Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add support for policies groups #848

Open
jvanz opened this issue Aug 7, 2024 · 0 comments
Open

Add support for policies groups #848

jvanz opened this issue Aug 7, 2024 · 0 comments
Assignees
Labels
kind/enhancement New feature or request
Milestone

Comments

@jvanz
Copy link
Member

jvanz commented Aug 7, 2024

We are in the process of adding a new policy kind, the ClusterAdimissionPolicyGroups and AdmissionPolicyGroup. These new kinds allow users to group policy together and act as a single policy. More info about them can be found in the RFC. In a recent change, we add the new CRDs in the Kubewarden controller and we should update the UI to support it as well.

This is an example of a yaml file to deploy all the policy types together:

apiVersion: policies.kubewarden.io/v1
kind: ClusterAdmissionPolicyGroup
metadata:
  name: cluster-policy-group-hd83ybjz
spec:
  policyServer: default
  rules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["pods"]
      operations:
        - CREATE
        - UPDATE
  backgroundAudit: true
  policies:
    - name: pod-privileged
      url: ghcr.io/kubewarden/policies/pod-privileged:v0.3.1
      settings: {}
      contextAwareResources:
        - apiVersion: "v1"
          kind: "Pod"

  expression: "pod-privileged()"
  message: "The policy group is rejected."
---
apiVersion: policies.kubewarden.io/v1
kind: AdmissionPolicyGroup 
metadata:
  name: namespace-policy-group-hd83ybjz
  namespace: default
spec:
  policyServer: "default"
  rules:
    - apiGroups: [""]
      apiVersions: ["v1"]
      resources: ["pods"]
      operations:
        - CREATE
        - UPDATE
  backgroundAudit: true
  policies:
    - name: pod-privileged
      url: ghcr.io/kubewarden/policies/pod-privileged:v0.3.1
      settings: {}
      contextAwareResources:
        - apiVersion: "v1"
          kind: "Pod"

  expression: "pod-privileged()"
  message: "The policy group is rejected."
---
apiVersion: policies.kubewarden.io/v1
kind: ClusterAdmissionPolicy
metadata:
  name: pod-privileged
  namespace: kubewarden
spec:
  module: "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.2.7"
  policyServer: default
  settings: {}
  mode: monitor
  rules:
    - apiGroups: ["apps"]
      apiVersions: ["v1"]
      resources: ["deployment"]
      operations:
        - CREATE
        - UPDATE
  mutating: false
---
apiVersion: policies.kubewarden.io/v1
kind: AdmissionPolicy
metadata:
  name: pod-privileged
  namespace: kubewarden
spec:
  module: "registry://ghcr.io/kubewarden/policies/pod-privileged:v0.2.7"
  settings: {}
  mode: monitor
  policyServer: default
  rules:
    - apiGroups: ["apps"]
      apiVersions: ["v1"]
      resources: ["deployment"]
      operations:
        - CREATE
        - UPDATE
  mutating: false

Acceptance criteria

  • Allow the Kubewarden UI to properly display and manipulate the policy group CRDs
@jordojordo jordojordo self-assigned this Aug 7, 2024
@jordojordo jordojordo added the kind/enhancement New feature or request label Aug 7, 2024
@jordojordo jordojordo added this to the 2.0.x milestone Aug 7, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
kind/enhancement New feature or request
Projects
None yet
Development

No branches or pull requests

2 participants