-
Notifications
You must be signed in to change notification settings - Fork 18
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: pre core exemption handling #311
Conversation
For testing manually:
|
example bundle using CRD package: kind: UDSBundle
metadata:
name: example CRD
packages:
- name: exemption-crd
repository: ghcr.io/defenseunicorns/...
ref: 0.20.0
- name: init
repository: ghcr.io/defenseunicorns/packages/init
# renovate: datasource=github-tags depName=defenseunicorns/zarf versioning=semver
ref: v0.33.1
# has UDS Exemption CR
- name: test-podinfo
path: ../../build/
ref: 0.1.0
- name: core-slim-dev
path: ../../build/
ref: 0.20.0 example bundle using helm overrides: kind: UDSBundle
metadata:
name: example helm overrides
packages:
- name: init
repository: ghcr.io/defenseunicorns/packages/init
# renovate: datasource=github-tags depName=defenseunicorns/zarf versioning=semver
ref: v0.33.1
# UDS Exemption CR does not live here but is passed to core
- name: test-podinfo
path: ../../build/
ref: 0.1.0
- name: core-slim-dev
path: ../../build/
# x-release-please-start-version
ref: 0.20.0
# x-release-please-end
overrides:
pre-core-exemptions:
pre-core-exemptions:
values:
- path: enabled
value: true
- path: exemptions
value: |
exemptions:
- policies:
- DisallowPrivileged
- RequireNonRootUser
- DropAllCapabilities
title: "podinfo1"
matcher:
namespace: podinfo
name: "^podinfo.*"
test: 1
- policies:
- DisallowNodePortServices
title: "podinfo2"
matcher:
namespace: podinfo
name: "^.*-local.*"
kind: service
test: 2 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hopefully small comments overall - I think this is a good 2-pronged approach to provide solves for this issue.
Going to close this PR for now - we need to reevaluate if there's still a need here and how to prioritize if there is. Noting that there are a few known ways to accomplish exemptions for things that come before core:
|
Description
Introducing a UDS Exemption CRD package, which allows for applying UDSExemption CRs before uds-core has deployed.
Also, integrating a uds-core scoped pre-core-exemption chart that allows users to pass exemptions (for things that might exist pre-core) through their bundle.
Related Issue
resolves #272
Type of change
Checklist before merging