Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: block jupyter download using export as #2

Merged
merged 2 commits into from
Aug 16, 2021
Merged

feat: block jupyter download using export as #2

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a526ef9
feat: block jupyter download using export as
wg102 Jul 13, 2021
40575dd
update gatekeeper-policies
wg102 Jul 27, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions deploy/deploy.yaml.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ spec:
- name: k8scc01covidacr-registry-connection
containers:
- name: notebook-auth-policy-checker
imagePullPolicy: IfNotPresent
image: k8scc01covidacr.azurecr.io/prob-notebook-controller:${IMAGE_SHA}
resources:
limits:
Expand Down
6 changes: 6 additions & 0 deletions kind/gatekeeper/constraint.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,3 +7,9 @@ spec:
kinds:
- apiGroups: [""]
kinds: ["Pod"]
labelSelector:
matchExpressions:
- key: data.statcan.gc.ca/classification
operator: In
values:
- protected-b
1 change: 0 additions & 1 deletion kind/gatekeeper/constraintTemplate.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ spec:
rego: |
package probauth
violation[{"msg": msg}] {
not input.review.object.metadata.labels["data.statcan.gc.ca/classification"] == "unclassified"
input.review.object.kind == "Pod"
ns := input.review.object.metadata.namespace
namePod := input.review.object.metadata.name
Expand Down
2 changes: 1 addition & 1 deletion kind/jupyter/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ prob: true
noprob: true
image:
image: jupyter/minimal-notebook
imagePullPolicy: Always
imagePullPolicy: IfNotPresent
command: ["jupyter"]
args:
- "notebook"
Expand Down
11 changes: 11 additions & 0 deletions pkg/controller/handler.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,23 +88,34 @@ func (c *Controller) generateAuthorizationPolicy(notebook *v1.Notebook)(*istiose
{
To: []*v1beta1.Rule_To{
{
//Rstudio upload
Operation: &v1beta1.Operation{
Methods: []string{"POST"},
Paths: []string{fmt.Sprintf("/notebook/%s/%s/rstudio/upload", notebook.Namespace, notebook.Name)},
},
},
{
//Rstudio download
Operation: &v1beta1.Operation{
Methods: []string{"GET"},
Paths: []string{fmt.Sprintf("/notebook/%s/%s/rstudio/export*", notebook.Namespace, notebook.Name)},
},
},
{
//Jupyter download
Operation: &v1beta1.Operation{
Methods: []string{"GET"},
Paths: []string{fmt.Sprintf("/notebook/%s/%s/files*", notebook.Namespace, notebook.Name)},
},
},
{
//Jupyter download - convert as
Operation: &v1beta1.Operation{
Methods: []string{"GET"},
Paths: []string{fmt.Sprintf("/notebook/%s/%s/nbconvert*", notebook.Namespace, notebook.Name)},
},
},
// VS Code download - handled by the image
},
},
},
Expand Down