podvm: allow setting custom agent-policy #434
Conversation
|
Tested this successfully by building a new image |
openshift-merge-robot
added
the
needs-rebase
openshift-merge-robot
removed
the
needs-rebase
snir911
force-pushed
the
agent_policyB
branch
2 times, most recently
from
7ce69eb to
e2d6db5
Compare
| if [[ "${AGENT_POLICY}" ]]; then | ||
| echo "Custom agent policy is being set through the AGENT_POLICY value" | ||
| echo ${AGENT_POLICY} | base64 -d > "${podvm_dir}"/files/etc/kata-opa/custom.rego | ||
| if [[ $? == 0 ]] && grep -q "agent_policy" "${podvm_dir}"/files/etc/kata-opa/custom.rego; then # checks policy validity |
There was a problem hiding this comment.
Isn't there a better way to validate the syntax than grepping ? Couldn't https://www.openpolicyagent.org/docs/latest/cli/#opa-check be used here ?
There was a problem hiding this comment.
right, my intention wasn't to actually validate the format rather to validate the output isn't ruined because of missing couple of characters when copied the encoded string.
This opa check is indeed an option, it will require to install the binary in the container, can certainly be done at future point.
by using relative path and disable ReadStreamRequest and ExecProcessRequest for CoCo by default Signed-off-by: Snir Sheriber <ssheribe@redhat.com>
by setting base64 encoded policy file string to the AGENT_POLICY key in the
<azure/aws-podvm>-image-cm ConfigMap
$ ENCODED_POLICY=$(cat allow-all-except-exec-process.rego | base64 -w 0)
$ kubectl patch cm aws-podvm-image-cm -p "{\"data\":{\"AGENT_POLICY\":\"${ENCODED_POLICY}\"}}" -n openshift-sandboxed-containers-operator
Signed-off-by: Snir Sheriber <ssheribe@redhat.com>
and example files Signed-off-by: Snir Sheriber <ssheribe@redhat.com>
to avoid unwanted printings Signed-off-by: Snir Sheriber <ssheribe@redhat.com>
|
@snir911: The following test failed, say
Full PR test history. Your PR dashboard. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
by having custom.rego file set as agent policy CM
kubectl create configmap agent-policy --from-file=<path/to/custom.rego> -n openshift-sandboxed-containers-operator
also use relative links is it essential when passed to packer
do not merge
I failed to test yet due to (probably) unaltered issues