Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add ability to convert K8s Obj to PSP #29

Merged
merged 1 commit into from
Oct 15, 2019
Merged

Conversation

mstemm
Copy link
Collaborator

@mstemm mstemm commented Oct 11, 2019

Add the ability to convert a single K8s Object to a Pod Security Policy,
instead of reading all objects from a live cluster.

  • Add spf13/cobra to add subcommands "inspect", which covers the
    existing functionality, and "convert", which converts a single K8s
    Object as a yaml file.

  • Move the code that generates a PodSecurityPolicy from lists of
    ContainerSecuritySpec/PodSecuritySpec to a standalone package in
    generator/generator.go. It only has a few minor changes:

    • It has a struct so it's more like an object than a standalone
      function.

    • The provided service account is optional. When not provided
      e.g. nil, "secret" is always added as an allowed volume type.

    • When used by the converter, the namespace and serverGitVersion
      are set to default values "default" and "v1.11", which allows
      enforcement of ReadOnly filesystems.

  • Error handling at the top level is done by log.Fatalf instead of
    panic(), to make problems like incorrect arguments a bit more
    graceful.

  • Add logging at least for the conversion path, showing the files that
    are read and written at debug level.

@Kaizhe
Copy link
Contributor

Kaizhe commented Oct 12, 2019

@mstemm it looks good to me, could you please also update the README.MD file and provides the example with the new capability as well? Thanks!

@Kaizhe Kaizhe self-requested a review October 14, 2019 22:09
Copy link
Contributor

@Kaizhe Kaizhe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please update the README.MD file as well.

kube-psp-advisor.go Outdated Show resolved Hide resolved
Copy link
Contributor

@Kaizhe Kaizhe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Just a minor question, lgtm

Add the ability to convert a single K8s Object to a Pod Security Policy,
instead of reading all objects from a live cluster.

 - Add spf13/cobra to add subcommands "inspect", which covers the
   existing functionality, and "convert", which converts a single K8s
   Object as a yaml file.

 - Move the code that generates a PodSecurityPolicy from lists of
   ContainerSecuritySpec/PodSecuritySpec to a standalone package in
   generator/generator.go. It only has a few minor changes:

      - It has a struct so it's more like an object than a standalone
        function.

      - The provided service account is optional. When not provided
        e.g. nil, "secret" is always added as an allowed volume type.

      - When used by the converter, the namespace and serverGitVersion
        are set to default values "default" and "v1.11", which allows
        enforcement of ReadOnly filesystems.

 - Error handling at the top level is done by log.Fatalf instead of
   panic(), to make problems like incorrect arguments a bit more
   graceful.

 - Add logging at least for the conversion path, showing the files that
   are read and written at debug level.
@mstemm mstemm force-pushed the allow-psp-gen-files branch from 4b19f5f to cc6425d Compare October 15, 2019 18:31
@mstemm mstemm merged commit 4908523 into master Oct 15, 2019
@mstemm mstemm deleted the allow-psp-gen-files branch October 15, 2019 18:34
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants