Create a sandbox ns & enforce rbac for gitlab-runner

defenseunicorns / uds-package-software-factory

Replaced by https://github.com/defenseunicorns/uds-software-factory

Apache License 2.0

8 stars 2 forks source link

Closed Michael-Kruggel closed 11 months ago

Michael-Kruggel commented 11 months ago

Made a sandbox namespace for the gitlab-runner job pods to use that isn't restricted by zarf
Added some RBAC to gitlab-runner to restrict some of its capabilities

Michael-Kruggel commented 11 months ago

/test all :robot: View pipeline run

Michael-Kruggel commented 11 months ago

/test all :robot: View pipeline run

anthonywendt commented 11 months ago

/test all :robot: View pipeline run

bburky commented 11 months ago

A ClusterRole with permissions on Pods and Secrets is still extremely permissive. What is the intent of this sandbox?