Kubernetes Manifest Validator

{
  "hookConfig": {
    "hooks": {
      "postToolUse": {
        "script": "./.claude/hooks/kubernetes-manifest-validator.sh",
        "matchers": [
          "write",
          "edit"
        ]
      }
    }
  },
  "scriptContent": "#!/usr/bin/env bash\n\n# Read the tool input from stdin\nINPUT=$(cat)\nTOOL_NAME=$(echo \"$INPUT\" | jq -r '.tool_name')\nFILE_PATH=$(echo \"$INPUT\" | jq -r '.tool_input.file_path // .tool_input.path // \"\"')\n\nif [ -z \"$FILE_PATH\" ]; then\n  exit 0\nfi\n\n# Check if this is a YAML file that might be a Kubernetes manifest\nif [[ \"$FILE_PATH\" == *.yaml ]] || [[ \"$FILE_PATH\" == *.yml ]]; then\n  # Check if it's a Kubernetes manifest by looking for apiVersion and kind\n  if grep -q 'apiVersion:\\|kind:' \"$FILE_PATH\" 2>/dev/null; then\n    echo \"☸️ Kubernetes Manifest Validation for: $(basename \"$FILE_PATH\")\" >&2\n    \n    # Initialize validation counters\n    ERRORS=0\n    WARNINGS=0\n    VALIDATIONS_PASSED=0\n    KUBECTL_AVAILABLE=false\n    \n    # Function to report validation results\n    report_validation() {\n      local level=\"$1\"\n      local message=\"$2\"\n      \n      case \"$level\" in\n        \"ERROR\")\n          echo \"❌ ERROR: $message\" >&2\n          ERRORS=$((ERRORS + 1))\n          ;;\n        \"WARNING\")\n          echo \"⚠️ WARNING: $message\" >&2\n          WARNINGS=$((WARNINGS + 1))\n          ;;\n        \"PASS\")\n          echo \"✅ PASS: $message\" >&2\n          VALIDATIONS_PASSED=$((VALIDATIONS_PASSED + 1))\n          ;;\n        \"INFO\")\n          echo \"ℹ️ INFO: $message\" >&2\n          ;;\n      esac\n    }\n    \n    # Check if file exists and is readable\n    if [ ! -f \"$FILE_PATH\" ]; then\n      report_validation \"ERROR\" \"Manifest file not found: $FILE_PATH\"\n      exit 1\n    fi\n    \n    if [ ! -r \"$FILE_PATH\" ]; then\n      report_validation \"ERROR\" \"Manifest file is not readable: $FILE_PATH\"\n      exit 1\n    fi\n    \n    # Get file information\n    FILE_NAME=\"$(basename \"$FILE_PATH\")\"\n    FILE_SIZE=$(wc -c < \"$FILE_PATH\" 2>/dev/null || echo \"0\")\n    \n    echo \"📊 Kubernetes manifest: $FILE_NAME ($(( FILE_SIZE / 1024 ))KB)\" >&2\n    \n    # 1. Basic YAML Syntax Validation\n    echo \"📋 Checking YAML syntax...\" >&2\n    \n    # Use Python YAML parser for syntax validation\n    if command -v python3 &> /dev/null; then\n      if python3 -c \"import yaml; yaml.safe_load_all(open('$FILE_PATH'))\" 2>/dev/null; then\n        report_validation \"PASS\" \"Valid YAML syntax\"\n      else\n        report_validation \"ERROR\" \"Invalid YAML syntax detected\"\n        python3 -c \"import yaml; yaml.safe_load_all(open('$FILE_PATH'))\" 2>&1 | head -3 >&2\n        exit 1\n      fi\n    else\n      report_validation \"WARNING\" \"Python not available for YAML validation\"\n    fi\n    \n    # 2. Kubernetes Manifest Structure Analysis\n    echo \"🔍 Analyzing Kubernetes manifest structure...\" >&2\n    \n    # Extract resource information\n    API_VERSION=$(grep '^apiVersion:' \"$FILE_PATH\" | head -1 | cut -d':' -f2 | xargs 2>/dev/null || echo \"unknown\")\n    KIND=$(grep '^kind:' \"$FILE_PATH\" | head -1 | cut -d':' -f2 | xargs 2>/dev/null || echo \"unknown\")\n    RESOURCE_NAME=$(grep 'name:' \"$FILE_PATH\" | head -1 | cut -d':' -f2 | xargs 2>/dev/null || echo \"unnamed\")\n    NAMESPACE=$(grep 'namespace:' \"$FILE_PATH\" | head -1 | cut -d':' -f2 | xargs 2>/dev/null || echo \"default\")\n    \n    echo \"   📊 Resource: $KIND/$RESOURCE_NAME\" >&2\n    echo \"   🔧 API Version: $API_VERSION\" >&2\n    echo \"   📁 Namespace: $NAMESPACE\" >&2\n    \n    # Check for multiple resources in single file\n    RESOURCE_COUNT=$(grep -c '^apiVersion:' \"$FILE_PATH\" 2>/dev/null || echo \"1\")\n    if [ \"$RESOURCE_COUNT\" -gt 1 ]; then\n      echo \"   📋 Multi-resource file: $RESOURCE_COUNT resources\" >&2\n    fi\n    \n    # 3. kubectl Validation (if available)\n    echo \"☸️ Running kubectl validation...\" >&2\n    \n    if command -v kubectl &> /dev/null; then\n      KUBECTL_AVAILABLE=true\n      echo \"   🔧 kubectl found - running dry-run validation\" >&2\n      \n      # Check kubectl connection (but don't fail if no cluster)\n      KUBECTL_OUTPUT_FILE=\"/tmp/kubectl_output_$$\"\n      if kubectl apply --dry-run=client -f \"$FILE_PATH\" > \"$KUBECTL_OUTPUT_FILE\" 2>&1; then\n        report_validation \"PASS\" \"kubectl dry-run validation successful\"\n        \n        # Show what would be created/updated\n        grep -E 'created|configured|unchanged' \"$KUBECTL_OUTPUT_FILE\" 2>/dev/null | head -3 | while read line; do\n          echo \"     $line\" >&2\n        done\n        \n      else\n        # Check if it's a connection error or manifest error\n        if grep -q 'connection refused\\|unable to connect' \"$KUBECTL_OUTPUT_FILE\" 2>/dev/null; then\n          report_validation \"WARNING\" \"kubectl validation skipped - no cluster connection\"\n        else\n          report_validation \"ERROR\" \"kubectl dry-run validation failed\"\n          echo \"   📝 kubectl error details:\" >&2\n          head -5 \"$KUBECTL_OUTPUT_FILE\" | while read line; do\n            echo \"     $line\" >&2\n          done\n        fi\n      fi\n      \n      rm -f \"$KUBECTL_OUTPUT_FILE\"\n    else\n      report_validation \"WARNING\" \"kubectl not available - install for comprehensive validation\"\n    fi\n    \n    # 4. Additional Validation Tools\n    echo \"🔍 Running additional validation tools...\" >&2\n    \n    # kubeval validation\n    if command -v kubeval &> /dev/null; then\n      echo \"   🔍 Running kubeval validation...\" >&2\n      \n      KUBEVAL_OUTPUT_FILE=\"/tmp/kubeval_output_$$\"\n      if kubeval \"$FILE_PATH\" > \"$KUBEVAL_OUTPUT_FILE\" 2>&1; then\n        report_validation \"PASS\" \"kubeval validation successful\"\n      else\n        report_validation \"WARNING\" \"kubeval found issues\"\n        head -5 \"$KUBEVAL_OUTPUT_FILE\" | while read line; do\n          echo \"     $line\" >&2\n        done\n      fi\n      rm -f \"$KUBEVAL_OUTPUT_FILE\"\n    else\n      echo \"   💡 kubeval not installed - consider installing for schema validation\" >&2\n    fi\n    \n    # kube-score validation (best practices)\n    if command -v kube-score &> /dev/null; then\n      echo \"   📊 Running kube-score best practices check...\" >&2\n      \n      KUBESCORE_OUTPUT_FILE=\"/tmp/kubescore_output_$$\"\n      if kube-score score \"$FILE_PATH\" > \"$KUBESCORE_OUTPUT_FILE\" 2>&1; then\n        # kube-score shows recommendations, not just pass/fail\n        CRITICAL_COUNT=$(grep -c 'CRITICAL' \"$KUBESCORE_OUTPUT_FILE\" 2>/dev/null || echo \"0\")\n        WARNING_COUNT=$(grep -c 'WARNING' \"$KUBESCORE_OUTPUT_FILE\" 2>/dev/null || echo \"0\")\n        \n        if [ \"$CRITICAL_COUNT\" -eq 0 ]; then\n          report_validation \"PASS\" \"kube-score validation passed (no critical issues)\"\n        else\n          report_validation \"WARNING\" \"kube-score found $CRITICAL_COUNT critical issues\"\n        fi\n        \n        if [ \"$WARNING_COUNT\" -gt 0 ]; then\n          echo \"   ⚠️ kube-score warnings: $WARNING_COUNT\" >&2\n        fi\n      fi\n      rm -f \"$KUBESCORE_OUTPUT_FILE\"\n    else\n      echo \"   💡 kube-score not installed - consider installing for best practices validation\" >&2\n    fi\n    \n    # 5. Resource-Specific Validation\n    echo \"🔧 Performing resource-specific validation...\" >&2\n    \n    case \"$KIND\" in\n      \"Deployment\")\n        echo \"   🚀 Deployment-specific checks...\" >&2\n        \n        # Check for resource limits\n        if grep -q 'resources:' \"$FILE_PATH\" 2>/dev/null; then\n          if grep -q 'limits:\\|requests:' \"$FILE_PATH\" 2>/dev/null; then\n            report_validation \"PASS\" \"Resource limits/requests defined\"\n          else\n            report_validation \"WARNING\" \"Resource limits/requests not fully specified\"\n          fi\n        else\n          report_validation \"WARNING\" \"No resource limits defined - consider adding for production\"\n        fi\n        \n        # Check for replicas\n        REPLICAS=$(grep 'replicas:' \"$FILE_PATH\" | head -1 | cut -d':' -f2 | xargs 2>/dev/null || echo \"1\")\n        if [ \"$REPLICAS\" -eq 1 ]; then\n          report_validation \"WARNING\" \"Single replica deployment - consider multiple replicas for HA\"\n        else\n          echo \"   📊 Replicas: $REPLICAS\" >&2\n        fi\n        \n        # Check for readiness/liveness probes\n        if grep -q 'livenessProbe:\\|readinessProbe:' \"$FILE_PATH\" 2>/dev/null; then\n          report_validation \"PASS\" \"Health probes configured\"\n        else\n          report_validation \"WARNING\" \"No health probes defined - consider adding for reliability\"\n        fi\n        ;;\n        \n      \"Service\")\n        echo \"   🌐 Service-specific checks...\" >&2\n        \n        # Check service type\n        SERVICE_TYPE=$(grep 'type:' \"$FILE_PATH\" | head -1 | cut -d':' -f2 | xargs 2>/dev/null || echo \"ClusterIP\")\n        echo \"   🔧 Service type: $SERVICE_TYPE\" >&2\n        \n        if [ \"$SERVICE_TYPE\" = \"LoadBalancer\" ]; then\n          report_validation \"WARNING\" \"LoadBalancer service - ensure cloud provider support\"\n        fi\n        \n        # Check for selector\n        if grep -q 'selector:' \"$FILE_PATH\" 2>/dev/null; then\n          report_validation \"PASS\" \"Service selector defined\"\n        else\n          report_validation \"ERROR\" \"Service missing selector - will not route traffic\"\n        fi\n        ;;\n        \n      \"ConfigMap\"|\"Secret\")\n        echo \"   🔐 Configuration resource checks...\" >&2\n        \n        # Check for data section\n        if grep -q 'data:' \"$FILE_PATH\" 2>/dev/null; then\n          DATA_KEYS=$(grep -A 10 'data:' \"$FILE_PATH\" | grep -c '^  [^:]*:' || echo \"0\")\n          echo \"   📊 Data keys: $DATA_KEYS\" >&2\n          report_validation \"PASS\" \"Configuration data present\"\n        else\n          report_validation \"WARNING\" \"No data section found in $KIND\"\n        fi\n        ;;\n        \n      \"Ingress\")\n        echo \"   🌍 Ingress-specific checks...\" >&2\n        \n        # Check for rules\n        if grep -q 'rules:' \"$FILE_PATH\" 2>/dev/null; then\n          report_validation \"PASS\" \"Ingress rules defined\"\n        else\n          report_validation \"ERROR\" \"Ingress missing rules section\"\n        fi\n        \n        # Check for TLS\n        if grep -q 'tls:' \"$FILE_PATH\" 2>/dev/null; then\n          report_validation \"PASS\" \"TLS configuration present\"\n        else\n          report_validation \"WARNING\" \"No TLS configuration - consider HTTPS\"\n        fi\n        ;;\n    esac\n    \n    # 6. Security and Best Practices\n    echo \"🔒 Security and best practices check...\" >&2\n    \n    # Check for security context\n    if grep -q 'securityContext:' \"$FILE_PATH\" 2>/dev/null; then\n      report_validation \"PASS\" \"Security context defined\"\n      \n      # Check for non-root user\n      if grep -q 'runAsNonRoot: true\\|runAsUser:' \"$FILE_PATH\" 2>/dev/null; then\n        report_validation \"PASS\" \"Non-root security configuration\"\n      else\n        report_validation \"WARNING\" \"Consider running as non-root user\"\n      fi\n    else\n      report_validation \"WARNING\" \"No security context defined - consider adding for security\"\n    fi\n    \n    # Check for privileged containers\n    if grep -q 'privileged: true' \"$FILE_PATH\" 2>/dev/null; then\n      report_validation \"WARNING\" \"Privileged container detected - security risk\"\n    fi\n    \n    # Check for host network/PID\n    if grep -q 'hostNetwork: true\\|hostPID: true' \"$FILE_PATH\" 2>/dev/null; then\n      report_validation \"WARNING\" \"Host network/PID access detected - security risk\"\n    fi\n    \n    # Check for latest tag usage\n    if grep -q 'image:.*:latest' \"$FILE_PATH\" 2>/dev/null; then\n      report_validation \"WARNING\" \"Using 'latest' tag - consider specific version tags\"\n    fi\n    \n    # 7. Generate Validation Summary\n    echo \"\" >&2\n    echo \"📋 Kubernetes Manifest Validation Summary:\" >&2\n    echo \"==========================================\" >&2\n    echo \"   📄 File: $FILE_NAME\" >&2\n    echo \"   ☸️ Resource: $KIND/$RESOURCE_NAME\" >&2\n    echo \"   🔧 API Version: $API_VERSION\" >&2\n    echo \"   📁 Namespace: $NAMESPACE\" >&2\n    echo \"   ✅ Validations passed: $VALIDATIONS_PASSED\" >&2\n    echo \"   ⚠️ Warnings: $WARNINGS\" >&2\n    echo \"   ❌ Errors: $ERRORS\" >&2\n    \n    if [ \"$ERRORS\" -eq 0 ]; then\n      if [ \"$WARNINGS\" -eq 0 ]; then\n        echo \"   🎉 Status: EXCELLENT - Manifest is valid and follows best practices\" >&2\n      else\n        echo \"   ✅ Status: GOOD - Manifest is valid with minor recommendations\" >&2\n      fi\n    else\n      echo \"   ❌ Status: ERRORS - Manifest has critical issues that must be fixed\" >&2\n    fi\n    \n    echo \"\" >&2\n    echo \"💡 Kubernetes Best Practices:\" >&2\n    echo \"   • Use specific image tags instead of 'latest'\" >&2\n    echo \"   • Define resource limits and requests\" >&2\n    echo \"   • Configure health probes for applications\" >&2\n    echo \"   • Use security contexts and non-root users\" >&2\n    echo \"   • Implement RBAC for access control\" >&2\n    echo \"   • Use multiple replicas for high availability\" >&2\n    \n    # Exit with error if there are critical validation issues\n    if [ \"$ERRORS\" -gt 0 ]; then\n      echo \"⚠️ Kubernetes manifest validation completed with errors\" >&2\n      exit 1\n    fi\n    \n  else\n    # YAML file but not a Kubernetes manifest\n    exit 0\n  fi\nelse\n  # Not a YAML file\n  exit 0\nfi\n\nexit 0"
}