Initial work

[v-ctiutiu]

Overview

Changes made in this PR:

• [x] Initial documentation about how to deploy and test the operator.
• [x] Main logic (implemented using Python) to add/change/remove static routes.
• [x] Sample manifests for testing.

[guardrails[bot]]

:warning: We detected 3 security issues in this pull request:

Insecure Configuration (1)

Docs | Details ----- | -------- [:bulb:](https://docs.guardrails.io/docs/en/vulnerabilities/kubernetes/insecure_configuration.html?utm_source=ghpr#) | Title: **hostNetwork is exposed**, Severity: Medium
https://github.com/digitalocean/k8s-staticroute-operator/blob/7408a886710c36392bd5346b38158c19850a40b9/operator/operator-daemonset.yaml#L15 More info on how to fix Insecure Configuration in [Kubernetes](https://docs.guardrails.io/docs/en/vulnerabilities/kubernetes/insecure_configuration.html?utm_source=ghpr#). ---

Insecure Access Control (2)

Docs | Details ----- | -------- [:bulb:](https://docs.guardrails.io/docs/en/vulnerabilities/kubernetes/insecure_access_control.html?utm_source=ghpr#) | Title: **DROP All Capabilities**, Severity: Low
File: [operator/operator-daemonset.yaml](https://github.com/digitalocean/k8s-staticroute-operator/blob/7408a886710c36392bd5346b38158c19850a40b9/operator/operator-daemonset.yaml) [:bulb:](https://docs.guardrails.io/docs/vulnerabilities/kubernetes/insecure_access_control?utm_source=ghpr#containers-with-added-capabilities) | Title: **Containers With Added Capabilities**, Severity: Medium
https://github.com/digitalocean/k8s-staticroute-operator/blob/7408a886710c36392bd5346b38158c19850a40b9/operator/operator-daemonset.yaml#L26 More info on how to fix Insecure Access Control in [Kubernetes](https://docs.guardrails.io/docs/en/vulnerabilities/kubernetes/insecure_access_control.html?utm_source=ghpr#).

---

👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

[bikram20]

@v-ctiutiu Nice work! Does the operator need hostNetwork: true?

[v-ctiutiu]

@v-ctiutiu Nice work! Does the operator need hostNetwork: true?

Yes, it doesn't work without that setting. The reason is that it needs access to host network to alter static routes. The operator runs in a Docker container after all, hence it runs in an isolated network from the main host.

Hope it makes sense. Thanks.

[bikram20]

Got it. Thanks.