Skip to content

Commit c3560f0

Browse files
butler54butler54
authored
feat: update policy customization to support OSC 1.9.0 and have editable policy files (#43)
Signed-off-by: Chris Butler <chris.butler@redhat.com>
1 parent 296e83b commit c3560f0

5 files changed

Lines changed: 41 additions & 34 deletions

File tree

‎charts/coco-supported/hello-openshift/insecure-policy.rego‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
package agent_policy
2+
3+
default AddARPNeighborsRequest := true
4+
default AddSwapRequest := true
5+
default CloseStdinRequest := true
6+
default CopyFileRequest := true
7+
default CreateContainerRequest := true
8+
default CreateSandboxRequest := true
9+
default DestroySandboxRequest := true
10+
default ExecProcessRequest := true
11+
default GetMetricsRequest := true
12+
default GetOOMEventRequest := true
13+
default GuestDetailsRequest := true
14+
default ListInterfacesRequest := true
15+
default ListRoutesRequest := true
16+
default MemHotplugByProbeRequest := true
17+
default OnlineCPUMemRequest := true
18+
default PauseContainerRequest := true
19+
default PullImageRequest := true
20+
default ReadStreamRequest := true
21+
default RemoveContainerRequest := true
22+
default RemoveStaleVirtiofsShareMountsRequest := true
23+
default ReseedRandomDevRequest := true
24+
default ResumeContainerRequest := true
25+
default SetGuestDateTimeRequest := true
26+
default SetPolicyRequest := true
27+
default SignalProcessRequest := true
28+
default StartContainerRequest := true
29+
default StartTracingRequest := true
30+
default StatsContainerRequest := true
31+
default StopTracingRequest := true
32+
default TtyWinResizeRequest := true
33+
default UpdateContainerRequest := true
34+
default UpdateEphemeralMountsRequest := true
35+
default UpdateInterfaceRequest := true
36+
default UpdateRoutesRequest := true
37+
default WaitProcessRequest := true
38+
default WriteStreamRequest := true

‎charts/coco-supported/hello-openshift/templates/insecure-policy-pod.yaml‎

Lines changed: 1 addition & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,7 @@ metadata:
55
labels:
66
app: insecure-policy
77
annotations:
8-
io.katacontainers.config.runtime.cc_init_data: YWxnb3JpdGhtID0gInNoYTM4NCIKdmVyc2lvbiA9ICIwLjEuMCIKCltkYXRhXQoiYWEudG9tbCIgPSAnJycKW3Rva2VuX2NvbmZpZ3NdClt0b2tlbl9jb25maWdzLmNvY29fYXNdCnVybCA9ICJodHRwczovL2ticy10cnVzdGVlLW9wZXJhdG9yLXN5c3RlbS5hcHBzLmNvY28uaDdnZHEuYXp1cmUucmVkaGF0d29ya3Nob3BzLmlvIgoKW3Rva2VuX2NvbmZpZ3Mua2JzXQp1cmwgPSAiaHR0cHM6Ly9rYnMtdHJ1c3RlZS1vcGVyYXRvci1zeXN0ZW0uYXBwcy5jb2NvLmg3Z2RxLmF6dXJlLnJlZGhhdHdvcmtzaG9wcy5pbyIKJycnCgoiY2RoLnRvbWwiICA9ICcnJwpzb2NrZXQgPSAndW5peDovLy9ydW4vY29uZmlkZW50aWFsLWNvbnRhaW5lcnMvY2RoLnNvY2snCmNyZWRlbnRpYWxzID0gW10KCltrYmNdCm5hbWUgPSAiY2Nfa2JjIgp1cmwgPSAiaHR0cHM6Ly9rYnMtdHJ1c3RlZS1vcGVyYXRvci1zeXN0ZW0uYXBwcy5jb2NvLmg3Z2RxLmF6dXJlLnJlZGhhdHdvcmtzaG9wcy5pbyIKJycn
9-
io.katacontainers.config.agent.policy: cGFja2FnZSBhZ2VudF9wb2xpY3kKCmRlZmF1bHQgQWRkQVJQTmVpZ2hib3JzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgQWRkU3dhcFJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IENsb3NlU3RkaW5SZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBDb3B5RmlsZVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IENyZWF0ZUNvbnRhaW5lclJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IENyZWF0ZVNhbmRib3hSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBEZXN0cm95U2FuZGJveFJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IEV4ZWNQcm9jZXNzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgR2V0TWV0cmljc1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IEdldE9PTUV2ZW50UmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgR3Vlc3REZXRhaWxzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgTGlzdEludGVyZmFjZXNSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBMaXN0Um91dGVzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgTWVtSG90cGx1Z0J5UHJvYmVSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBPbmxpbmVDUFVNZW1SZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBQYXVzZUNvbnRhaW5lclJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFB1bGxJbWFnZVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFJlYWRTdHJlYW1SZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBSZW1vdmVDb250YWluZXJSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBSZW1vdmVTdGFsZVZpcnRpb2ZzU2hhcmVNb3VudHNSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBSZXNlZWRSYW5kb21EZXZSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBSZXN1bWVDb250YWluZXJSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBTZXRHdWVzdERhdGVUaW1lUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgU2V0UG9saWN5UmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgU2lnbmFsUHJvY2Vzc1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFN0YXJ0Q29udGFpbmVyUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgU3RhcnRUcmFjaW5nUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgU3RhdHNDb250YWluZXJSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBTdG9wVHJhY2luZ1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFR0eVdpblJlc2l6ZVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFVwZGF0ZUNvbnRhaW5lclJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFVwZGF0ZUVwaGVtZXJhbE1vdW50c1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFVwZGF0ZUludGVyZmFjZVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFVwZGF0ZVJvdXRlc1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFdhaXRQcm9jZXNzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgV3JpdGVTdHJlYW1SZXF1ZXN0IDo9IHRydWUK
8+
io.katacontainers.config.agent.policy: '{{ tpl ( .Files.Get "insecure-policy.rego") . | b64enc }}'
109
spec:
1110
runtimeClassName: kata-remote
1211
containers:
@@ -26,23 +25,3 @@ spec:
2625
type: RuntimeDefault
2726

2827
---
29-
# apiVersion: v1
30-
# kind: Pod
31-
# metadata:
32-
# name: skr-openshift
33-
# labels:
34-
# app: skr-openshift
35-
# annotations:
36-
# io.katacontainers.config.agent.policy: cGFja2FnZSBhZ2VudF9wb2xpY3kKCmRlZmF1bHQgQWRkQVJQTmVpZ2hib3JzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgQWRkU3dhcFJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IENsb3NlU3RkaW5SZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBDb3B5RmlsZVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IENyZWF0ZUNvbnRhaW5lclJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IENyZWF0ZVNhbmRib3hSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBEZXN0cm95U2FuZGJveFJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IEV4ZWNQcm9jZXNzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgR2V0TWV0cmljc1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IEdldE9PTUV2ZW50UmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgR3Vlc3REZXRhaWxzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgTGlzdEludGVyZmFjZXNSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBMaXN0Um91dGVzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgTWVtSG90cGx1Z0J5UHJvYmVSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBPbmxpbmVDUFVNZW1SZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBQYXVzZUNvbnRhaW5lclJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFB1bGxJbWFnZVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFJlYWRTdHJlYW1SZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBSZW1vdmVDb250YWluZXJSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBSZW1vdmVTdGFsZVZpcnRpb2ZzU2hhcmVNb3VudHNSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBSZXNlZWRSYW5kb21EZXZSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBSZXN1bWVDb250YWluZXJSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBTZXRHdWVzdERhdGVUaW1lUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgU2V0UG9saWN5UmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgU2lnbmFsUHJvY2Vzc1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFN0YXJ0Q29udGFpbmVyUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgU3RhcnRUcmFjaW5nUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgU3RhdHNDb250YWluZXJSZXF1ZXN0IDo9IHRydWUKZGVmYXVsdCBTdG9wVHJhY2luZ1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFR0eVdpblJlc2l6ZVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFVwZGF0ZUNvbnRhaW5lclJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFVwZGF0ZUVwaGVtZXJhbE1vdW50c1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFVwZGF0ZUludGVyZmFjZVJlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFVwZGF0ZVJvdXRlc1JlcXVlc3QgOj0gdHJ1ZQpkZWZhdWx0IFdhaXRQcm9jZXNzUmVxdWVzdCA6PSB0cnVlCmRlZmF1bHQgV3JpdGVTdHJlYW1SZXF1ZXN0IDo9IHRydWUK
37-
# spec:
38-
# runtimeClassName: kata-remote
39-
# containers:
40-
# - name: skr-openshift
41-
# image: registry.access.redhat.com/ubi9/ubi:9.3
42-
# command:
43-
# - sleep
44-
# - "36000"
45-
# securityContext:
46-
# privileged: false
47-
# seccompProfile:
48-
# type: RuntimeDefault

‎charts/coco-supported/sandbox/templates/peer-pods-cm.yaml‎

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,16 +17,6 @@ spec:
1717
remediationAction: enforce
1818
severity: medium
1919
object-templates:
20-
# this doesn't work
21-
# - complianceType: musthave
22-
# objectDefinition:
23-
# apiVersion: v1
24-
# kind: ConfigMap
25-
# metadata:
26-
# name: peer-pods-cm
27-
# namespace: openshift-sandboxed-containers-operator
28-
# data:
29-
# AZURE_IMAGE_ID: "" # This will get rewritten when the image is built
3020

3121
- complianceType: mustonlyhave
3222
objectDefinition:

‎rhdp/wrapper.sh‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@ sleep 10
4444
echo "---------------------"
4545
echo "Installing python dependencies"
4646
echo "---------------------"
47-
pip3 install -r rhdp/requirements.txt
47+
pip install -r rhdp/requirements.txt
4848
echo "---------------------"
4949
echo "requirements installed"
5050
echo "---------------------"

‎values-simple.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ clusterGroup:
9595
# Default to 'safe' for ARO
9696
overrides:
9797
- name: letsencrypt.enabled
98-
value: true
98+
value: false
9999
hello-openshift:
100100
name: hello-openshift
101101
namespace: hello-openshift

0 commit comments

Comments
 (0)