object.kind != 'ServiceAccount' || (has(object.automountServiceAccountToken) && object.automountServiceAccountToken == false)"
  message: "ServiceAccounts must have automountServiceAccountToken set to false"
```

--------------------------------

### Deployment and Workload Configuration

Source: https://hub.datree.io/cicd-examples/gitLab-ci-cd

These rules ensure proper configuration of deployments and workloads, including labels, replicas, and restart policies, to maintain application stability and manageability.

```Kubernetes
apiVersion: datree.io/v1
kind: Policy
metadata:
  name: ensure-env-label
spec:
  rules:
    - name: "Ensure Deployment has a configured `env` label"
      message: "Deployments should have an `env` label to identify the environment."
      resources:
        - "deployments"
      actions:
        - "create"
        - "update"
      parameters:
        labels:
          env: "*"

```

```Kubernetes
apiVersion: datree.io/v1
kind: Policy
metadata:
  name: ensure-labels-value-valid
spec:
  rules:
    - name: "Ensure workload has valid label values"
      message: "Workload labels must adhere to Kubernetes naming conventions."
      resources:
        - "*"
      actions:
        - "create"
        - "update"
      parameters:
        labelValueRegex: "^[a-zA-Z0-9_.-]+$"

```

```Kubernetes
apiVersion: datree.io/v1
kind: Policy
metadata:
  name: ensure-minimum-two-replicas
spec:
  rules:
    - name: "Ensure Deployment has more than one replica configured"
      message: "Deployments should have more than one replica for high availability."
      resources:
        - "deployments"
      actions:
        - "create"
        - "update"
      parameters:
        replicas: ">1"

```

```Kubernetes
apiVersion: datree.io/v1
kind: Policy
metadata:
  name: ensure-owner-label
spec:
  rules:
    - name: "Ensure workload has a configured `owner` label"
      message: "Workloads should have an `owner` label for accountability."
      resources:
        - "*"
      actions:
        - "create"
        - "update"
      parameters:
        labels:
          owner: "*"

```

```Kubernetes
apiVersion: datree.io/v1
kind: Policy
metadata:
  name: ensure-valid-restart-policy
spec:
  rules:
    - name: "Ensure deployment-like resource is using a valid restart policy"
      message: "Deployment-like resources should use a valid restart policy (e.g., Always, OnFailure, Never)."
      resources:
        - "deployments"
        - "statefulsets"
        - "daemonsets"
      actions:
        - "create"
        - "update"
      parameters:
        restartPolicy: ["Always", "OnFailure", "Never"]

```

```Kubernetes
apiVersion: datree.io/v1
kind: Policy
metadata:
  name: prevent-default-namespace
spec:
  rules:
    - name: "Prevent workload from using the default namespace"
      message: "Workloads should not be deployed in the 'default' namespace for better organization and security."
      resources:
        - "*"
      actions:
        - "create"
        - "update"
      parameters:
        namespace: "!default"

```

--------------------------------

### Datree CLI Kustomize Test Command

Source: https://hub.datree.io/integrations/kustomize-support

Scan Kustomize files and generated resources for misconfigurations using the Datree CLI. Supports custom Datree CLI arguments and Kustomize build arguments.

```bash
datree kustomize test [path] [cliArgs] -- [kustomizeArgs]
```

```bash
datree kustomize test /path/to/dir/
```

```bash
datree kustomize test /path/to/dir/ -s 1.23.0 -p staging
```

--------------------------------

### Datree CLI Rule Output Example

Source: https://hub.datree.io/built-in-rules/ensure-no-cpu-limit

This example shows the output from the Datree CLI when testing a Kubernetes YAML file that violates the 'Ensure each container fully utilizes CPU with no limitations' rule. It indicates the file, the rule that failed, the occurrence count, and a suggestion to refrain from setting a CPU limit.

```shell
$ datree test *.yaml

>> File: failExample.yaml
❌ Ensure each container fully utilizes CPU with no limitations [1 occurrence]
💡 Invalid key `limits.cpu` - refrain from setting a CPU limit to better utilize the CPU and prevent starvation
```

--------------------------------

### ArgoCD Integration and Rollout Best Practices

Source: https://hub.datree.io/dashboard/activity-log

These rules focus on best practices for integrating with ArgoCD and configuring Rollouts, including namespace association, ConfigMap recognition, and revision history management.

```Kubernetes
☑️ Ensure Application and AppProject are part of the argocd namespace
☑️ Ensure ConfigMap is recognized by ArgoCD
☑️ Ensure Rollout allows broadcasting IP table changes
☑️ Ensure Rollout has revision history set
☑️ Ensure Rollout pause step has a configured duration
☑️ Ensure Rollout that is marked as degraded scales down ReplicaSet
```

--------------------------------

### Kubernetes Container Memory Limit Enforcement

Source: https://hub.datree.io/built-in-rules/ensure-memory-limit

This documentation explains how to ensure containers have memory limits configured in Kubernetes. It shows a failing example where memory limits are missing and provides a corrected example with memory limits specified. It also includes CLI output demonstrating how the rule failure is reported.

```yaml
spec:
  containers:
  - name: app
    image: nginx:1.19.8

```

```bash
$ datree test *.yaml

>> File: failExample.yaml
❌ Ensure each container has a configured memory limit [1 occurrence]
💡 Missing property object `limits.memory` - value should be within the accepted boundaries recommended by the organization

```

```yaml
spec:
  containers:
  - name: app
    image: nginx:1.19.8
    resources:
      limits:
        memory: "128Mi"

```

--------------------------------

### Rule output in CLI

Source: https://hub.datree.io/built-in-rules/prevent-accessing-host-files-by-using-high-gids

Example of the rule's output when a violation is detected in the CLI.

```cli
$ datree test *.yaml

>> File: failExample.yaml
❌ Prevent containers from accessing host files by using high GIDs [1 occurrence]
💡 Invalid value for key `runAsGroup` - must be greater than 999 to ensure container is running with non-root group membership
```

--------------------------------

### ArgoCD Rollout Best Practices

Source: https://hub.datree.io/integrations

This set of rules addresses best practices for ArgoCD Rollouts, focusing on ensuring robust deployment strategies, proper revision management, and secure handling of deployment steps.

```APIDOC
Ensure Rollout allows broadcasting IP table changes:
  Description: Verifies that Rollouts are configured to allow broadcasting IP table changes, which can be important for network-aware deployments.

Ensure Rollout has revision history set:
  Description: Enforces that Rollouts have revision history configured, enabling effective rollback capabilities.

Ensure Rollout pause step has a configured duration:
  Description: Requires that any pause steps within a Rollout strategy have a defined duration, preventing indefinite pauses.

Ensure Rollout that is marked as degraded scales down ReplicaSet:
  Description: Ensures that a degraded Rollout automatically scales down its associated ReplicaSet, mitigating the impact of faulty deployments.
```

--------------------------------

### Install Datree using Argo CD UI (Application YAML)

Source: https://hub.datree.io/index

Defines an Argo CD Application resource in YAML format for deploying Datree. This includes source repository, chart details, destination namespace, and Helm parameters for token and cluster name.

```yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
name: datree
spec:
destination:
name:''
namespace: datree
server:'https://kubernetes.default.svc'
source:
path:''
repoURL:'https://datreeio.github.io/admission-webhook-datree'
targetRevision: 0.3.83
chart: datree-admission-webhook
helm:
parameters:
-name: datree.token
value: <DATREE_TOKEN>
-name: datree.clusterName
value: <CLUSTER_NAME>
sources:[]
project: default
syncPolicy:
syncOptions:
- CreateNamespace=true
```

--------------------------------

### Datree CLI Version Check

Source: https://hub.datree.io/cli/cli-arguments

Prints the current version of the Datree CLI installed on the system.

```bash
datree version
```

--------------------------------

### ArgoCD and Workflow Configuration

Source: https://hub.datree.io/built-in-rules/prevent-access-to-secrets

Rules related to ArgoCD integration and workflow management, ensuring proper setup and behavior.

```yaml
apiVersion: datree.io/v1alpha1
kind: Policy
metadata:
  name: ensure-application-and-appproject-are-part-of-the-argocd-namespace
spec:
  rules:
    - name: "Ensure Application and AppProject are part of the argocd namespace"
      message: "Application and AppProject resources must be part of the argocd namespace."
      policy: "ensure-application-and-appproject-are-part-of-the-argocd-namespace"
--- 
apiVersion: datree.io/v1alpha1
kind: Policy
metadata:
  name: ensure-configmap-is-recognized-by-argocd
spec:
  rules:
    - name: "Ensure ConfigMap is recognized by ArgoCD"
      message: "ConfigMaps must be recognized by ArgoCD."
      policy: "ensure-configmap-is-recognized-by-argocd"
--- 
apiVersion: datree.io/v1alpha1
kind: Policy
metadata:
  name: ensure-rollout-allows-broadcasting-ip-table-changes
spec:
  rules:
    - name: "Ensure Rollout allows broadcasting IP table changes"
      message: "Rollouts should allow broadcasting IP table changes."
      policy: "ensure-rollout-allows-broadcasting-ip-table-changes"
--- 
apiVersion: datree.io/v1alpha1
kind: Policy
metadata:
  name: ensure-rollout-has-revision-history-set
spec:
  rules:
    - name: "Ensure Rollout has revision history set"
      message: "Rollouts must have revision history configured."
      policy: "ensure-rollout-has-revision-history-set"
--- 
apiVersion: datree.io/v1alpha1
kind: Policy
metadata:
  name: ensure-rollout-pause-step-has-a-configured-duration
spec:
  rules:
    - name: "Ensure Rollout pause step has a configured duration"
      message: "The pause step in a Rollout must have a configured duration."
      policy: "ensure-rollout-pause-step-has-a-configured-duration"
--- 
apiVersion: datree.io/v1alpha1
kind: Policy
metadata:
  name: ensure-rollout-that-is-marked-as-degraded-scales-down-replicaset
spec:
  rules:
    - name: "Ensure Rollout that is marked as degraded scales down ReplicaSet"
      message: "Degraded Rollouts must scale down their ReplicaSets."
      policy: "ensure-rollout-that-is-marked-as-degraded-scales-down-replicaset"
--- 
apiVersion: datree.io/v1alpha1
kind: Policy
metadata:
  name: ensure-workflow-dag-fail-fast-on-node-failure
spec:
  rules:
    - name: "Ensure Workflow DAG fail-fast on node failure"
      message: "Workflow DAGs should fail fast on node failure."
      policy: "ensure-workflow-dag-fail-fast-on-node-failure"
--- 
apiVersion: datree.io/v1alpha1
kind: Policy
metadata:
  name: ensure-workflow-retry-policy-catches-relevant-errors-only
spec:
  rules:
    - name: "Ensure Workflow retry policy catches relevant errors only"
      message: "Workflow retry policies should only catch relevant errors."
      policy: "ensure-workflow-retry-policy-catches-relevant-errors-only"
```
Tokens:
Raw