Datree supports writing custom rules in the CEL language, by utilizing a custom JSON Schema keyword.
Writing custom rules in CEL is supported in CLI version 1.9.19 and above.
In addition to the basic required format, a CEL custom rule has the following requirements:
schemaproperty must have a property named
CELDefinition, which is an array of items.
- Each item must have a property named
expressionthat contains the logic of the rule written in CEL. Within the expression, use
objectto reference the resource being evaluated (see example below).
- Each item may have a property named
message, which specifies what print when the expression is violated.
Ensure the validity of your CEL expressions by testing them against resources using an online CEL playground.
The following schema requires that resources of kind
ServiceAccount have the
automountServiceAccountToken property set to
- expression: "object.kind != 'ServiceAccount' || (has(object.automountServiceAccountToken) && object.automountServiceAccountToken == false)"
message: "ServiceAccounts must have automountServiceAccountToken set to false" # `message` is optional
In the above example, the constraint
object.kind != 'ServiceAccount' is a part of the CEL logic.
You can also write such a constraint in JSON schema and write the rest of the logic using CEL:
# Constraint - enforce rule only on `ServiceAccount` resources
- expression: "has(object.automountServiceAccountToken) && object.automountServiceAccountToken == false"