Add PSP constraints and CTs to library

[ritazh]

Signed-off-by: Rita Zhang rita.z.zhang@gmail.com

Adding the PSP constraints and constraint templates to the library folder until we have the gatekeeper-library repo available per community call on August 6th.

Thank you @sozercan for your contribution!

cc @timothyhinrichs @teq0

[timothyhinrichs]

Very cool Rita! It'll take a long while to go through these in detail. I wonder if we should just get them into the repo so we've got something to build on. Would you say these are all ready to go live, or are they more experimental in terms of say test-coverage?

A couple highlevel thoughts...

• I was going to ask whether we want to commit the ConstraintTemplates into the repo, but we need that metadata somewhere, and we don't have the tooling yet to generate them from Rego + Metadata. So I think it makes sense to commit them now and refactor later, if needed.

• The directory name could be something like just psp or pod-security-policy. Obviously a nit that could be adjusted later.

[ritazh]

Would you say these are all ready to go live, or are they more experimental in terms of say test-coverage?

We have tested these with opa test --coverage as well as in a k8s cluster. The lowest coverage right now is at 94.45, most are at 100. You can see the test coverage by running make test in /library/pod-security-policy/. Please LMK if there are other forms of tests I need to run to validate them.

I wonder if we should just get them into the repo so we've got something to build on

I would really love some review on these regos if possible. I'm afraid once these are merged, we might not have time to come back to them. WDYT? We have 10 policies now, maybe each reviewer can take 3? between @maxsmythe @teq0 @timothyhinrichs Would that work?

[timothyhinrichs]

I looked at the first 3: allow-privilege-escalation, flexvolume-drivers, fsgroup

[timothyhinrichs]

Looked at a couple more.

[timothyhinrichs]

Finished review of the whole thing

[timothyhinrichs]

Just nits. Overall, consistent and clean rego code. Nice work!

[ritazh]

Thanks for the review @timothyhinrichs! Merging per this week's GK weekly call.