-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
1 changed file
with
3 additions
and
43 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -1,44 +1,4 @@ | ||
SELinux policy helper operator | ||
============================== | ||
DEPRECATED | ||
========== | ||
|
||
This is a controller that listens to all pods in the system. | ||
|
||
It will attempt to generate a policy for pods when the pod is annotated with | ||
a specific tag "generate-selinux-policy" and the pod is in a running | ||
state. | ||
|
||
It is also possible to annotate a namespace itself, this will try to generate a | ||
policy for each pod running on it. | ||
|
||
In order to generate the policy, it spawns a pod with the selinux-k8s | ||
tool which uses udica to generate the policy. It will spit out a | ||
configmap with the appropriate policy. | ||
|
||
The link to the tool is the following: | ||
|
||
https://github.com/JAORMX/selinux-k8s | ||
|
||
Note that this now requires the selinux-operator to be installed: | ||
|
||
https://github.com/JAORMX/selinux-operator | ||
|
||
Instructions | ||
------------ | ||
|
||
Install the selinux-operator with the instructions from that repository. | ||
|
||
Create assets in cluster: | ||
|
||
``` | ||
oc create -f deploy/ | ||
``` | ||
|
||
Demo | ||
---- | ||
|
||
[![asciicast](https://asciinema.org/a/295362.svg)](https://asciinema.org/a/295362) | ||
|
||
TODO | ||
---- | ||
|
||
- [ ] Allow passing extra capabilities as annotations. | ||
This project has been deprecated in favor of the [Security Profiles Operator](https://github.com/kubernetes-sigs/security-profiles-operator) |