kubewarden / apparmor-psp-policy Goto Github PK
View Code? Open in Web Editor NEWA Kubewarden Pod Security Policy that controls usage of AppArmor profiles
Home Page: https://kubewarden.io
License: Apache License 2.0
A Kubewarden Pod Security Policy that controls usage of AppArmor profiles
Home Page: https://kubewarden.io
License: Apache License 2.0
Update the policy from targeting Pod resource to target higher level objects like deployments. This is a better practice because we prevent the resources to be created instead of failing in the deployment phase when the pods are created.
As an example, see kubewarden/allow-privilege-escalation-psp-policy#33.
Add workflow to test the policy in a actual cluster running Kubewarden.
This has been created to address the testing architecture RFC requirements
The Wasm file containing the policy must be enriched with metadata.
This is just an example of the metadata.yaml file:
rules:
- apiGroups: [""]
apiVersions: ["v1"]
resources: ["pods"]
operations: ["CREATE", "UPDATE"]
mutating: false
labels:
production: false
annotations:
name.castelli.hello: world
io.kubewarden.policy.title: psp-apparmor
io.kubewarden.policy.description: Replacement for the Kubernetes Pod Security Policy that controls the usage of AppArmor profiles
io.kubewarden.policy.author: Flavio Castelli
io.kubewarden.policy.url: https://github.com/kubewarden/psp-apparmor
io.kubewarden.policy.source: https://github.com/kubewarden/psp-apparmor
io.kubewarden.policy.license: Apache-2.0
io.kubewarden.policy.usage: |
This policy works by defining a whitelist of allowed AppArmor profiles. Pods are then inspected at creation and update time, to ensure only approved profiles are used.
When no AppArmor profile is defined, Kubernetes will leave the final choice to the underlying container runtime. This will result in using the default AppArmor profile provided by Container Runtime. Because of that, the default behaviour of this policy is to accept workloads that do not have an AppArmor profile specified.
The policy can be configured with the following data structure:
```yaml
# list of allowed profiles
allowed_profiles:
- runtime/default
- localhost/my-special-workload
```
This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.
These updates are awaiting their schedule. Click on a checkbox to get an update now.
Cargo.toml
anyhow 1.0
k8s-openapi 0.22.0
kubewarden-policy-sdk 0.11.0
serde_json 1.0
serde 1.0
.github/workflows/release.yml
kubewarden/github-actions v3.3.1
kubewarden/github-actions v3.3.1
.github/workflows/tests.yml
kubewarden/github-actions v3.3.1
Implement real e2e tests for the policy
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.