Add blog about CEL admission control library #40174

craigbox · 2023-03-21T02:40:32Z

This blog post introduces a library of Validating Admission Policies built by converting Kubescape controls from Rego to CEL.

craigbox · 2023-03-21T02:40:50Z

/assign sftim

netlify · 2023-03-21T02:51:41Z

✅ Pull request preview available for checking

Built without sensitive environment variables

Name	Link
🔨 Latest commit	`934feaa`
🔍 Latest deploy log	https://app.netlify.com/sites/kubernetes-io-main-staging/deploys/64238584ee9c1400084822a4
😎 Deploy Preview	https://deploy-preview-40174--kubernetes-io-main-staging.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify site settings.

craigbox · 2023-03-24T01:41:21Z

/unassign sftim

sftim

Hi @craigbox

I'm short on capacity to help with optional work - this article included. If you can pick a new future date and find a SIG API Machinery tech reviewer, we / I should be able to do the actual approve.

We'd like the publication date to be in the future at the date we merge. Try the 5th of April?

content/en/blog/_posts/2023-03-23-kubescape-validating-admission-policy-library.md

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md

jpbetz · 2023-03-29T00:28:48Z

/lgtm
For technical content. Thanks for the feature feedback and blog post @craigbox!

k8s-ci-robot · 2023-03-29T00:28:56Z

LGTM label has been added.

Git tree hash: 883ec0ef1bf4e52e76357a0cdd2855f36e8373d7

craigbox · 2023-03-29T00:31:14Z

@sftim / @nate-double-u / @onlydole - when you're ready, please lmk if we can bring the publication date forward, I took a week in the future as suggestion

sftim

Thanks!

Enough nits here that I'd welcome a follow-up PR, that we merge in before the publication date.
We can publish this as is; it's nice to leave a more maintainable article in the repo if we can.

/approve
/lgtm

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md

sftim · 2023-03-29T08:35:12Z

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md

+
+## Giving CEL a roll - a practical example
+
+[Kubescape](https://github.com/kubescape/kubescape) is a CNCF project which has become one of the most popular ways for users to improve the security posture of a Kubernetes cluster and validate its compliance. [Its controls](https://github.com/kubescape/regolibrary) — groups of tests against API objects — are built in [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/), the policy language of Open Policy Agent.


Suggested change

[Kubescape](https://github.com/kubescape/kubescape) is a CNCF project which has become one of the most popular ways for users to improve the security posture of a Kubernetes cluster and validate its compliance. [Its controls](https://github.com/kubescape/regolibrary) — groups of tests against API objects — are built in [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/), the policy language of Open Policy Agent.

[Kubescape](https://github.com/kubescape/kubescape) is a CNCF project which has become one of the most popular ways for users to improve the security posture of a Kubernetes cluster and validate its compliance. Its [controls](https://github.com/kubescape/regolibrary) — groups of tests against API objects — are built in [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/), the policy language of Open Policy Agent.

sftim · 2023-03-29T08:35:42Z

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md

+
+[Kubescape](https://github.com/kubescape/kubescape) is a CNCF project which has become one of the most popular ways for users to improve the security posture of a Kubernetes cluster and validate its compliance. [Its controls](https://github.com/kubescape/regolibrary) — groups of tests against API objects — are built in [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/), the policy language of Open Policy Agent.
+
+Rego has a reputation for complexity, based largely on the fact that it is a declarative query language (like SQL). It [was considered](https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/2876-crd-validation-expression-language/README.md#alternatives) for use in Kubernetes, but it does not offer the same sandbox constraints as CEL.


nit: better to link to a commit and not master (more link a permalink)

sftim · 2023-03-29T08:36:11Z

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md

+
+### Show me the policy
+
+It did not take us long to convert many of our controls and build [a library of validating admission policies.](https://github.com/kubescape/cel-admission-library) Let’s look at one as an example.


Suggested change

It did not take us long to convert many of our controls and build [a library of validating admission policies.](https://github.com/kubescape/cel-admission-library) Let’s look at one as an example.

It did not take us long to convert many of our controls and build a [library of validating admission policies](https://github.com/kubescape/cel-admission-library). Let’s look at one as an example.

sftim · 2023-03-29T08:36:36Z

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md

+
+It did not take us long to convert many of our controls and build [a library of validating admission policies.](https://github.com/kubescape/cel-admission-library) Let’s look at one as an example.
+
+[Kubescape’s control C-0017](https://hub.armosec.io/docs/c-0017) covers the requirement for containers to have an immutable (read-only) root filesystem. This is a best practice according to the [NSA Kubernetes hardening guidelines](https://kubernetes.io/blog/2021/10/05/nsa-cisa-kubernetes-hardening-guidance/#immutable-container-filesystems), but is not currently required as a part of any of the [pod security standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/).


Suggested change

[Kubescape’s control C-0017](https://hub.armosec.io/docs/c-0017) covers the requirement for containers to have an immutable (read-only) root filesystem. This is a best practice according to the [NSA Kubernetes hardening guidelines](https://kubernetes.io/blog/2021/10/05/nsa-cisa-kubernetes-hardening-guidance/#immutable-container-filesystems), but is not currently required as a part of any of the [pod security standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/).

Kubescape’s [control C-0017](https://hub.armosec.io/docs/c-0017) covers the requirement for containers to have an immutable (read-only) root filesystem. This is a best practice according to the [NSA Kubernetes hardening guidelines](/blog/2021/10/05/nsa-cisa-kubernetes-hardening-guidance/#immutable-container-filesystems), but is not currently required as a part of any of the [pod security standards](/docs/concepts/security/pod-security-standards/).

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md

sftim · 2023-03-29T08:42:08Z

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md

+# Install configuration CRD
+kubectl apply -f https://github.com/kubescape/cel-admission-library/releases/latest/download/policy-configuration-definition.yaml
+# Install basic configuration
+kubectl apply -f https://github.com/kubescape/cel-admission-library/releases/latest/download/basic-control-configuration.yaml
+# Install policies
+kubectl apply -f https://github.com/kubescape/cel-admission-library/releases/latest/download/kubescape-validating-admission-policies.yaml


nit: can we use a stable link that will work even after these are updated to work with v1.27?

I don't expect them to change, but I'm happy to update the blog post in future if needed to fix.

We're planning a release next month, that won't work with those manifests.

I knew there were some changes in this API in 1.27, but I didn't see that any were breaking?
Do you know why these manifests won't work with 1.27?

New API version, IIRC (v1alpha2).

I will update the repository to support v1alpha2. What is the ETA of this blog?

The only version remained v1alpha1 in 1.27 because there was no breaking change. See https://github.com/kubernetes/api/blob/v0.27.0-rc.0/admissionregistration/v1alpha1/types.go

Sorry, got my KEPs mixed up.

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md

sftim · 2023-03-29T08:43:24Z

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md

Please wrap lines at around 100 characters. That wrapping helps localization teams.

k8s-ci-robot · 2023-03-29T08:45:02Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: sftim

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~content/en/blog/OWNERS~~ [sftim]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Add blog about CEL admission control library

5a73f20

k8s-ci-robot added area/blog Issues or PRs related to the Kubernetes Blog subproject cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. labels Mar 21, 2023

k8s-ci-robot requested review from nate-double-u and onlydole March 21, 2023 02:40

k8s-ci-robot added language/en Issues or PRs related to English language sig/docs Categorizes an issue or PR as relevant to SIG Docs. size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Mar 21, 2023

k8s-ci-robot assigned sftim Mar 21, 2023

k8s-ci-robot unassigned sftim Mar 24, 2023

sftim reviewed Mar 27, 2023

View reviewed changes

k8s-ci-robot added the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Mar 27, 2023

Comb nits for Tim

2813376

craigbox force-pushed the cel-blog branch from 0428e57 to 2813376 Compare March 27, 2023 08:56

k8s-ci-robot removed the do-not-merge/invalid-commit-message Indicates that a PR should not merge because it has an invalid commit message. label Mar 27, 2023

jpbetz reviewed Mar 28, 2023

View reviewed changes

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md Outdated Show resolved Hide resolved

jpbetz reviewed Mar 28, 2023

View reviewed changes

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md Show resolved Hide resolved

jiahuif reviewed Mar 28, 2023

View reviewed changes

content/en/blog/_posts/2023-04-05-kubescape-validating-admission-policy-library.md Show resolved Hide resolved

craigbox added 2 commits March 29, 2023 13:23

Add changes from tech review

96bae60

slight rewording

934feaa

k8s-ci-robot assigned jpbetz Mar 29, 2023

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Mar 29, 2023

sftim reviewed Mar 29, 2023

View reviewed changes

k8s-ci-robot assigned sftim Mar 29, 2023

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Mar 29, 2023

k8s-ci-robot merged commit e19b954 into kubernetes:main Mar 29, 2023

craigbox deleted the cel-blog branch March 29, 2023 08:49

This was referenced Mar 29, 2023

Bring forward article "Kubernetes Validating Admission Policies: A Practical Example" / fix nits #40392

Merged

Add a label on each policy with their control number kubescape/cel-admission-library#40

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add blog about CEL admission control library #40174

Add blog about CEL admission control library #40174

craigbox commented Mar 21, 2023

craigbox commented Mar 21, 2023

netlify bot commented Mar 21, 2023 •

edited

craigbox commented Mar 24, 2023

sftim left a comment

jpbetz commented Mar 29, 2023

k8s-ci-robot commented Mar 29, 2023

craigbox commented Mar 29, 2023

sftim left a comment

sftim Mar 29, 2023

sftim Mar 29, 2023

sftim Mar 29, 2023

sftim Mar 29, 2023

sftim Mar 29, 2023

craigbox Mar 29, 2023

sftim Mar 29, 2023

craigbox Mar 29, 2023

sftim Mar 29, 2023

slashben Mar 29, 2023

jiahuif Mar 29, 2023

sftim Mar 29, 2023

sftim Mar 29, 2023

k8s-ci-robot commented Mar 29, 2023


		## Giving CEL a roll - a practical example

		[Kubescape](https://github.com/kubescape/kubescape) is a CNCF project which has become one of the most popular ways for users to improve the security posture of a Kubernetes cluster and validate its compliance. [Its controls](https://github.com/kubescape/regolibrary) — groups of tests against API objects — are built in [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/), the policy language of Open Policy Agent.


		[Kubescape](https://github.com/kubescape/kubescape) is a CNCF project which has become one of the most popular ways for users to improve the security posture of a Kubernetes cluster and validate its compliance. [Its controls](https://github.com/kubescape/regolibrary) — groups of tests against API objects — are built in [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/), the policy language of Open Policy Agent.

		Rego has a reputation for complexity, based largely on the fact that it is a declarative query language (like SQL). It [was considered](https://github.com/kubernetes/enhancements/blob/master/keps/sig-api-machinery/2876-crd-validation-expression-language/README.md#alternatives) for use in Kubernetes, but it does not offer the same sandbox constraints as CEL.


		### Show me the policy

		It did not take us long to convert many of our controls and build [a library of validating admission policies.](https://github.com/kubescape/cel-admission-library) Let’s look at one as an example.


		It did not take us long to convert many of our controls and build [a library of validating admission policies.](https://github.com/kubescape/cel-admission-library) Let’s look at one as an example.

		[Kubescape’s control C-0017](https://hub.armosec.io/docs/c-0017) covers the requirement for containers to have an immutable (read-only) root filesystem. This is a best practice according to the [NSA Kubernetes hardening guidelines](https://kubernetes.io/blog/2021/10/05/nsa-cisa-kubernetes-hardening-guidance/#immutable-container-filesystems), but is not currently required as a part of any of the [pod security standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/).

Add blog about CEL admission control library #40174

Add blog about CEL admission control library #40174

Conversation

craigbox commented Mar 21, 2023

craigbox commented Mar 21, 2023

netlify bot commented Mar 21, 2023 • edited

✅ Pull request preview available for checking

craigbox commented Mar 24, 2023

sftim left a comment

Choose a reason for hiding this comment

jpbetz commented Mar 29, 2023

k8s-ci-robot commented Mar 29, 2023

craigbox commented Mar 29, 2023

sftim left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

k8s-ci-robot commented Mar 29, 2023

netlify bot commented Mar 21, 2023 •

edited