Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add a wildcard option for volumes contained in AcceptedPods for Rules 2003 and 2008 #409

Conversation

georgibaltiev
Copy link
Contributor

@georgibaltiev georgibaltiev commented Dec 17, 2024

What this PR does / why we need it:
This PR contains a modification to the acceptedResources handling in Rules 2003 and 2008 of the Security Hardened Kubernetes Ruleset by adding the option to accept all volumes in an accepted pod by using a wildcard.

Which issue(s) this PR fixes:
Fixes #407

Special notes for your reviewer:

Release note:

Accepted volume names for rules 2003 and 2008 of the Security Hardened Kubernetes Ruleset can be generalized by using a wildcard in the configuration.

@georgibaltiev georgibaltiev requested a review from a team as a code owner December 17, 2024 07:41
@gardener-robot gardener-robot added needs/review Needs review size/s Size of pull request is small (see gardener-robot robot/bots/size.py) labels Dec 17, 2024
@gardener-robot-ci-2 gardener-robot-ci-2 added reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) and removed reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) labels Dec 17, 2024
Copy link
Member

@dimityrmirchev dimityrmirchev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please also add the proper example in the sample configuration file

@gardener-robot gardener-robot added the needs/changes Needs (more) changes label Dec 17, 2024
@georgibaltiev
Copy link
Contributor Author

I will push the guide change to #406 to avoid merge conflicts later on.

@dimityrmirchev
Copy link
Member

I am not sure what you mean. I mean having the new wildcard value shown here

On a similar note I think that we should also do the same changes for rule 2008. WDYT?

@georgibaltiev
Copy link
Contributor Author

I assumed that you meant the guide configuration that will be used by the stakeholders. I agree that 2008 could benefit from the same mechanism, so I will add the changes to that rule too.

@gardener-robot gardener-robot added size/m Size of pull request is medium (see gardener-robot robot/bots/size.py) and removed size/s Size of pull request is small (see gardener-robot robot/bots/size.py) labels Dec 17, 2024
@georgibaltiev georgibaltiev changed the title Add a wildcard option for volumes contained in AcceptedPods for Rule 2003 Add a wildcard option for volumes contained in AcceptedPods for Rules 2003 and 2008 Dec 17, 2024
@dimityrmirchev dimityrmirchev added the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Dec 18, 2024
Copy link
Member

@dimityrmirchev dimityrmirchev left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you!

/lgtm

@gardener-robot gardener-robot added reviewed/lgtm Has approval for merging and removed needs/changes Needs (more) changes needs/review Needs review labels Dec 18, 2024
@gardener-robot-ci-3 gardener-robot-ci-3 removed the reviewed/ok-to-test Has approval for testing (check PR in detail before setting this label because PR is run on CI/CD) label Dec 18, 2024
@dimityrmirchev dimityrmirchev merged commit a4a8e8f into gardener:main Dec 18, 2024
9 checks passed
@gardener-robot gardener-robot added the status/closed Issue is closed (either delivered or triaged) label Dec 18, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
needs/ok-to-test Needs approval for testing (check PR in detail before setting this label because PR is run on CI/CD) reviewed/lgtm Has approval for merging size/m Size of pull request is medium (see gardener-robot robot/bots/size.py) status/closed Issue is closed (either delivered or triaged)
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Allow selecting all volume names via wildcard "*" in rule 2003 from Security Hardened K8s
5 participants