search

kubewarden / kubewarden-controller

Manage admission policies in your Kubernetes cluster with ease
https://kubewarden.io
Apache License 2.0
182 stars 30 forks source link

Update some of our policies that are targeting `Pod`, to make them process higher level objects #282

Open jvanz opened 1 year ago

jvanz commented 1 year ago

Update some of our policies that are targeting Pod, to make them process higher level objects like deployments. This is a better practice because we prevent the resources to be created instead of failing in the deployment phase when the pods are created.

The following list is the policies with rules targeting pod resource which need to be updated

Go-based:

Rust-based:

For the rust policies, it's possible to use a recent feature added to the rust SDK which allow policy authors to get the pod definition from the high level resources. It would be nice to have a similar feature in the others SDKs as well.

jvanz commented 1 year ago

As we are not working on this now, I've re added the issue in the board to keep it in the "waiting triage" queue.

flavio commented 11 months ago

Instead of updating all our policies targeting Pods to cover for high order resources, we might consider doing something like Kyverno aug-gen rules

adnanhashmi09 commented 11 months ago

I would like to work on this issue. Please assign this to me.

jvanz commented 11 months ago

@adnanhashmi09, please, select a sub task. I'll assign it for you as well.

flavio commented 11 months ago

wait, I'm a bit confused. I don't know if @adnanhashmi09 wants to work on the original task or attempt to implement what I described inside of https://github.com/kubewarden/kubewarden-controller/issues/282#issuecomment-1665120267

@adnanhashmi09: can you please clarify?

adnanhashmi09 commented 11 months ago

I am working on this sub-issue.. I left a comment there. @flavio

flavio commented 11 months ago

JFYI, I've created https://github.com/kubewarden/rfc/issues/23 to keep track of what I described inside of https://github.com/kubewarden/kubewarden-controller/issues/282#issuecomment-1665120267.

I suggest to put this issue on hold until we understand whether we can have a generic way to make Pod-specific policies work against higher-order resources

niheetes commented 5 months ago

Any progress on the generic way to make these policies work on higher level resources?

jvanz commented 5 months ago

Any progress on the generic way to make these policies work on higher level resources?

No, this is issue is on hold for now. May I ask you why you're interested on this? Are you facing some issue writing policies or something similar? Do you want to contribute?

jvanz commented 5 months ago

@niheetes sorry for the long delay to give you a feedback. We've discussed this issue during our planning session and we do not want to fix all the policies manually. Because that will required a lot of changes and it not future proof. In other words, we would like to avoid to remember that policy must be handle pod inside high level resources every time. Therefore, we will refine this card to decide the proper way to move it forward.

However, we do not want to leave you if a workaround. Thus, we would like to know which policies you want to get fix. Therefore, we can work on them while we do not find the final solution for this issue. Can you share that with us?