kyverno-to-gatekeeper-translator
Translates Kyverno policies to OPA Gatekeeper ConstraintTemplates and Constraints with RHACM PolicyGenerator output.
소스 정보
- 저장소
- redhat-et/rhacm-gatekeeper-skills
- 최근 소스 활동
- 2026년 3월 30일 21:29
- 감지된 SKILL.md 언어
- 영어
- 스타
- 0
- 포크
- 0
설치 방법
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
소스 파일 검토
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
파일 탐색기
5 개 파일SKILL.md 표시 중
SKILL.md
소스 지침 · 읽기 전용 미리보기- name
- kyverno-to-gatekeeper-translator
- description
- Translates Kyverno policies to OPA Gatekeeper ConstraintTemplates and Constraints with RHACM PolicyGenerator output.
- allowed-tools
- ["Read","Write","Bash","AskUserQuestion","WebFetch"]
# Kyverno to Gatekeeper Translator
## Workflow
```
INPUT → Parse → Feasibility Check → Generate Rego → Validate → Output Files
```
### Step 1: Receive Policy
Accept via: paste YAML, file path, or URL (use WebFetch).
### Step 2: Check Feasibility
| Kyverno Type | Gatekeeper Support | Action |
|--------------|-------------------|--------|
| `validate.pattern` | Full | Translate |
| `validate.deny` | Full | Translate |
| `validate.foreach` | Full | Translate |
| `validate.anyPattern` | Full | Translate |
| `validate.cel` | Partial | Recommend VAP |
| `mutate.*` | Alpha | Keep Kyverno |
| `generate` | None | Cannot translate |
| `verifyImages` | None | Use Sigstore |
If unsupported features exist, inform user and ask to proceed with supported parts.
See: `references/KYVERNO_TO_GATEKEEPER_MAPPING.md` for translation patterns.
### Step 3: Generate & Validate Rego
```bash
mkdir -p /tmp/claude
# Write policy.rego and input.json
opa eval -d /tmp/claude/policy.rego -i /tmp/claude/input.json "data.{package}.violation" --format pretty
```
Fix errors and re-validate until passing. Show user the translated Rego.
### Step 4: Create Output
```bash
TRACE_ID=$(python3 skills/kyverno-to-gatekeeper-translator/scripts/get_trace_id.py 2>/dev/null || echo "no-trace")
OUTPUT_DIR="skills/kyverno-to-gatekeeper-translator/assets/${TRACE_ID}"
mkdir -p ${OUTPUT_DIR}/{constraint-templates,constraints,original-kyverno}
```
Generate files using templates from `references/TEMPLATES.md`:
- `original-kyverno/{name}.yaml`
- `constraint-templates/{name}-template.yaml`
- `constraints/{name}.yaml`
- `policyGenerator.yaml`
- `kustomization.yaml`
- `TRANSLATION_REPORT.md`
### Step 5: Summary
```
Output: skills/kyverno-to-gatekeeper-translator/assets/{TRACE_ID}/
Deploy directly:
kubectl apply -f constraint-templates/ && kubectl apply -f constraints/
Deploy via RHACM:
kustomize build --enable-alpha-plugins . | kubectl apply -n policies -f -
```
## Key Mappings
| Kyverno | Gatekeeper |
|---------|------------|
| `validationFailureAction: Audit` | `enforcementAction: dryrun` |
| `validationFailureAction: Enforce` | `enforcementAction: deny` |
| `{{request.object.*}}` | `input.review.object.*` |
| `exclude.namespaces` | `spec.match.excludedNamespaces` |
## References
- `references/KYVERNO_TO_GATEKEEPER_MAPPING.md` - Translation patterns & operators
- `references/TEMPLATES.md` - Output file templates
- `references/COMMON_POLICY_TRANSLATIONS.md` - Complete examples
GitHub에서 보기