Skip to content

Commit

Permalink
Merge pull request #3641 from Azure/yjst2012/ARO-8531
Browse files Browse the repository at this point in the history 
update guardrails protected namespaces list
  • Loading branch information
@jaitaiwan
jaitaiwan authored Jul 2, 2024
2 parents 42daa82 + a100c61 commit 2adcd63
Show file tree
Hide file tree
Showing 6 changed files with 77 additions and 82 deletions.
2 changes: 1 addition & 1 deletion ...ntrollers/guardrails/policies/gktemplates-src/aro-deny-privileged-namespace/src_test.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -192,7 +192,7 @@ delete_pullsecret_with_userinfo(userinfo) = output {
}
}

input_allowed_ns = "mytest"
input_allowed_ns = "openshift-marketplace"

input_disallowed_ns = "openshift-apiserver"

Expand Down
33 changes: 16 additions & 17 deletions pkg/operator/controllers/guardrails/policies/gktemplates-src/library/common.rego
View file
Original file line number Diff line number Diff line change
Expand Up @@ -71,7 +71,6 @@ exempted_groups = {
# "system:serviceaccounts:openshift-machine-config-operator", # machine-config-operator, however the request provide correct sa name
"system:masters" # system:admin
}

privileged_ns = {
# Kubernetes specific namespaces
"kube-node-lease",
Expand All @@ -92,13 +91,9 @@ privileged_ns = {
"openshift-cloud-controller-manager",
"openshift-cloud-controller-manager-operator",
"openshift-cloud-credential-operator",
# "openshift-cluster-csi-drivers",
"openshift-cluster-machine-approver",
"openshift-cluster-node-tuning-operator",
"openshift-cluster-samples-operator",
"openshift-cluster-storage-operator",
"openshift-cluster-version",
# "openshift-config",
"openshift-config-managed",
"openshift-config-operator",
"openshift-console",
Expand All @@ -113,31 +108,35 @@ privileged_ns = {
"openshift-host-network",
"openshift-image-registry",
"openshift-ingress",
"openshift-ingress-canary",
"openshift-ingress-operator",
"openshift-insights",
"openshift-kni-infra",
"openshift-kube-apiserver",
"openshift-kube-apiserver-operator",
"openshift-kube-controller-manager",
"openshift-kube-controller-manager-operator",
"openshift-kube-scheduler",
"openshift-kube-scheduler-operator",
"openshift-kube-storage-version-migrator",
"openshift-kube-storage-version-migrator-operator",
"openshift-machine-api",
"openshift-machine-config-operator",
"openshift-marketplace",
"openshift-monitoring",
"openshift-multus",
"openshift-network-diagnostics",
"openshift-network-operator",
"openshift-oauth-apiserver",
"openshift-openstack-infra",
"openshift-operators",
"openshift-operator-lifecycle-manager",
"openshift-ovirt-infra",
"openshift-sdn",
"openshift-service-ca",
"openshift-service-ca-operator"
}
"openshift-service-ca-operator",
# "openshift-kube-storage-version-migrator",
# "openshift-kube-storage-version-migrator-operator",
# "openshift-network-diagnostics",
# "openshift-openstack-infra",
# "openshift-marketplace",
# "openshift-ingress-canary",
# "openshift-insights",
# "openshift-kni-infra",
# "openshift-cluster-csi-drivers",
# "openshift-cluster-node-tuning-operator",
# "openshift-cluster-samples-operator",
# "openshift-config",
# "openshift-ovirt-infra",
"openshift-sdn"
}
31 changes: 15 additions & 16 deletions pkg/operator/controllers/guardrails/policies/gktemplates/aro-deny-delete-pull-secret.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,6 @@ spec:
# "system:serviceaccounts:openshift-machine-config-operator", # machine-config-operator, however the request provide correct sa name
"system:masters" # system:admin
}
privileged_ns = {
# Kubernetes specific namespaces
"kube-node-lease",
Expand All @@ -120,13 +119,9 @@ spec:
"openshift-cloud-controller-manager",
"openshift-cloud-controller-manager-operator",
"openshift-cloud-credential-operator",
# "openshift-cluster-csi-drivers",
"openshift-cluster-machine-approver",
"openshift-cluster-node-tuning-operator",
"openshift-cluster-samples-operator",
"openshift-cluster-storage-operator",
"openshift-cluster-version",
# "openshift-config",
"openshift-config-managed",
"openshift-config-operator",
"openshift-console",
Expand All @@ -141,31 +136,35 @@ spec:
"openshift-host-network",
"openshift-image-registry",
"openshift-ingress",
"openshift-ingress-canary",
"openshift-ingress-operator",
"openshift-insights",
"openshift-kni-infra",
"openshift-kube-apiserver",
"openshift-kube-apiserver-operator",
"openshift-kube-controller-manager",
"openshift-kube-controller-manager-operator",
"openshift-kube-scheduler",
"openshift-kube-scheduler-operator",
"openshift-kube-storage-version-migrator",
"openshift-kube-storage-version-migrator-operator",
"openshift-machine-api",
"openshift-machine-config-operator",
"openshift-marketplace",
"openshift-monitoring",
"openshift-multus",
"openshift-network-diagnostics",
"openshift-network-operator",
"openshift-oauth-apiserver",
"openshift-openstack-infra",
"openshift-operators",
"openshift-operator-lifecycle-manager",
"openshift-ovirt-infra",
"openshift-sdn",
"openshift-service-ca",
"openshift-service-ca-operator"
"openshift-service-ca-operator",
# "openshift-kube-storage-version-migrator",
# "openshift-kube-storage-version-migrator-operator",
# "openshift-network-diagnostics",
# "openshift-openstack-infra",
# "openshift-marketplace",
# "openshift-ingress-canary",
# "openshift-insights",
# "openshift-kni-infra",
# "openshift-cluster-csi-drivers",
# "openshift-cluster-node-tuning-operator",
# "openshift-cluster-samples-operator",
# "openshift-config",
# "openshift-ovirt-infra",
"openshift-sdn"
}
31 changes: 15 additions & 16 deletions pkg/operator/controllers/guardrails/policies/gktemplates/aro-deny-machine-config.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,6 @@ spec:
# "system:serviceaccounts:openshift-machine-config-operator", # machine-config-operator, however the request provide correct sa name
"system:masters" # system:admin
}
privileged_ns = {
# Kubernetes specific namespaces
"kube-node-lease",
Expand All @@ -125,13 +124,9 @@ spec:
"openshift-cloud-controller-manager",
"openshift-cloud-controller-manager-operator",
"openshift-cloud-credential-operator",
# "openshift-cluster-csi-drivers",
"openshift-cluster-machine-approver",
"openshift-cluster-node-tuning-operator",
"openshift-cluster-samples-operator",
"openshift-cluster-storage-operator",
"openshift-cluster-version",
# "openshift-config",
"openshift-config-managed",
"openshift-config-operator",
"openshift-console",
Expand All @@ -146,31 +141,35 @@ spec:
"openshift-host-network",
"openshift-image-registry",
"openshift-ingress",
"openshift-ingress-canary",
"openshift-ingress-operator",
"openshift-insights",
"openshift-kni-infra",
"openshift-kube-apiserver",
"openshift-kube-apiserver-operator",
"openshift-kube-controller-manager",
"openshift-kube-controller-manager-operator",
"openshift-kube-scheduler",
"openshift-kube-scheduler-operator",
"openshift-kube-storage-version-migrator",
"openshift-kube-storage-version-migrator-operator",
"openshift-machine-api",
"openshift-machine-config-operator",
"openshift-marketplace",
"openshift-monitoring",
"openshift-multus",
"openshift-network-diagnostics",
"openshift-network-operator",
"openshift-oauth-apiserver",
"openshift-openstack-infra",
"openshift-operators",
"openshift-operator-lifecycle-manager",
"openshift-ovirt-infra",
"openshift-sdn",
"openshift-service-ca",
"openshift-service-ca-operator"
"openshift-service-ca-operator",
# "openshift-kube-storage-version-migrator",
# "openshift-kube-storage-version-migrator-operator",
# "openshift-network-diagnostics",
# "openshift-openstack-infra",
# "openshift-marketplace",
# "openshift-ingress-canary",
# "openshift-insights",
# "openshift-kni-infra",
# "openshift-cluster-csi-drivers",
# "openshift-cluster-node-tuning-operator",
# "openshift-cluster-samples-operator",
# "openshift-config",
# "openshift-ovirt-infra",
"openshift-sdn"
}
31 changes: 15 additions & 16 deletions ...erator/controllers/guardrails/policies/gktemplates/aro-deny-master-toleration-taints.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,6 @@ spec:
# "system:serviceaccounts:openshift-machine-config-operator", # machine-config-operator, however the request provide correct sa name
"system:masters" # system:admin
}
privileged_ns = {
# Kubernetes specific namespaces
"kube-node-lease",
Expand All @@ -144,13 +143,9 @@ spec:
"openshift-cloud-controller-manager",
"openshift-cloud-controller-manager-operator",
"openshift-cloud-credential-operator",
# "openshift-cluster-csi-drivers",
"openshift-cluster-machine-approver",
"openshift-cluster-node-tuning-operator",
"openshift-cluster-samples-operator",
"openshift-cluster-storage-operator",
"openshift-cluster-version",
# "openshift-config",
"openshift-config-managed",
"openshift-config-operator",
"openshift-console",
Expand All @@ -165,31 +160,35 @@ spec:
"openshift-host-network",
"openshift-image-registry",
"openshift-ingress",
"openshift-ingress-canary",
"openshift-ingress-operator",
"openshift-insights",
"openshift-kni-infra",
"openshift-kube-apiserver",
"openshift-kube-apiserver-operator",
"openshift-kube-controller-manager",
"openshift-kube-controller-manager-operator",
"openshift-kube-scheduler",
"openshift-kube-scheduler-operator",
"openshift-kube-storage-version-migrator",
"openshift-kube-storage-version-migrator-operator",
"openshift-machine-api",
"openshift-machine-config-operator",
"openshift-marketplace",
"openshift-monitoring",
"openshift-multus",
"openshift-network-diagnostics",
"openshift-network-operator",
"openshift-oauth-apiserver",
"openshift-openstack-infra",
"openshift-operators",
"openshift-operator-lifecycle-manager",
"openshift-ovirt-infra",
"openshift-sdn",
"openshift-service-ca",
"openshift-service-ca-operator"
"openshift-service-ca-operator",
# "openshift-kube-storage-version-migrator",
# "openshift-kube-storage-version-migrator-operator",
# "openshift-network-diagnostics",
# "openshift-openstack-infra",
# "openshift-marketplace",
# "openshift-ingress-canary",
# "openshift-insights",
# "openshift-kni-infra",
# "openshift-cluster-csi-drivers",
# "openshift-cluster-node-tuning-operator",
# "openshift-cluster-samples-operator",
# "openshift-config",
# "openshift-ovirt-infra",
"openshift-sdn"
}
31 changes: 15 additions & 16 deletions pkg/operator/controllers/guardrails/policies/gktemplates/aro-deny-privileged-namespace.yaml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -121,7 +121,6 @@ spec:
# "system:serviceaccounts:openshift-machine-config-operator", # machine-config-operator, however the request provide correct sa name
"system:masters" # system:admin
}
privileged_ns = {
# Kubernetes specific namespaces
"kube-node-lease",
Expand All @@ -142,13 +141,9 @@ spec:
"openshift-cloud-controller-manager",
"openshift-cloud-controller-manager-operator",
"openshift-cloud-credential-operator",
# "openshift-cluster-csi-drivers",
"openshift-cluster-machine-approver",
"openshift-cluster-node-tuning-operator",
"openshift-cluster-samples-operator",
"openshift-cluster-storage-operator",
"openshift-cluster-version",
# "openshift-config",
"openshift-config-managed",
"openshift-config-operator",
"openshift-console",
Expand All @@ -163,31 +158,35 @@ spec:
"openshift-host-network",
"openshift-image-registry",
"openshift-ingress",
"openshift-ingress-canary",
"openshift-ingress-operator",
"openshift-insights",
"openshift-kni-infra",
"openshift-kube-apiserver",
"openshift-kube-apiserver-operator",
"openshift-kube-controller-manager",
"openshift-kube-controller-manager-operator",
"openshift-kube-scheduler",
"openshift-kube-scheduler-operator",
"openshift-kube-storage-version-migrator",
"openshift-kube-storage-version-migrator-operator",
"openshift-machine-api",
"openshift-machine-config-operator",
"openshift-marketplace",
"openshift-monitoring",
"openshift-multus",
"openshift-network-diagnostics",
"openshift-network-operator",
"openshift-oauth-apiserver",
"openshift-openstack-infra",
"openshift-operators",
"openshift-operator-lifecycle-manager",
"openshift-ovirt-infra",
"openshift-sdn",
"openshift-service-ca",
"openshift-service-ca-operator"
"openshift-service-ca-operator",
# "openshift-kube-storage-version-migrator",
# "openshift-kube-storage-version-migrator-operator",
# "openshift-network-diagnostics",
# "openshift-openstack-infra",
# "openshift-marketplace",
# "openshift-ingress-canary",
# "openshift-insights",
# "openshift-kni-infra",
# "openshift-cluster-csi-drivers",
# "openshift-cluster-node-tuning-operator",
# "openshift-cluster-samples-operator",
# "openshift-config",
# "openshift-ovirt-infra",
"openshift-sdn"
}

0 comments on commit 2adcd63

Please sign in to comment.