Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add template for PolicyExceptions #1151

Closed
wants to merge 9 commits into from
Closed

add template for PolicyExceptions #1151

wants to merge 9 commits into from

Conversation

mcharriere
Copy link
Contributor

@mcharriere mcharriere commented Oct 24, 2023

What does this PR do?

Add policyexception templating command based on PolicyExceptionDraft

What is the effect of this change to users?

User is able to generate a PolicyException based on an existing PolicyExceptionDraft.

What does it look like?

Given the following PolicyExceptionDraft

$ k get policyexceptiondrafts.policy.giantswarm.io happa -n policy-exceptions -o yaml
apiVersion: policy.giantswarm.io/v1alpha1
kind: PolicyExceptionDraft
metadata:
  creationTimestamp: "2023-10-05T18:24:00Z"
  generation: 8
  labels:
    app.kubernetes.io/managed-by: exception-recommender
  name: happa
  namespace: policy-exceptions
  resourceVersion: "1346023412"
  uid: 0792f4ab-5333-4379-905c-f6bbdbade468
spec:
  policies:
  - require-run-as-nonroot
  - disallow-privilege-escalation
  - restrict-seccomp-strict
  - disallow-capabilities-strict
  targets:
  - kind: Deployment
    names:
    - happa*
    namespaces:
    - giantswarm

the new template command can generate:

$ kubectl gs template policyexception --draft happa 
apiVersion: policy.giantswarm.io/v1alpha1
kind: PolicyException
metadata:
  creationTimestamp: null
  name: happa
spec:
  policies:
  - require-run-as-nonroot
  - disallow-privilege-escalation
  - restrict-seccomp-strict
  - disallow-capabilities-strict
  targets:
  - kind: Deployment
    names:
    - happa*
    namespaces:
    - giantswarm

Any background context you can provide?

https://github.com/giantswarm/rfc/tree/main/policy-orchestration#policyexception

What is needed from the reviewers?

Do the docs need to be updated?

Should this change be mentioned in the release notes?

  • CHANGELOG.md has been updated

Is this a breaking change?

(Breaking changes are, for example, removal of commnds/flags or substantial changes in the meaning of a flag. If yes, please add the breaking-change label to the PR.)

@mcharriere mcharriere changed the title add template for PolicyException add template for PolicyExceptions Oct 24, 2023
@mcharriere mcharriere requested a review from a team November 1, 2023 09:17
@fhielpos fhielpos self-assigned this Nov 28, 2023
@fhielpos
Copy link
Member

I like this idea, will pick this up this week.

Signed-off-by: Matias Charriere <[email protected]>
Signed-off-by: Matias Charriere <[email protected]>
Signed-off-by: Matias Charriere <[email protected]>
Signed-off-by: Matias Charriere <[email protected]>
Signed-off-by: Matias Charriere <[email protected]>
Signed-off-by: Matias Charriere <[email protected]>
Signed-off-by: Matias Charriere <[email protected]>
Signed-off-by: Matias Charriere <[email protected]>
Signed-off-by: Matias Charriere <[email protected]>
@fhielpos
Copy link
Member

fhielpos commented Nov 4, 2024

We will move in a different direction with this, sorry

@fhielpos fhielpos closed this Nov 4, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants