search

sigstore / policy-controller

Sigstore Policy Controller - an admission controller that can be used to enforce policy on a Kubernetes cluster based on verifiable supply-chain metadata from cosign
Other
123 stars 54 forks source link

Verify only pods #1388

Open dszakallas opened 6 months ago

dszakallas commented 6 months ago

Description

Make policy-controller configurable to only consider pods, not higher level resources.

Use case

We are using a continuous reconciliation (GitOps) solution, Flux, to maintain cluster state. The mutation of the image reference by the mutating admission webhook has undesired effects for us when used in conjunction with Flux:

Workarounds

While the scope of resources to validate can be controlled on the Policy level, this is not sufficient for our use, as mutations still get applied to all recognized resources and this seems to be hard coded. The only workaround I found was to fork the code and remove these.

Related work

Correct me if I am wrong, but I believe this change would not deteriorate the integrity of the cluster, since the pods owned by these unvalidated resources would still go through admission control, and their images will be verified. As an example of this practice, PSA (Pod Security Admission) only operates on the pod resource. Recently, Connaisseur also added a flag to opt out of higher level resource validation.

senanz commented 2 months ago

/assign

senanz commented 2 months ago

@hectorj2f - could you please assign it to me, started to work on code that supporting that.

0xiso commented 3 weeks ago

@senanz We are also facing the same issue and are searching for solutions. Seems like you are working on solving this problem, but do you have plans to create a PR?

hectorj2f commented 3 weeks ago

@0xiso @senanz feel free to assign it yourself, but we need to discuss whether we want to go ahead with this change.

senanz commented 3 weeks ago

@hectorj2f - I have already have the change, need to do some modification and let's discuss that then. will update you soon. Thanks for consedring that.

senanz commented 3 weeks ago

@0xiso - I have the PR need some updates and will raise it again. @hectorj2f -Could you please assign the ticket on me?

senanz commented 2 weeks ago

@hectorj2f - Could you please review? https://github.com/sigstore/policy-controller/pull/1687 Let me know of you want to do dsicussion regarding that on slack.