search

metal-stack / firewall-controller

A kubernetes controller running on bare-metal firewalls, creating nftables rules, configures suricata, collects network metrics
MIT License
47 stars 4 forks source link

Make CWNP Validation more strict #150

Open majst01 opened 1 year ago

majst01 commented 1 year ago

We should enforce that for every rule specified either to or toFQDNs and port is specified to prevent accidentally open to wide

Gerrit91 commented 1 year ago

Another idea that comes to mind is implementing a validation webhook. This could run as a dedicated pod in the seed's shoot namespace and watch the shoot api-server. This way, we could decline erroneous resources directly before storing them into ETCD.