Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Install Open-policy-agent and create a ingress-conflicts policy. #242

Merged
merged 11 commits into from
Apr 12, 2019

Commits on Apr 8, 2019

  1. Resource helm_release.open-policy-agent created

    to deploy opa using default values from helm chart
    vijay-veeranki committed Apr 8, 2019
    Configuration menu
    Copy the full SHA
    1b8d55c View commit details
    Browse the repository at this point in the history
  2. Updated opa values.yaml

    * comment out line 7-13 to not use default policy
       provided in the bundle
    
    * enabled configmappolicies for namespace opa
      line 72-73
    
    * defined variables for the opa and kube-mgmt image tags
    vijay-veeranki committed Apr 8, 2019
    Configuration menu
    Copy the full SHA
    7828f7b View commit details
    Browse the repository at this point in the history
  3. Created null_resource.open-policy-agent_policies

    To apply opa policies under resources/opa
    vijay-veeranki committed Apr 8, 2019
    Configuration menu
    Copy the full SHA
    f3e5410 View commit details
    Browse the repository at this point in the history
  4. Configuration menu
    Copy the full SHA
    5c63fff View commit details
    Browse the repository at this point in the history
  5. Created configmap for default-system policy

    This applies a ConfigMap that contains the
    main OPA policy and default response.
    
    This policy is used as an entry-point for policy evaluations and returns allowed:true
    if policies are not matched to inbound data.
    vijay-veeranki committed Apr 8, 2019
    Configuration menu
    Copy the full SHA
    46e06ad View commit details
    Browse the repository at this point in the history
  6. Created a policy Ingress-conflicts

    This policy prevents Ingress objects in different
    namespaces from sharing the same hostname
    vijay-veeranki committed Apr 8, 2019
    Configuration menu
    Copy the full SHA
    1268429 View commit details
    Browse the repository at this point in the history
  7. Updated opa values.yaml.tpl file to get

    ingress-conflicts policy necessary restrictions/permissions
    
    * updated admissionControllerRules:
    line 26-29 to restrict the kinds of operations
    and resources that are subject to ingress-conflicts policy checks
    
    * mgmt/replicate:
    line 79-81 configured to pull resource
     metadata that needed for ingress-conflicts policy
    
    *rbac:
    line 113-139 ClusterRole permissions needed for ingress-conflicts policy
    vijay-veeranki committed Apr 8, 2019
    Configuration menu
    Copy the full SHA
    a50c883 View commit details
    Browse the repository at this point in the history

Commits on Apr 10, 2019

  1. Configuration menu
    Copy the full SHA
    6b962ae View commit details
    Browse the repository at this point in the history
  2. Configuration menu
    Copy the full SHA
    951277d View commit details
    Browse the repository at this point in the history

Commits on Apr 11, 2019

  1. Update ingress conflict policy

    Use := for assignment and == for equality. This makes the policy easier to read and is recommended practice. The
    previous policy would fail to run properly in the opa repl.
    
    Additionally, it removes the operation type check (redundant, we want to check both CREATE and UPDATE) which is set at
    the ValidatingWebhookConfig level. Also removes the namespace check (which invalidates the check for ingresses within
    the same namespace).
    alkar committed Apr 11, 2019
    Configuration menu
    Copy the full SHA
    7c7c416 View commit details
    Browse the repository at this point in the history
  2. Remove imageTag variables from opa values

    There is no need to override the values from terraform. Removing them makes maintainance easier since we don't need to
    remember to update those values and can rely on defaults.
    alkar committed Apr 11, 2019
    Configuration menu
    Copy the full SHA
    0601f82 View commit details
    Browse the repository at this point in the history