Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: introduce Pepr common policies #50

Merged
merged 35 commits into from
Dec 5, 2023
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
35 commits
Select commit Hold shift + click to select a range
dc98a5f
enforce strict mode for pepr
jeff-mccoy Nov 22, 2023
2545187
pepr policies: restrict volume types & hostPath rw
jeff-mccoy Nov 22, 2023
9acde9d
restructure pepr to one capability per source package
jeff-mccoy Nov 22, 2023
6f1bf20
add host namespace policy
jeff-mccoy Nov 23, 2023
db01aa8
experiment with policy exemptions
jeff-mccoy Nov 24, 2023
8911d4f
spelling annoyances
jeff-mccoy Nov 24, 2023
f9a4f33
promtail things
jeff-mccoy Nov 24, 2023
08ae5bf
more policy thingz
jeff-mccoy Nov 25, 2023
6b026ac
add security policies
jeff-mccoy Nov 26, 2023
b3ae9ca
wip: network policy extravaganza
jeff-mccoy Nov 27, 2023
94b502f
remove network policies in this pr
jeff-mccoy Nov 28, 2023
7194765
restore network policies
jeff-mccoy Nov 28, 2023
5864193
remove kyverno gh filter target
jeff-mccoy Nov 28, 2023
0c1dd0d
that sucketh
jeff-mccoy Nov 29, 2023
3163c6a
be more explicit for non-root user
jeff-mccoy Nov 29, 2023
dfe915f
Update src/policies/exemptions/storage.ts
jeff-mccoy Nov 29, 2023
aebd504
Update src/policies/storage.ts
jeff-mccoy Nov 29, 2023
35974da
bump to pepr 0.18
jeff-mccoy Nov 29, 2023
13d2d0d
spelling thingz
jeff-mccoy Nov 29, 2023
835a3f6
i dont want to talk about it....
jeff-mccoy Nov 30, 2023
7944003
less annoying metric server lag
jeff-mccoy Dec 1, 2023
967112a
more policy fun
jeff-mccoy Dec 1, 2023
109e7fa
more exemption fun
jeff-mccoy Dec 1, 2023
68e791b
exclude istio init containers from checks
jeff-mccoy Dec 1, 2023
980a69a
more exemptions
jeff-mccoy Dec 1, 2023
1cb8790
more policy fixy things
jeff-mccoy Dec 2, 2023
1d4bc00
never ending story
jeff-mccoy Dec 2, 2023
465a6ff
start adding jest tests for pepr policies
jeff-mccoy Dec 4, 2023
e2633d1
finish policy tests
jeff-mccoy Dec 5, 2023
2c63b77
bump pepr version
jeff-mccoy Dec 5, 2023
5aea6fe
cleanup
jeff-mccoy Dec 5, 2023
ad08108
Update README.md
jeff-mccoy Dec 5, 2023
64fddac
Update networking.ts
jeff-mccoy Dec 5, 2023
727614a
Update networking.ts
jeff-mccoy Dec 5, 2023
e3df7bb
cleanup network tests
jeff-mccoy Dec 5, 2023
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 6 additions & 18 deletions .eslintrc.json
Original file line number Diff line number Diff line change
Expand Up @@ -3,28 +3,16 @@
"browser": false,
"es2021": true
},
"extends": [
"eslint:recommended",
"plugin:@typescript-eslint/recommended"
],
"extends": ["eslint:recommended", "plugin:@typescript-eslint/recommended"],
"parser": "@typescript-eslint/parser",
"parserOptions": {
"project": [
"./tsconfig.json"
],
"project": ["./tsconfig.json"],
"ecmaVersion": 2022
},
"plugins": [
"@typescript-eslint"
],
"ignorePatterns": [
"node_modules",
"dist"
],
"plugins": ["@typescript-eslint"],
"ignorePatterns": ["node_modules", "dist", "jest.*.js"],
"root": true,
"rules": {
"@typescript-eslint/no-floating-promises": [
"error"
]
"@typescript-eslint/no-floating-promises": ["error"]
}
}
}
2 changes: 0 additions & 2 deletions .github/filters.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,6 @@ keycloak:
- "src/keycloak/**"
kiali:
- "src/kiali/**"
kyverno:
- "src/kyverno/**"
loki:
- "src/loki/**"
metrics-server:
Expand Down
4 changes: 2 additions & 2 deletions .prettierrc
Original file line number Diff line number Diff line change
Expand Up @@ -4,10 +4,10 @@
"bracketSpacing": true,
"embeddedLanguageFormatting": "auto",
"insertPragma": false,
"printWidth": 80,
"printWidth": 100,
"quoteProps": "as-needed",
"requirePragma": false,
"semi": true,
"tabWidth": 2,
"useTabs": false
}
}
21 changes: 20 additions & 1 deletion .vscode/settings.json
Original file line number Diff line number Diff line change
Expand Up @@ -22,5 +22,24 @@
"https://raw.githubusercontent.com/defenseunicorns/zarf/v0.31.1/zarf.schema.json": [
"zarf.yaml"
]
}
},
"cSpell.words": [
"alertmanager",
"Authservice",
"automount",
"controlplane",
"crds",
"distros",
"ironbank",
"Kiali",
"Kyverno",
"MITM",
"neuvector",
"opensource",
"promtail",
"Quickstart",
"seccomp",
"Sysctls",
"Velero"
]
}
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ UDS core publishes two packages:

### UDS Core Bundles

Thes bundles are intended for boostrapping common development & testing environments and should not be used for produciton. They also serve as examples to create custom bundles.
These bundles are intended for bootstrapping common development & testing environments and should not be used for production. They also serve as examples to create custom bundles.

- [k3d-core](./bundles/k3d-core/README.md): A bundle to create a local k3d cluster with UDS Core installed.

Expand Down
13 changes: 13 additions & 0 deletions jest.setup.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
const { K8s, kind } = require("kubernetes-fluent-client");

module.exports = async () => {
await K8s(kind.Namespace).Apply({
metadata: {
name: "policy-tests",
labels: {
"istio-injection": "disabled",
"zarf.dev/agent": "ignore",
},
},
});
}
5 changes: 5 additions & 0 deletions jest.teardown.js
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
const { K8s, kind } = require("kubernetes-fluent-client");

module.exports = async () => {
await K8s(kind.Namespace).Delete("policy-tests");
}
Loading