kubewarden / docs Goto Github PK
View Code? Open in Web Editor NEWKubewarden's documentation
Home Page: https://docs.kubewarden.io
License: Creative Commons Attribution 4.0 International
Kubewarden's documentation
Home Page: https://docs.kubewarden.io
License: Creative Commons Attribution 4.0 International
Update the docs so that the following acceptance criteria are met.
The section describing the architecture of Kubewarden must be updated to reflect the changes done by the new architecture.
PolicyServer
CRD works, what is the purpose of thatUpdate the waPC protocol used for input/output
It would be great to extend our current documentation to include some user stories about PSPs replacement.
PSPs are currently deprecated and are going to be dropped from k8s pretty soon. Users relying on PSPs can use Kubewarden to replace them.
No response
Add a new Sigstore section (for example under 6.Distributed Policies).
This new section will explain https://github.com/kubewarden/kubewarden-controller/blob/main/rfc/0003-policy-signing.md in an user facing way.
cosign sign
and push it to a registry.kwct verify -k
.kwct verify --verification-config-path
, for subjectUrl, subjectUrlPrefix.PolicyServer
: it's the same as kwctl
, just configured via Configmap containing the verification-config.ymlNo response
No response
WIth the work from kubewarden/kwctl#170 and its PR,
we will have now kwctl scaffold manifest
, that substitutes the old kwctl manifest
.
Update its appearances in docs.
With the upcoming UI version 1.0.0
there should be documentation explaining how to install the UI as an extension in Rancher Manager.
> helm repo add kubewarden https://charts.kubewarden.io
"kubewarden" has been added to your repositories
> helm install --namespace kubewarden --create-namespace kubewarden-controller kubewarden/kubewarden-controller
Installing chart "kubewarden-controller" in namespace "kubewarden"…
Done! 👏
> kubectl apply -f - <<EOF
> apiVersion: kubewarden.io/v1alpha1
> kind: ClusterAdmissionPolicy
> metadata:
> name: privileged-pods
> spec:
> module: registry://ghcr.io/kubewarden/policies/pod-privileged:v0.1.1
> resources:
> - pods
> operations:
> - CREATE
> - UPDATE
> EOF
error: unable to recognize "STDIN": no matches for kind "ClusterAdmissionPolicy" in version "kubewarden.io/v1alpha1"
Explain the workflow needed to run a vanilla OPA policy on top of Kubewarden.
This should cover topics such as:
rego
file to Wasm
Also, we should provide some practical examples.
Similarly to Kubernetes docs contributing guides, describe documentation contributing guides for Kubewarden.
The Policy Server can export trace events to a Jaeger endpoint. This provides useful information to debug a running cluster.
The new architecture will enable us to deploy PolicyServer with tracing enabled. We should document that inside of our docs.
The Quick Start
documentation has references to the recently removed Jaeger tracing. We need to remove the references or update to Open Telemetry configuration.
Extend the docs to explain:
Create a section describing how to take advantage of the monitor mode of ClusterAdmissionPolicy
.
We are about to add a new Helm chart to install default Policy Server. This means that kubewarden-controller
will not install the Policy Server anymore. So, we need to document the impact of this change and how users can migrate from one version to another.
The testing the validation code block passes metav1.Object meta by value instead of by reference.
Pass it by reference.
Follow the docs and attempt to run make test
- OS: MacOS
- Architecture: amd64
No response
The charts on the page have been updated to show also the involvement of OCI registry. The text should be updated to reflect that.
Double check if the reference documentation of the host capabilities function available matches of what is send over the wire in the guest and host communication. If there is some difference, fix the docs.
The "Writing policies" introduction should provide the following information:
Explain how to log messages from a policy.
Issue opened to track nits mentioned by @ereslibre in this comment on the PR #104
No response
No response
- OS:
- Architecture:
No response
Explain:
While policy generation is well documented, getting this policy to run and tested is a spread over multiple documents
I'd like to see a simple developer workflow, ideally documented on a single page
It's not about writing/testing a correct policy, it's about getting this workflow documented and to give a developer an initial sense of accomplishment.
Bonus points if this all can be done on a local workstation (with e.g. k3s) and doesn't need a registry,
Explain how to create a Rust based policy
As described in the threat 10 in the threat model, there is a possibility of a exploitation if the Kubewarden policies do mutation and validation in the same policy. If the policies are not properly written, bad actions can exploit this to get privileged container created. Therefore, it is necessary update the Kubewarden documentation to warn policy authors about this threat in their policies.
We could suggest policy authors to split policies which perform validation and mutation into two separable policies. One for mutation and another for validation.
NOTE: This is an issue created from RFC discussing the admission control threat model. It's created to allow the Kubewarden team discuss the proposed mitigation further and select each individual item when necessary.
Creating this issue to discuss the big picture structure of the docs:
We already have policies written in both languages, but we don't have yet the time to write detailed instructions like the ones of Rust and Go.
Nevertheless, we should mention them.
Rename chimera-book
to kubewarden-book
and all occurences within
Hey.
I'm trying to follow the quickstart guide but hitting issues, presumably i'm doing something daft, hope you can tell me where i'm going wrong.
minikube start
helm repo add kubewarden https://charts.kubewarden.io
kubectl apply -f https://github.com/jetstack/cert-manager/releases/download/v1.5.3/cert-manager.yaml
kubectl wait --for=condition=Available deployment --timeout=2m -n cert-manager --all
helm install --wait -n kubewarden --create-namespace kubewarden-crds kubewarden/kubewarden-crds
helm install --wait -n kubewarden kubewarden-controller kubewarden/kubewarden-controller
... wait for everything to come up
kubectl apply -f - <<EOF
apiVersion: policies.kubewarden.io/v1alpha2
kind: PolicyServer
metadata:
name: reserved-instance-for-tenant-a
spec:
image: ghcr.io/kubewarden/policy-server:latest
serviceAccountName: policy-server
replicas: 1
env:
- name: KUBEWARDEN_LOG_LEVEL
value: debug
EOF
kubectl apply -f - <<EOF
apiVersion: policies.kubewarden.io/v1alpha2
kind: ClusterAdmissionPolicy
metadata:
name: privileged-pods
spec:
policyServer: reserved-instance-for-tenant-a
module: registry://ghcr.io/kubewarden/policies/pod-privileged:v0.1.9
rules:
- apiGroups: [""]
apiVersions: ["v1"]
resources: ["pods"]
operations:
- CREATE
- UPDATE
mutating: false
EOF
everything looks fine
$ kubectl -n kubewarden get pods,ClusterAdmissionPolicy
NAME READY STATUS RESTARTS AGE
pod/kubewarden-controller-5cc6b54d-fbp5b 1/1 Running 0 2m22s
pod/policy-server-default-5bb75cbf9b-jddkh 1/1 Running 0 2m
pod/policy-server-reserved-instance-for-tenant-a-7b88657b77-dw794 1/1 Running 0 27s
NAME POLICY SERVER MUTATING STATUS
clusteradmissionpolicy.policies.kubewarden.io/privileged-pods reserved-instance-for-tenant-a false active
but then doing:
$ kubectl apply -f - <<EOF
apiVersion: v1
kind: Pod
metadata:
name: unprivileged-pod
spec:
containers:
- name: nginx
image: nginx:latest
EOF
Error from server (InternalError): error when creating "STDIN": Internal error occurred: failed calling webhook "privileged-pods.kubewarden.admission": Post "https://policy-server-reserved-instance-for-tenant-a.kubewarden.svc:8443/validate/privileged-pods?timeout=10s": read tcp 192.168.49.2:37254->10.105.28.154:8443: read: connection reset by peer
Which causes the policy server to crash
$ kubectl -n kubewarden get pods,ClusterAdmissionPolicy
NAME READY STATUS RESTARTS AGE
pod/kubewarden-controller-5cc6b54d-fbp5b 1/1 Running 0 4m17s
pod/policy-server-default-5bb75cbf9b-jddkh 1/1 Running 0 3m55s
pod/policy-server-reserved-instance-for-tenant-a-7b88657b77-dw794 1/1 Running 1 (55s ago) 2m22s
NAME POLICY SERVER MUTATING STATUS
clusteradmissionpolicy.policies.kubewarden.io/privileged-pods reserved-instance-for-tenant-a false active
and the logs despite being in DEBUG
don't seem to give any clues:
$ kubectl logs -n kubewarden --previous policy-server-reserved-instance-for-tenant-a-7b88657b77-dw794
�[2mNov 26 10:43:55.550�[0m �[32m INFO�[0m policy_server: policies download download_dir="/tmp/" policies_count=1 status="init"
�[2mNov 26 10:43:55.550�[0m �[34mDEBUG�[0m policy_server: download policy="privileged-pods"
�[2mNov 26 10:43:55.582�[0m �[34mDEBUG�[0m policy_fetcher: pulling policy url=Url { scheme: "registry", cannot_be_a_base: false, username: "", password: None, host: Some(Domain("ghcr.io")), port: None, path: "/kubewarden/policies/pod-privileged:v0.1.9", query: None, fragment: None }
�[2mNov 26 10:43:55.587�[0m �[34mDEBUG�[0m oci_distribution::client: Pulling image: ghcr.io/kubewarden/policies/pod-privileged:v0.1.9
�[2mNov 26 10:43:55.587�[0m �[34mDEBUG�[0m oci_distribution::client: Authorizing for image: ghcr.io/kubewarden/policies/pod-privileged:v0.1.9
�[2mNov 26 10:43:55.587�[0m �[34mDEBUG�[0m reqwest::connect: starting new connection: https://ghcr.io/
�[2mNov 26 10:43:55.837�[0m �[34mDEBUG�[0m reqwest::async_impl::client: response '401 Unauthorized' for https://ghcr.io/v2/
�[2mNov 26 10:43:55.837�[0m �[34mDEBUG�[0m oci_distribution::client: Making authentication call to https://ghcr.io/token
�[2mNov 26 10:43:55.974�[0m �[34mDEBUG�[0m reqwest::async_impl::client: response '200 OK' for https://ghcr.io/token?scope=repository%3Akubewarden%2Fpolicies%2Fpod-privileged%3Apull&service=ghcr.io
�[2mNov 26 10:43:55.974�[0m �[34mDEBUG�[0m oci_distribution::client: Received response from auth request: {"token":"djE6a3ViZXdhcmRlbi9wb2xpY2llcy9wb2QtcHJpdmlsZWdlZDoxNjM3OTIzNDM2MDE1OTgzMzky"}
�[2mNov 26 10:43:55.974�[0m �[34mDEBUG�[0m oci_distribution::client: Succesfully authorized for image 'ghcr.io/kubewarden/policies/pod-privileged:v0.1.9'
�[2mNov 26 10:43:55.974�[0m �[34mDEBUG�[0m oci_distribution::client: Pulling image manifest from https://ghcr.io/v2/kubewarden/policies/pod-privileged/manifests/v0.1.9
�[2mNov 26 10:43:56.193�[0m �[34mDEBUG�[0m reqwest::async_impl::client: response '200 OK' for https://ghcr.io/v2/kubewarden/policies/pod-privileged/manifests/v0.1.9
�[2mNov 26 10:43:56.193�[0m �[34mDEBUG�[0m oci_distribution::client: validating manifest: {"schemaVersion":2,"mediaType":null,"config":{"mediaType":"application/vnd.wasm.config.v1+json","digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","size":2,"urls":null,"annotations":null},"layers":[{"mediaType":"application/vnd.wasm.content.layer.v1+wasm","digest":"sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2","size":21858,"urls":null,"annotations":{"org.opencontainers.image.title":"sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2"}}],"annotations":null}
�[2mNov 26 10:43:56.193�[0m �[34mDEBUG�[0m oci_distribution::client: Parsing response as OciManifest: {"schemaVersion":2,"mediaType":null,"config":{"mediaType":"application/vnd.wasm.config.v1+json","digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","size":2,"urls":null,"annotations":null},"layers":[{"mediaType":"application/vnd.wasm.content.layer.v1+wasm","digest":"sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2","size":21858,"urls":null,"annotations":{"org.opencontainers.image.title":"sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2"}}],"annotations":null}
�[2mNov 26 10:43:56.193�[0m �[34mDEBUG�[0m oci_distribution::client: Pulling image layer
�[2mNov 26 10:43:56.390�[0m �[34mDEBUG�[0m reqwest::async_impl::client: redirecting 'https://ghcr.io/v2/kubewarden/policies/pod-privileged/blobs/sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2' to 'https://pkg-containers.githubusercontent.com/ghcr1/blobs/sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2?se=2021-11-26T10%3A50%3A00Z&sig=GJJkXqHYIkoNkX93V%2FeB1eVRsa5QUzWThtiQOaROacM%3D&sp=r&spr=https&sr=b&sv=2019-12-12'
�[2mNov 26 10:43:56.390�[0m �[34mDEBUG�[0m reqwest::connect: starting new connection: https://pkg-containers.githubusercontent.com/
�[2mNov 26 10:43:56.598�[0m �[34mDEBUG�[0m reqwest::async_impl::client: response '200 OK' for https://pkg-containers.githubusercontent.com/ghcr1/blobs/sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2?se=2021-11-26T10%3A50%3A00Z&sig=GJJkXqHYIkoNkX93V%2FeB1eVRsa5QUzWThtiQOaROacM%3D&sp=r&spr=https&sr=b&sv=2019-12-12
�[2mNov 26 10:43:56.604�[0m �[34mDEBUG�[0m oci_distribution::client: Pulling image: ghcr.io/kubewarden/policies/pod-privileged:v0.1.9
�[2mNov 26 10:43:56.604�[0m �[34mDEBUG�[0m oci_distribution::client: Authorizing for image: ghcr.io/kubewarden/policies/pod-privileged:v0.1.9
�[2mNov 26 10:43:56.604�[0m �[34mDEBUG�[0m reqwest::connect: starting new connection: https://ghcr.io/
�[2mNov 26 10:43:56.807�[0m �[34mDEBUG�[0m reqwest::async_impl::client: response '401 Unauthorized' for https://ghcr.io/v2/
�[2mNov 26 10:43:56.807�[0m �[34mDEBUG�[0m oci_distribution::client: Making authentication call to https://ghcr.io/token
�[2mNov 26 10:43:56.953�[0m �[34mDEBUG�[0m reqwest::async_impl::client: response '200 OK' for https://ghcr.io/token?scope=repository%3Akubewarden%2Fpolicies%2Fpod-privileged%3Apull&service=ghcr.io
�[2mNov 26 10:43:56.953�[0m �[34mDEBUG�[0m oci_distribution::client: Received response from auth request: {"token":"djE6a3ViZXdhcmRlbi9wb2xpY2llcy9wb2QtcHJpdmlsZWdlZDoxNjM3OTIzNDM2OTc5OTkzNzIy"}
�[2mNov 26 10:43:56.953�[0m �[34mDEBUG�[0m oci_distribution::client: Succesfully authorized for image 'ghcr.io/kubewarden/policies/pod-privileged:v0.1.9'
�[2mNov 26 10:43:56.953�[0m �[34mDEBUG�[0m oci_distribution::client: Pulling image manifest from https://ghcr.io/v2/kubewarden/policies/pod-privileged/manifests/v0.1.9
�[2mNov 26 10:43:57.186�[0m �[34mDEBUG�[0m reqwest::async_impl::client: response '200 OK' for https://ghcr.io/v2/kubewarden/policies/pod-privileged/manifests/v0.1.9
�[2mNov 26 10:43:57.186�[0m �[34mDEBUG�[0m oci_distribution::client: validating manifest: {"schemaVersion":2,"mediaType":null,"config":{"mediaType":"application/vnd.wasm.config.v1+json","digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","size":2,"urls":null,"annotations":null},"layers":[{"mediaType":"application/vnd.wasm.content.layer.v1+wasm","digest":"sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2","size":21858,"urls":null,"annotations":{"org.opencontainers.image.title":"sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2"}}],"annotations":null}
�[2mNov 26 10:43:57.186�[0m �[34mDEBUG�[0m oci_distribution::client: Parsing response as OciManifest: {"schemaVersion":2,"mediaType":null,"config":{"mediaType":"application/vnd.wasm.config.v1+json","digest":"sha256:44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a","size":2,"urls":null,"annotations":null},"layers":[{"mediaType":"application/vnd.wasm.content.layer.v1+wasm","digest":"sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2","size":21858,"urls":null,"annotations":{"org.opencontainers.image.title":"sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2"}}],"annotations":null}
�[2mNov 26 10:43:57.186�[0m �[34mDEBUG�[0m oci_distribution::client: Pulling image layer
�[2mNov 26 10:43:57.374�[0m �[34mDEBUG�[0m reqwest::async_impl::client: redirecting 'https://ghcr.io/v2/kubewarden/policies/pod-privileged/blobs/sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2' to 'https://pkg-containers.githubusercontent.com/ghcr1/blobs/sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2?se=2021-11-26T10%3A50%3A00Z&sig=GJJkXqHYIkoNkX93V%2FeB1eVRsa5QUzWThtiQOaROacM%3D&sp=r&spr=https&sr=b&sv=2019-12-12'
�[2mNov 26 10:43:57.374�[0m �[34mDEBUG�[0m reqwest::connect: starting new connection: https://pkg-containers.githubusercontent.com/
�[2mNov 26 10:43:57.450�[0m �[34mDEBUG�[0m reqwest::async_impl::client: response '200 OK' for https://pkg-containers.githubusercontent.com/ghcr1/blobs/sha256:59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2?se=2021-11-26T10%3A50%3A00Z&sig=GJJkXqHYIkoNkX93V%2FeB1eVRsa5QUzWThtiQOaROacM%3D&sp=r&spr=https&sr=b&sv=2019-12-12
�[2mNov 26 10:43:57.461�[0m �[32m INFO�[0m policy_server: policy download name="privileged-pods" path="/tmp/registry/ghcr.io/kubewarden/policies/pod-privileged:v0.1.9" sha256sum="59e34f482b40cc39e408c6eef76ed48a25560ee54579839eda0817cb0ada31c2" mutating=false
�[2mNov 26 10:43:57.461�[0m �[32m INFO�[0m policy_server: policies download status="done"
�[2mNov 26 10:43:57.461�[0m �[32m INFO�[0m policy_server: kubernetes poller bootstrap status="init"
�[2mNov 26 10:43:57.461�[0m �[32m INFO�[0m policy_server: kubernetes poller bootstrap status="done"
�[2mNov 26 10:43:57.461�[0m �[32m INFO�[0m policy_server: worker pool bootstrap status="init"
�[2mNov 26 10:43:57.461�[0m �[32m INFO�[0m policy_server::kube_poller: spawning cluster context refresh loop
�[2mNov 26 10:43:57.461�[0m �[32m INFO�[0m policy_server::worker_pool: spawning worker spawned=2 total=5
�[2mNov 26 10:43:57.462�[0m �[32m INFO�[0m policy_server::worker_pool: spawning worker spawned=1 total=5
�[2mNov 26 10:43:57.462�[0m �[32m INFO�[0m policy_server::worker_pool: spawning worker spawned=3 total=5
�[2mNov 26 10:43:57.462�[0m �[32m INFO�[0m policy_server::worker_pool: spawning worker spawned=4 total=5
�[2mNov 26 10:43:57.471�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:43:57.482�[0m �[32m INFO�[0m policy_server::worker_pool: spawning worker spawned=5 total=5
�[2mNov 26 10:43:57.554�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:43:57.556�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:43:57.567�[0m �[34mDEBUG�[0m policy_server::worker_pool: worker loop start id=3
�[2mNov 26 10:43:57.567�[0m �[34mDEBUG�[0m policy_server::worker_pool: worker loop start id=1
�[2mNov 26 10:43:57.567�[0m �[32m INFO�[0m policy_server: worker pool bootstrap status="done"
�[2mNov 26 10:43:57.567�[0m �[34mDEBUG�[0m policy_server::worker_pool: worker loop start id=4
�[2mNov 26 10:43:57.567�[0m �[34mDEBUG�[0m policy_server::worker_pool: worker loop start id=2
�[2mNov 26 10:43:57.567�[0m �[34mDEBUG�[0m policy_server::worker_pool: worker loop start id=5
�[2mNov 26 10:43:57.570�[0m �[32m INFO�[0m policy_server::server: started HTTPS server address="0.0.0.0:8443"
�[2mNov 26 10:44:02.558�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:02.589�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:02.591�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:07.596�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:07.610�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:07.615�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:12.622�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:12.639�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:12.641�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:17.646�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:17.659�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:17.669�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:22.673�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:22.691�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:22.697�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:27.708�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:27.720�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:27.723�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:32.727�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:32.741�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:32.743�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:37.746�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:37.768�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:37.774�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:42.778�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:42.795�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:42.797�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:47.802�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:47.818�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:47.824�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:52.838�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:52.844�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:52.846�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:57.851�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:57.868�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:44:57.870�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:45:02.873�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:45:02.879�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:45:02.881�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:45:07.885�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:45:07.897�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:45:07.899�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:45:12.902�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/namespaces? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:45:12.936�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/api/v1/services? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
�[2mNov 26 10:45:12.938�[0m �[34mDEBUG�[0m �[1mHTTP�[0m�[1m{�[0mhttp.method=GET http.url=https://10.96.0.1:443/apis/networking.k8s.io/v1/ingresses? otel.name="HTTP" otel.kind="client"�[1m}�[0m: kube_client::client: requesting
Every time I try to submit the pod that should be allowed the policy server crashes again 😢
Consequently I'm pretty stuck!
I've tried with both kind and minikube to the same end result, I'm trying to build https://github.com/appvia/psp-migration which might be a useful resource for the kubewarden folk, it'd be great to get some collaboration on it if you've time and interest (after I've got kubewarden to bootstrap!) thanks!
Chris
We have defined in our docs:
waPC contracts up to this point. This is the interface that we should support going forward so policies built today can be run on future Kubewarden versions without any glitch.
This issue is to describe the logging contract: https://github.com/kubewarden/policy-evaluator/blob/01548909206cbbc6ce8cf7321ca3596aa72cfb9b/src/runtimes/wapc.rs#L31-L46
We've recently changed the format of the sources.yaml
file. The documentation should be updated to reflect that.
I also think we should update the page to explain to the users how to get this information into the Policy Server, when the kubewarden operator is used.
sources.yaml
format is documentedsources.yaml
configuration when using our controllerOn the Distributing Policies section of the book, provide a list of what are the OCI registries that have been tested, and if some registries are giving troubles, give an explicit list as well, so we can get feedback from the users if at some point they are working.
Extend these documentation sections:
We should document that pulling policies from a private registry can be done by using the Policy Server CRD attribute imagePullSecret
.
Following tasks to be accomplished for Docusaurus migration
This is an issue to track the progress of docusaurus migration for Kubewarden.
No response
No response
Reorganize docs following https://diataxis.fr. As an example, see https://docs.epinio.io.
This allows to cater to personas. Note that thanks to the Divio system, those personas don't necessarily get specific doc sections for them, they just get an easier time navigating the docs and finding the info relevant to them.
Docusaurus lints on build for broken links, so we can iterate on this process.
As said, work should be prioritized by personas, starting from the first, to maximize adoption.
A low hanging fruit may be to create a "Reference documentation" section, and start moving relevant parts there (e.g: config files, CRDs, etc).
Some users in the Kubewarden communication channels requested an air-gapped installation guide. This issue should keep track of this request. Furthermore, the team should discuss if this would be supported by Kubewarden.
metadata.yml
fileThe deployment instructions should cover the deployment of the chimera stack using the chimera-controller
Explain how to create a AssemblyScript based policy
Document the importance of properly RBAC configured privileges.
It's necessary to document the importance of properly configured RBAC privileges to keep the admission control, and by consequence the Kuberwarden, secure and working as expected. Therefore, only the right users should be allowed to manipulate webhook objects and CRD objects. This is the mitigation action proposed in the threat #4 and #11
NOTE: This is an issue created from RFC discussing the admission control threat model. It's created to allow the Kubewarden team discuss the proposed mitigation further and select each individual item when necessary.
TLS termination against docs.kubewarden.io is broken since we moved to the custom domain. This should be fixed to ensure the website can be accessed using https
Add documentation about how to use the new AdmissionPolicy
and its differences with the ClusterAdmissionPolicy
Explain how to create a AssemblyScript based policy
Upstream mdBook will remove its google-analytics integration.
Instead downstream projects should put respective javascript code into theme/head.hbs
This issue provides visibility into Renovate updates and their statuses. Learn more
This repository currently has no open or pending branches.
After this PR, it is necessary to check in the docs where we refer Helm chart values about telemetry and update to the latest structure. The flag to enable metrics are not outsite the policyserver
field.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.