kyverno-to-gatekeeper-translator
Translates Kyverno policies to OPA Gatekeeper ConstraintTemplates and Constraints with RHACM PolicyGenerator output.
معلومات المصدر
- المستودع
- redhat-et/rhacm-gatekeeper-skills
- آخر نشاط في المصدر
- ٣٠ مارس ٢٠٢٦ في ٢١:٢٩
- لغة SKILL.md المكتشفة
- الإنجليزية
- النجوم
- ٠
- التفرعات
- ٠
خيارات التثبيت
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
مراجعة ملفات المصدر
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
مستكشف الملفات
5 ملفاتعرض SKILL.md
SKILL.md
تعليمات المصدر · معاينة للقراءة فقط- name
- kyverno-to-gatekeeper-translator
- description
- Translates Kyverno policies to OPA Gatekeeper ConstraintTemplates and Constraints with RHACM PolicyGenerator output.
- allowed-tools
- ["Read","Write","Bash","AskUserQuestion","WebFetch"]
# Kyverno to Gatekeeper Translator
## Workflow
```
INPUT → Parse → Feasibility Check → Generate Rego → Validate → Output Files
```
### Step 1: Receive Policy
Accept via: paste YAML, file path, or URL (use WebFetch).
### Step 2: Check Feasibility
| Kyverno Type | Gatekeeper Support | Action |
|--------------|-------------------|--------|
| `validate.pattern` | Full | Translate |
| `validate.deny` | Full | Translate |
| `validate.foreach` | Full | Translate |
| `validate.anyPattern` | Full | Translate |
| `validate.cel` | Partial | Recommend VAP |
| `mutate.*` | Alpha | Keep Kyverno |
| `generate` | None | Cannot translate |
| `verifyImages` | None | Use Sigstore |
If unsupported features exist, inform user and ask to proceed with supported parts.
See: `references/KYVERNO_TO_GATEKEEPER_MAPPING.md` for translation patterns.
### Step 3: Generate & Validate Rego
```bash
mkdir -p /tmp/claude
# Write policy.rego and input.json
opa eval -d /tmp/claude/policy.rego -i /tmp/claude/input.json "data.{package}.violation" --format pretty
```
Fix errors and re-validate until passing. Show user the translated Rego.
### Step 4: Create Output
```bash
TRACE_ID=$(python3 skills/kyverno-to-gatekeeper-translator/scripts/get_trace_id.py 2>/dev/null || echo "no-trace")
OUTPUT_DIR="skills/kyverno-to-gatekeeper-translator/assets/${TRACE_ID}"
mkdir -p ${OUTPUT_DIR}/{constraint-templates,constraints,original-kyverno}
```
Generate files using templates from `references/TEMPLATES.md`:
- `original-kyverno/{name}.yaml`
- `constraint-templates/{name}-template.yaml`
- `constraints/{name}.yaml`
- `policyGenerator.yaml`
- `kustomization.yaml`
- `TRANSLATION_REPORT.md`
### Step 5: Summary
```
Output: skills/kyverno-to-gatekeeper-translator/assets/{TRACE_ID}/
Deploy directly:
kubectl apply -f constraint-templates/ && kubectl apply -f constraints/
Deploy via RHACM:
kustomize build --enable-alpha-plugins . | kubectl apply -n policies -f -
```
## Key Mappings
| Kyverno | Gatekeeper |
|---------|------------|
| `validationFailureAction: Audit` | `enforcementAction: dryrun` |
| `validationFailureAction: Enforce` | `enforcementAction: deny` |
| `{{request.object.*}}` | `input.review.object.*` |
| `exclude.namespaces` | `spec.match.excludedNamespaces` |
## References
- `references/KYVERNO_TO_GATEKEEPER_MAPPING.md` - Translation patterns & operators
- `references/TEMPLATES.md` - Output file templates
- `references/COMMON_POLICY_TRANSLATIONS.md` - Complete examples
عرض على GitHub