search

iann0036 / iamlive

Generate an IAM policy from AWS, Azure, or Google Cloud (GCP) calls using client-side monitoring (CSM) or embedded proxy
MIT License
3.12k stars 107 forks source link

Contributing a guide for deploying iamlive on Kubernetes? #76

Open orishoshan opened 9 months ago

orishoshan commented 9 months ago

Hi!

First, a shout-out for building a great tool. We've been working at Otterize to make workload IAM of various kinds (not just AWS/GCP/Azure, but also IAM like network policies, etc.) declarative and easy to grok for developers. We do this through a combination of open source projects which we develop and a Cloud service that aids in automation. For each type of policy, we have a method to detect actual traffic and compare it to the declared permissions.

Long story short, for AWS visibility of traffic, we discovered iamlive that does a lot of the work, and is wonderful! We are working on utilizing it in our project, and as part of that have done a bunch of work on how to deploy iamlive in proxy mode to a Kubernetes cluster, and would like to contribute a walkthrough that explains all the steps needed to get things working.

Is this desirable? And what is the preferred way to contribute this sort of documentation & tooling? We were looking for where documentation like this might live and couldn't find anything.

iann0036 commented 9 months ago

Hi @orishoshan,

Thanks for reaching out!

I don't have a solid story yet for additional supporting documentation. The Other Methods section generally links out to other 3rd-party posts on various ways to deploy the tool. If you want to host docs externally, I'll happily link out to you.

If you think it'd be best within the repo itself (.md), I'm happy to accept PRs for a new documentation section (is /docs standard these days?) and again include a link from the Other Methods section. I'll just need to ensure it's vendor-agnostic.

Appreciate your assistance!

orishoshan commented 9 months ago

I think the .md path would be easiest for us :) And yeah, we were definitely looking to contribute something vendor-agnostic (i.e. how to deploy vanilla iamlive on your cluster).