Agent skill
jmespath-for-kyverno
Master JMESPath for Kyverno policies. Query nested resources, build complex conditions, and validate Kubernetes workloads with production-tested patterns.
Install this agent skill to your Project
npx add-skill https://github.com/adaptive-enforcement-lab/claude-skills/tree/main/plugins/enforce/skills/jmespath-for-kyverno
SKILL.md
JMESPath for Kyverno
When to Use This Skill
Use JMESPath when:
- Pattern matching can't express your logic
- You need conditionals or transformations
- Validation depends on multiple fields
- You're filtering or comparing arrays
Skip JMESPath when:
- Simple pattern matching works (
pattern,anyPattern) - You're only checking field existence
- No cross-field validation needed
Test Before Deploying
Always test JMESPath expressions with
kyverno jpbefore adding them to policies. Syntax errors fail silently in audit mode and block resources in enforce mode.
Implementation
Install Kyverno CLI for testing:
# Install kyverno CLI
brew install kyverno/kyverno/kyverno
# Test JMESPath expression
kyverno jp query -i manifest.yaml 'spec.template.spec.containers[*].name'
Simple validation example:
See examples.md for detailed code examples.
What this does:
- Filters containers without memory limits:
containers[?!resources.limits.memory] - Extracts their names:
.name - Counts them:
| length(@) - Denies if count > 0
Examples
See examples.md for code examples.
References
Recommended Agent Skills
Expand your agent's capabilities with these related and highly-rated skills.
adaptive-enforcement-lab/claude-skills
github-token-permissions-overview
Understanding GITHUB_TOKEN scope, default permissions, and implementing least-privilege principle for GitHub Actions workflows.
adaptive-enforcement-lab/claude-skills
secure
Find and fix security issues before they become incidents. Vulnerability scanning, SBOM generation, supply chain security, and secure authentication workflows.
adaptive-enforcement-lab/claude-skills
complete-workflow-examples
Copy-paste hardened CI/CD workflows with SHA-pinned actions, minimal GITHUB_TOKEN permissions, OIDC authentication, and comprehensive security scanning for GitHub Actions.
adaptive-enforcement-lab/claude-skills
ephemeral-runner-patterns
Disposable runner patterns for GitHub Actions. Container-based, VM-based, and ARC deployment strategies with complete state isolation between jobs.
adaptive-enforcement-lab/claude-skills
action-pinning-overview
Why pinning GitHub Actions to SHA-256 commits matters for supply chain security. Attack vectors from unpinned actions and comparison of tag vs SHA pinning.
adaptive-enforcement-lab/claude-skills
github-actions-security-patterns-hub
Complete security patterns for GitHub Actions covering action pinning, GITHUB_TOKEN permissions, third-party action risks, secret management, and runner security.
Didn't find tool you were looking for?