Add disallow interactive tty constraint #305

tspearconquest · 2023-03-20T20:16:30Z

What this PR does / why we need it:
Adds a constraint to disallow deployment of pods with containers where the fields related to interactive sessions, such as stdin, and tty, are set to true

Special notes for your reviewer:

tspearconquest · 2023-04-06T19:55:59Z

I've tested this in my cluster. Gitlab runners use tty: true, and with a constraint applied against this template, the gitlab runner job pods are rejected by Gatekeeper. :)

maxsmythe

LGTM, thanks for the contribution!

Not sure if the artifact hub generation stuff is supposed to happen later.

maxsmythe · 2023-04-06T23:42:01Z

It looks like this command needs to be run: Please run 'make generate generate-website-docs generate-artifacthub-artifacts' to generate the templates and docs

tspearconquest · 2023-04-06T23:42:46Z

Thanks, yes I am doing this now.

tspearconquest · 2023-04-06T23:52:57Z

Done, and pushed.

tspearconquest · 2023-04-07T00:04:22Z

Checking on the new failures...

ritazh · 2023-04-07T00:15:40Z

library/general/horizontalpodautoscaler/template.yaml

@@ -4,7 +4,7 @@ metadata:
  name: k8shorizontalpodautoscaler
  annotations:
    metadata.gatekeeper.sh/title: "Horizontal Pod Autoscaler"
-    metadata.gatekeeper.sh/version: 1.0.0


did you mean to make these changes for this policy?

tspearconquest · 2023-04-07T00:29:03Z

Yes. I'm trying to sneak in a whitespace fix in the hpa constraint and the CI required that the version be bumped in order to approve the change.

ritazh · 2023-04-07T00:30:51Z

@tspearconquest the change bumps the patch version. might be good to revert it for now since the horizontalpodautoscaler policy is not in the right place. xref #314

Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

* remove skip for storage class Signed-off-by: Sertac Ozercan <sozercan@gmail.com> * revert timestamp Signed-off-by: Sertac Ozercan <sozercan@gmail.com> --------- Signed-off-by: Sertac Ozercan <sozercan@gmail.com> Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

* fix: disallowed repos sample test name Signed-off-by: Sertac Ozercan <sozercan@gmail.com> * fix tests Signed-off-by: Sertac Ozercan <sozercan@gmail.com> --------- Signed-off-by: Sertac Ozercan <sozercan@gmail.com> Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

* feat: add HorizontalPodAutoscaler policy Signed-off-by: Craig Trought <k8s@trought.ca> * chore: add metadata for artifacts Signed-off-by: Craig Trought <k8s@trought.ca> * chore: generate artifacts Signed-off-by: Craig Trought <k8s@trought.ca> * fix: remove sample constraint Signed-off-by: Craig Trought <k8s@trought.ca> * core: add requiresSyncData metadata Signed-off-by: Craig Trought <k8s@trought.ca> * add hpa policy to kustomize Signed-off-by: Craig Trought <k8s@trought.ca> --------- Signed-off-by: Craig Trought <k8s@trought.ca> Co-authored-by: Sertaç Özercan <852750+sozercan@users.noreply.github.com> Co-authored-by: Max Smythe <smythe@google.com> Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

) Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

…ts' again Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

…-artifacts' again" This reverts commit 673a63a. Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

…-artifacts'" This reverts commit 54b069c. Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

ritazh · 2023-04-13T19:52:25Z

@nilekhc can you pls help take a look at all the CI failures to make sure they are failing correctly? e.g. panic: looks like template.yaml is updated but the version is not. Please update the 'metadata.gatekeeper.sh/version' annotation in the template.yaml source and if so, what needs to be fixed?

JaydipGabani · 2023-04-27T21:39:07Z

@tspearconquest can you try deleting artifact-hub/library/general/disallowinteractive dir from your local and then run make generate generate-website-docs generate-artifacthub-artifacts? it should solve ci error.

Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

…tspearconquest/gatekeeper-library into add_disallow_interactive_tty_constraint

…_tty_constraint

nilekhc · 2023-05-04T23:02:31Z

@nilekhc can you pls help take a look at all the CI failures to make sure they are failing correctly? e.g. panic: looks like template.yaml is updated but the version is not. Please update the 'metadata.gatekeeper.sh/version' annotation in the template.yaml source and if so, what needs to be fixed?

Thanks for reporting this @ritazh! I have opened #339 to fix it.

apeabody · 2023-05-15T15:47:20Z

Hi @tspearconquest - #339 has been merged, can you please try a fresh 'make generate generate-website-docs generate-artifacthub-artifacts' to generate the templates and docs. Cheers!

tspearconquest · 2023-05-22T19:33:06Z

Hello, apologies for my delay, as I was on leave for the last 2 weeks. I am doing it now.

Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

tspearconquest · 2023-05-22T20:25:29Z

Ok, it's pushed and it looks like tests have passed. Please take a look. Thanks again!

maxsmythe · 2023-07-20T02:00:09Z

@ritazh LGTY?

stale · 2023-09-19T20:56:41Z

This issue/PR has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

tspearconquest · 2023-09-19T20:57:45Z

Any update on this?

stale · 2023-11-25T00:07:33Z

This issue/PR has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

tspearconquest · 2023-11-27T16:33:07Z

Not stale...

/help

tspearconquest mentioned this pull request Mar 20, 2023

Constraint to block deployment of pods with containers having either stdin: true or tty: true #306

Closed

maxsmythe approved these changes Apr 6, 2023

View reviewed changes

ritazh reviewed Apr 7, 2023

View reviewed changes

Thomas Spear and others added 11 commits April 6, 2023 21:19

Add a disallow interactive TTY constraint

4fb9e23

Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

Add source for disallow interactive

f0dd4cd

Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

fix: remove hardcoded kind from replicalimits msg (open-policy-agent#309

52fe3c3

) Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

Run 'make generate generate-website-docs generate-artifacthub-artifacts'

651c7c4

Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

Run 'make generate generate-website-docs generate-artifacthub-artifac…

c4a2a40

…ts' again Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

Revert "Run 'make generate generate-website-docs generate-artifacthub…

3085f8d

…-artifacts' again" This reverts commit 673a63a. Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

Revert "Run 'make generate generate-website-docs generate-artifacthub…

5d0c896

…-artifacts'" This reverts commit 54b069c. Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

Run 'make generate generate-website-docs generate-artifacthub-artifacts'

0547a50

Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

tspearconquest force-pushed the add_disallow_interactive_tty_constraint branch from 5cb4eae to 0547a50 Compare April 7, 2023 02:19

Thomas Spear and others added 2 commits April 7, 2023 01:47

Fix missing libs

b2d9eb8

Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

Merge branch 'master' into add_disallow_interactive_tty_constraint

b42a989

Thomas Spear and others added 4 commits April 27, 2023 16:41

Fix CI

c7b3e61

Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

Merge branch 'add_disallow_interactive_tty_constraint' of github.com:…

489dc08

…tspearconquest/gatekeeper-library into add_disallow_interactive_tty_constraint

Merge branch 'open-policy-agent:master' into add_disallow_interactive…

0d62cc4

…_tty_constraint

Merge branch 'master' into add_disallow_interactive_tty_constraint

9f2d113

nilekhc mentioned this pull request May 4, 2023

fix version check in Artifact Hub generation #331

Closed

Merge branch 'master' into add_disallow_interactive_tty_constraint

73dcffd

Run make generate generate-website-docs generate-artifacthub-artifacts

6962979

Signed-off-by: Thomas Spear <tspear@conquestcyber.com>

Merge branch 'master' into add_disallow_interactive_tty_constraint

6486a3e

stale bot added the stale label Sep 19, 2023

stale bot removed the stale label Sep 19, 2023

tspearconquest and others added 2 commits September 19, 2023 15:58

Merge branch 'master' into add_disallow_interactive_tty_constraint

c0e1873

Merge branch 'master' into add_disallow_interactive_tty_constraint

7e14a37

stale bot added the stale label Nov 25, 2023

stale bot removed the stale label Nov 27, 2023

Merge branch 'master' into add_disallow_interactive_tty_constraint

a7e7cc8

apeabody requested a review from a team as a code owner November 27, 2023 16:40

tspearconquest and others added 4 commits November 27, 2023 10:57

Merge branch 'master' into add_disallow_interactive_tty_constraint

317f82e

Merge branch 'master' into add_disallow_interactive_tty_constraint

56a24f7

Merge branch 'master' into add_disallow_interactive_tty_constraint

53a6534

Merge branch 'master' into add_disallow_interactive_tty_constraint

bdb4a90

nilekhc approved these changes Dec 6, 2023

View reviewed changes

nilekhc merged commit 2d99845 into open-policy-agent:master Dec 6, 2023
15 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add disallow interactive tty constraint #305

Add disallow interactive tty constraint #305

tspearconquest commented Mar 20, 2023

tspearconquest commented Apr 6, 2023

maxsmythe left a comment

maxsmythe commented Apr 6, 2023

tspearconquest commented Apr 6, 2023

tspearconquest commented Apr 6, 2023

tspearconquest commented Apr 7, 2023

ritazh Apr 7, 2023

tspearconquest commented Apr 7, 2023 via email •

edited

Loading

ritazh commented Apr 7, 2023

ritazh commented Apr 13, 2023

JaydipGabani commented Apr 27, 2023

nilekhc commented May 4, 2023

apeabody commented May 15, 2023

tspearconquest commented May 22, 2023

tspearconquest commented May 22, 2023

maxsmythe commented Jul 20, 2023

stale bot commented Sep 19, 2023

tspearconquest commented Sep 19, 2023

stale bot commented Nov 25, 2023

tspearconquest commented Nov 27, 2023

Add disallow interactive tty constraint #305

Add disallow interactive tty constraint #305

Conversation

tspearconquest commented Mar 20, 2023

tspearconquest commented Apr 6, 2023

maxsmythe left a comment

Choose a reason for hiding this comment

maxsmythe commented Apr 6, 2023

tspearconquest commented Apr 6, 2023

tspearconquest commented Apr 6, 2023

tspearconquest commented Apr 7, 2023

ritazh Apr 7, 2023

Choose a reason for hiding this comment

tspearconquest commented Apr 7, 2023 via email • edited Loading

ritazh commented Apr 7, 2023

ritazh commented Apr 13, 2023

JaydipGabani commented Apr 27, 2023

nilekhc commented May 4, 2023

apeabody commented May 15, 2023

tspearconquest commented May 22, 2023

tspearconquest commented May 22, 2023

maxsmythe commented Jul 20, 2023

stale bot commented Sep 19, 2023

tspearconquest commented Sep 19, 2023

stale bot commented Nov 25, 2023

tspearconquest commented Nov 27, 2023

tspearconquest commented Apr 7, 2023 via email •

edited

Loading