feat: introduce Pepr common policies #50
Conversation
jeff-mccoy
changed the title
There was a problem hiding this comment.
I think there's definitely more to review here on the actual policy contents but wanted to comment here with an overarching issue on policies not being enforced.
I crafted malicious pods + services that should have been blocked by every single policy. What I found was that only the final policy for pods in networking (hostport) actually blocked the pod. The same was true for service, only the final policy for service in networking (nodeport) blocked the service. It appears as if only the final approve/deny for the pod actually affects the admission. Other policies that the pod violates showed as logs in pepr, but the pod/svc were still admitted. I did some testing to confirm and reordering policies in networking.ts changes what is actually enforced (always the last policy). I also modified the index.ts to change the import order and confirmed that the order of the imports has an effect on what is enforced.
TLDR: Last policy, in the last import in index.ts is the only one that gets properly enforced.
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
Co-authored-by: Micah Nagel <micah.nagel@defenseunicorns.com>
🤖 I have created a release *beep* *boop* --- ## [0.6.0](v0.5.0...v0.6.0) (2023-12-05) ### Features * introduce Pepr common policies ([#50](#50)) ([54182b4](54182b4)) ### Miscellaneous * conform to latest uds bundle schema ([#52](#52)) ([14dad38](14dad38)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
🤖 I have created a release *beep* *boop* --- ## [0.6.0](defenseunicorns/uds-core@v0.5.0...v0.6.0) (2023-12-05) ### Features * introduce Pepr common policies ([#50](defenseunicorns/uds-core#50)) ([54182b4](defenseunicorns/uds-core@54182b4)) ### Miscellaneous * conform to latest uds bundle schema ([#52](defenseunicorns/uds-core#52)) ([14dad38](defenseunicorns/uds-core@14dad38)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Description
Introduce Pepr Validations to replace Kyverno.
Type of change
Checklist before merging