Problem description (if applicable)
In order to protect the environment, pre-determined calico policies will need to be in place, as desired. For any un-planned/un-tested/accidental policy changes locally, could lead to potential disruption in the environment, leading to service-denial or intrusions.
Proposed change
Develop a tool, that could validate/compare local user input (policies) with the deployment repository. This tool can be called when applying the calico policies via airshipctl (with calicoctl image integrated). Creating a daemon process that would run this tool frequently and logs warning/alerts is valuable. Although, network connectivity constraints to reach 'deployment repository' will need to be considered for this effort.
Potential impacts
Unintended accidental policy updates/changes could cause environment unusable.
Problem description (if applicable) In order to protect the environment, pre-determined calico policies will need to be in place, as desired. For any un-planned/un-tested/accidental policy changes locally, could lead to potential disruption in the environment, leading to service-denial or intrusions.
Proposed change Develop a tool, that could validate/compare local user input (policies) with the deployment repository. This tool can be called when applying the calico policies via airshipctl (with calicoctl image integrated). Creating a daemon process that would run this tool frequently and logs warning/alerts is valuable. Although, network connectivity constraints to reach 'deployment repository' will need to be considered for this effort.
Potential impacts Unintended accidental policy updates/changes could cause environment unusable.