search

kinvolk / fanotify-mon

MIT License
0 stars 2 forks source link

Add support for policy language configmap #4

Open surajssd opened 2 years ago

surajssd commented 2 years ago

Right now instead of going into implementing full-fledged CRDs, rely on a configmap for the policy information. The app will read the policy from a configmap with name fanotify-policy in fanotify-mon namespace with key policy. This policy will be parsed by the application to decide what pods should be selected for policy enforcement.

Here is the document to flesh out the policy language.

vbatts commented 2 years ago

Let's consider the Rego language, used by OPA https://www.openpolicyagent.org/docs/latest/policy-language/ https://pkg.go.dev/github.com/open-policy-agent/opa/rego

vbatts commented 2 years ago

Looks like our seccompagent is working with it as well https://github.com/kinvolk/seccompagent/pull/12 (additional info https://github.com/kubearmor/KubeArmor/blob/main/getting-started/security_policy_specification.md)