Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add CEL code for PSP Policies in library #541

Closed
5 of 21 tasks
JaydipGabani opened this issue Jun 3, 2024 · 0 comments · Fixed by #535, #540, #503, #542 or #543
Closed
5 of 21 tasks

Add CEL code for PSP Policies in library #541

JaydipGabani opened this issue Jun 3, 2024 · 0 comments · Fixed by #535, #540, #503, #542 or #543
Assignees

Comments

@JaydipGabani
Copy link
Contributor

JaydipGabani commented Jun 3, 2024

To-Do list for each policy:

  • Add src.cel file for the policy under src/pod-security-policy/<name>/

  • Modify constraint.tmpl to add CEL engine and move rego under rego engine

  targets:
    - target: admission.k8s.gatekeeper.sh
      code: 
      - engine: K8sNativeValidation
        source:
{{ file.Read "src/pod-security-policy/<name>/src.cel" | strings.Indent 10 | strings.TrimSuffix "\n" }}
      - engine: Rego
        source:
          rego: |
{{ file.Read "src/pod-security-policy/<name>/src.rego" | strings.Indent 12 | strings.TrimSuffix "\n" }}
          libs:
            - |
{{ file.Read "src/pod-security-policy/<name>/lib_exempt_container.rego" | strings.Indent 14 | strings.TrimSuffix "\n" }}
  • Bump minor version on constraint.tmpl by updating metadata.gatekeeper.sh/version annotation.
  • Run make generate-all to generate all relavent files
  • Run make verify-gator-dockerized POLICY_ENGINE=cel && make verify-gator-dockerized POLICY_ENGINE=rego to test changes in local

PSP Policies list to track migration

  • validation/allow-privilege-escalation
  • validation/apparmor
  • validation/capabilities
  • validation/flexvolume-drivers
  • validation/forbidden-sysctls
  • validation/fsgroup
  • validation/host-filesystem
  • validation/host-namespaces
  • validation/host-network-ports
  • validation/privileged-containers
  • validation/proc-mount
  • validation/read-only-root-filesystem
  • validation/seccomp
  • validation/selinux
  • validation/users
  • validation/volumes
JaydipGabani added a commit to JaydipGabani/gatekeeper-library that referenced this issue Jun 3, 2024
@JaydipGabani JaydipGabani reopened this Jun 5, 2024
JaydipGabani added a commit that referenced this issue Jun 5, 2024
@JaydipGabani JaydipGabani reopened this Jun 5, 2024
@sozercan sozercan reopened this Aug 13, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment