Skip to content

Commit

Permalink
docs: update genpolicy docs
Browse files Browse the repository at this point in the history
Fix CI failure for genpolicy docs.

Signed-off-by: Dan Mihai <dmihai@microsoft.com>
  • Loading branch information
danmihai1 committed Nov 14, 2023
1 parent 2257a16 commit 0b3cb31
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 5 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -75,7 +75,7 @@ $ genpolicy -b -y test.yaml

# Use a custom `genpolicy` settings file

The default `genpolicy` settings file is `./genpolicy-settings.json`. See [`genpolicy` settings](genpolicy-settings.md) for additional information. Users can specify in the command line a different settings file by using the `-j` parameter - e.g.,
The default `genpolicy` settings file is `./genpolicy-settings.json`. Users can specify in the command line a different settings file by using the `-j` parameter - e.g.,

```bash
$ genpolicy -j my-settings.json -y test.yaml
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ package agent_policy

For an introduction to Policy default values, see [default values](../../../docs/how-to/how-to-use-the-kata-agent-policy.md#default-values).

`genpolicy` copies the default values from [`rules.rego`](rules.rego#L8) into the auto-generated Policy. Therefore, all Policies generated using the same `rules.rego` file are using the same default values.
`genpolicy` copies the default values from [`rules.rego`](rules.rego) into the auto-generated Policy. Therefore, all Policies generated using the same `rules.rego` file are using the same default values.

Some of the [ttRPC API](../../libs/protocols/protos/agent.proto) requests are always allowed by the auto-generated Policy. Those requests have a default value of `true` and there aren't any rules associated with them. Examples:

Expand All @@ -34,9 +34,9 @@ default CreateContainerRequest := false

## Rules

For an introduction to Policy rules, see [default values](../../../docs/how-to/#-use-the-kata-agent-policy.md#rules).
For an introduction to Policy rules, see [rules](../../../docs/how-to/how-to-use-the-kata-agent-policy.md#rules).

`genpolicy` copies the rules from [`rules.rego`](rules.rego#L37) into the auto-generated Policy. Therefore, all Policies generated using the same `rules.rego` file are using the same rules.
`genpolicy` copies the rules from [`rules.rego`](rules.rego) into the auto-generated Policy. Therefore, all Policies generated using the same `rules.rego` file are using the same rules.

For additional details about the `genpolicy` rules see [`genpolicy` rules details](#rules-details).

Expand Down Expand Up @@ -83,7 +83,7 @@ Therefore, by default the auto-generated Policy allows the Host to copy any file

## `CreateContainerRequest`

Most of the rules from [`rules.rego`](rules.rego#L37) are applicable to the `CreateContainer` request, because:
Most of the rules from [`rules.rego`](rules.rego) are applicable to the `CreateContainer` request, because:
1. The inputs of `CreateContainer` are very complex - e.g., see the Spec data structure from the [OCI protocol](../../libs/protocols/protos/oci.proto).
1. Those complex inputs could allow a buggy or malicious Host to alter the intended behavior of user's Kubernetes (K8s) pods.

Expand Down

0 comments on commit 0b3cb31

Please sign in to comment.