Add GATEKEEPER.md for a guide on enforcing use of Kata Containers #432
Conversation
This commit adds GATEKEEPER.md to the docs directory and example yaml manifests to config/sample/gatekeeper. The document provides a step-by-step guide on using OpenShift Gatekeeper to enforce policies that require privileged pods to use Kata Containers. Reasons to include this in the repository: Kata Containers enhance isolation for sensitive workloads. This guide helps users implement and enforce their use through Gatekeeper policies. By including this, we aim to: 1. Educate users with clear instructions on enforcing security policies. 2. Promote best practices for securing Kubernetes environments. 3. Improve usability by offering a structured, practical example. Structure 1. Constraint Template: Steps to create and apply. 2. Constraint: Instructions to create and apply. 3. Pod Manifest: Example for testing. 4. Compliance*: How to verify. This document enhances the repository by providing practical guidance on using Kata Containers with Gatekeeper. Signed-off-by: Jens Freimann <[email protected]>
openshift-ci
bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
| match: | ||
| kinds: | ||
| - apiGroups: [""] | ||
| kinds: ["Pod"] |
There was a problem hiding this comment.
Should this also apply to higher level objects like Deployments etc, or creating the policy for Pod automatically applies it to higher level constructs that uses Pod (eg. Deployments, Replicasets etc) ?
|
Issues go stale after 90d of inactivity. Mark the issue as fresh by commenting If this issue is safe to close now please do so with /lifecycle stale |
openshift-ci
bot
added
the
lifecycle/stale
|
Stale issues rot after 30d of inactivity. Mark the issue as fresh by commenting If this issue is safe to close now please do so with /lifecycle rotten |
openshift-ci
bot
added
lifecycle/rotten
- What I did
This commit adds GATEKEEPER.md to the docs directory and example yaml
manifests to config/sample/gatekeeper. The document
provides a step-by-step guide on using OpenShift Gatekeeper to enforce
policies that require privileged pods to use Kata Containers.
- Description of the problem which is fixed/What is the use case
Reasons to include this in the repository:
Kata Containers enhance isolation for sensitive workloads. This guide
helps users implement and enforce their use through Gatekeeper policies.
By including this, we aim to:
Structure
This document enhances the repository by providing practical guidance on
using Kata Containers with Gatekeeper.
- How to verify it
Read it and try it out.
Signed-off-by: Jens Freimann [email protected]