otty / apps

All apps/Datree

Datree

datree

Prevent Kubernetes misconfigurations from reaching production.

Runs as datree|macOS, Linux, Windows|hub.datree.io

Open form in Otty otty.toml

Sync rules

What travels, what stays, what never leaves

Datree in your home directory Every rule on this page, by file

token

Lifted into your secret store; the rest of the file syncs.

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/datree/otty.tomlThe file this page is generated from

id = "datree"

name = "Datree"

homepage = "https://hub.datree.io"

description = "Prevent Kubernetes misconfigurations from reaching production."

# Datree's square logo mark, from its own repository.

icon = "https://raw.githubusercontent.com/datreeio/datree/main/images/datree-logo.svg"

executables = ["datree"]

[dotfiles]

# https://hub.datree.io/cli/cli-arguments — "after running your first policy

# check, a default config file will be created (defaults to

# $HOME/.datree/config.yaml)", holding client_id, offline and token, and

# `datree config set` rewrites it. The GitHub repository was archived in June

# 2024; the CLI still runs in offline mode and still keeps this file.

paths = ["~/.datree/config.yaml"]

exclude = []

# Not a whole-file secret: `offline` is a preference worth carrying, and

# client_id names the account rather than authenticating it.

secret = []

# Read once per policy check by a process that then exits.

side_effect = false

# token is the credential that links this CLI to the Datree dashboard; the

# docs tell users to read their token out of this field.

[[dotfiles.secret_paths]]

file = "~/.datree/config.yaml"

match = { key_path = ["token"] }

[commands]

format = 1

label = "Datree policy check"

description = "Run datree test against Kubernetes manifests or Helm output. Other subcommands are left out."

quality = "ai-draft"

base = "fig:datree"

parser = { end_of_options = "--", interleave = "permute", long_equals = true, short_attached = true, short_bundles = false }

[[commands.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/datree.ts"

license = "MIT"

[[commands.subcommand]]

path = ["test"]

label = "Check manifests"

description = "Runs policy checks on one or more manifest paths or globs."

[[commands.subcommand.source]]

id = "fig"

kind = "completion"

url = "https://github.com/withfig/autocomplete/blob/master/src/datree.ts"

license = "MIT"

[[commands.subcommand.field]]

id = "files"

label = "Manifest files or globs"

type = "path"

position = 0

multiple = true

path = { kind = "any", role = "input" }

sources = ["fig"]

[[commands.subcommand.field]]

id = "policy"

label = "Policy name"

type = "string"

option = ["--policy", "-p"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "output"

label = "Output format"

type = "string"

option = ["--output", "-o"]

suggestions = [{ value = "simple", label = "simple" }, { value = "yaml", label = "yaml" }, { value = "json", label = "json" }, { value = "xml", label = "xml" }, { value = "junit", label = "junit" }]

sources = ["fig"]

[[commands.subcommand.field]]

id = "schema_version"

label = "Kubernetes version"

type = "string"

option = ["--schema-version", "-s"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "ignore_missing_schemas"

label = "Ignore missing schemas"

type = "boolean"

option = ["--ignore-missing-schemas"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "only_k8s_files"

label = "Only Kubernetes YAML"

type = "boolean"

option = ["--only-k8s-files"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "no_record"

label = "Do not send metadata to backend"

type = "boolean"

option = ["--no-record"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "verbose"

label = "Show how-to-fix links"

type = "boolean"

option = ["--verbose"]

sources = ["fig"]

[[commands.subcommand.field]]

id = "policy_config"

label = "Local policy file"

type = "path"

option = ["--policy-config"]

path = { kind = "file", role = "input" }

sources = ["fig"]

[[commands.subcommand.task]]

id = "basic"

label = "Check manifests"

fields = ["files", "policy", "output"]

required = ["files"]

[[commands.subcommand.task]]

id = "offline"

label = "Check without reporting"

set = { no_record = [true] }

fields = ["files", "no_record", "ignore_missing_schemas"]

required = ["files"]

[[commands.subcommand.group]]

id = "basic"

label = "Basic"

fields = ["files", "policy", "output", "no_record"]

[[commands.subcommand.group]]

id = "advanced"

label = "Advanced"

fields = ["ignore_missing_schemas", "only_k8s_files", "verbose", "policy_config", "schema_version"]

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/datree. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these is generated from the same rules as this page.