Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

refactor : Update cnf doc link to k8s doc link #2257

Merged
merged 1 commit into from
Jul 16, 2024
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
162 changes: 81 additions & 81 deletions CATALOG.md

Large diffs are not rendered by default.

148 changes: 74 additions & 74 deletions cmd/certsuite/claim/compare/testdata/claim_access_control.json

Large diffs are not rendered by default.

148 changes: 74 additions & 74 deletions cmd/certsuite/claim/compare/testdata/claim_observability.json

Large diffs are not rendered by default.

8 changes: 4 additions & 4 deletions cmd/certsuite/claim/show/failures/testdata/claim1.json
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
"tags": "common"
},
"catalogInfo": {
"bestPracticeReference": "https://test-network-function.github.io/cnf-best-practices/#cnf-best-practices-security-rbac",
"bestPracticeReference": "https://test-network-function.github.io/k8s-best-practices-guide/#k8s-best-practices-security-rbac",
"description": "Ensures that containers do not use SYS_ADMIN capability",
"exceptionProcess": "Exception possible only for workloads that's cluster wide in nature and absolutely needs cluster level roles \u0026 role bindings",
"remediation": "In most cases, Pod's should not have ClusterRoleBindings. The suggested remediation is to remove the need for ClusterRoleBindings, if possible. Cluster roles and cluster role bindings discouraged unless absolutely needed by CNF (often reserved for cluster admin only)."
Expand All @@ -43,7 +43,7 @@
"tags": "telco"
},
"catalogInfo": {
"bestPracticeReference": "https://test-network-function.github.io/cnf-best-practices/#cnf-best-practices-security-rbac",
"bestPracticeReference": "https://test-network-function.github.io/k8s-best-practices-guide/#k8s-best-practices-security-rbac",
"description": "Check that pods running on nodes with realtime kernel enabled have the SYS_NICE capability enabled in their spec. In the case that a CNF is running on a node using the real-time kernel, SYS_NICE will be used to allow DPDK application to switch to SCHED_FIFO.",
"exceptionProcess": "Exception possible only for workloads that's cluster wide in nature and absolutely needs cluster level roles \u0026 role bindings",
"remediation": "In most cases, Pod's should not have ClusterRoleBindings. The suggested remediation is to remove the need for ClusterRoleBindings, if possible. Cluster roles and cluster role bindings discouraged unless absolutely needed by CNF (often reserved for cluster admin only)."
Expand All @@ -70,7 +70,7 @@
"tags": "common"
},
"catalogInfo": {
"bestPracticeReference": "https://test-network-function.github.io/cnf-best-practices/#cnf-best-practices-security-rbac",
"bestPracticeReference": "https://test-network-function.github.io/k8s-best-practices-guide/#k8s-best-practices-security-rbac",
"description": "Tests that no one has changed the node's sysctl configs after the node was created, the tests works by checking if the sysctl configs are consistent with the MachineConfig CR which defines how the node should be configured",
"exceptionProcess": "Exception possible only for workloads that's cluster wide in nature and absolutely needs cluster level roles \u0026 role bindings",
"remediation": "In most cases, Pod's should not have ClusterRoleBindings. The suggested remediation is to remove the need for ClusterRoleBindings, if possible. Cluster roles and cluster role bindings discouraged unless absolutely needed by CNF (often reserved for cluster admin only)."
Expand All @@ -97,7 +97,7 @@
"tags": "common"
},
"catalogInfo": {
"bestPracticeReference": "https://test-network-function.github.io/cnf-best-practices/#cnf-best-practices-security-rbac",
"bestPracticeReference": "https://test-network-function.github.io/k8s-best-practices-guide/#k8s-best-practices-security-rbac",
"description": "Ensures that the Node(s) hosting CNFs do not utilize tainted kernels. This test case is especially important to support Highly Available CNFs, since when a CNF is re-instantiated on a backup Node, that Node's kernel may not have the same hacks.",
"exceptionProcess": "Exception possible only for workloads that's cluster wide in nature and absolutely needs cluster level roles \u0026 role bindings",
"remediation": "In most cases, Pod's should not have ClusterRoleBindings. The suggested remediation is to remove the need for ClusterRoleBindings, if possible. Cluster roles and cluster role bindings discouraged unless absolutely needed by CNF (often reserved for cluster admin only)."
Expand Down
8 changes: 4 additions & 4 deletions cmd/certsuite/claim/show/failures/testdata/claim2.json
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
"tags": "common"
},
"catalogInfo": {
"bestPracticeReference": "https://test-network-function.github.io/cnf-best-practices/#cnf-best-practices-security-rbac",
"bestPracticeReference": "https://test-network-function.github.io/k8s-best-practices-guide/#k8s-best-practices-security-rbac",
"description": "Ensures that containers do not use SYS_ADMIN capability",
"exceptionProcess": "Exception possible only for workloads that's cluster wide in nature and absolutely needs cluster level roles \u0026 role bindings",
"remediation": "In most cases, Pod's should not have ClusterRoleBindings. The suggested remediation is to remove the need for ClusterRoleBindings, if possible. Cluster roles and cluster role bindings discouraged unless absolutely needed by CNF (often reserved for cluster admin only)."
Expand All @@ -43,7 +43,7 @@
"tags": "telco"
},
"catalogInfo": {
"bestPracticeReference": "https://test-network-function.github.io/cnf-best-practices/#cnf-best-practices-security-rbac",
"bestPracticeReference": "https://test-network-function.github.io/k8s-best-practices-guide/#k8s-best-practices-security-rbac",
"description": "Check that pods running on nodes with realtime kernel enabled have the SYS_NICE capability enabled in their spec. In the case that a CNF is running on a node using the real-time kernel, SYS_NICE will be used to allow DPDK application to switch to SCHED_FIFO.",
"exceptionProcess": "Exception possible only for workloads that's cluster wide in nature and absolutely needs cluster level roles \u0026 role bindings",
"remediation": "In most cases, Pod's should not have ClusterRoleBindings. The suggested remediation is to remove the need for ClusterRoleBindings, if possible. Cluster roles and cluster role bindings discouraged unless absolutely needed by CNF (often reserved for cluster admin only)."
Expand All @@ -70,7 +70,7 @@
"tags": "common"
},
"catalogInfo": {
"bestPracticeReference": "https://test-network-function.github.io/cnf-best-practices/#cnf-best-practices-security-rbac",
"bestPracticeReference": "https://test-network-function.github.io/k8s-best-practices-guide/#k8s-best-practices-security-rbac",
"description": "Tests that no one has changed the node's sysctl configs after the node was created, the tests works by checking if the sysctl configs are consistent with the MachineConfig CR which defines how the node should be configured",
"exceptionProcess": "Exception possible only for workloads that's cluster wide in nature and absolutely needs cluster level roles \u0026 role bindings",
"remediation": "In most cases, Pod's should not have ClusterRoleBindings. The suggested remediation is to remove the need for ClusterRoleBindings, if possible. Cluster roles and cluster role bindings discouraged unless absolutely needed by CNF (often reserved for cluster admin only)."
Expand All @@ -97,7 +97,7 @@
"tags": "common"
},
"catalogInfo": {
"bestPracticeReference": "https://test-network-function.github.io/cnf-best-practices/#cnf-best-practices-security-rbac",
"bestPracticeReference": "https://test-network-function.github.io/k8s-best-practices-guide/#k8s-best-practices-security-rbac",
"description": "Ensures that the Node(s) hosting CNFs do not utilize tainted kernels. This test case is especially important to support Highly Available CNFs, since when a CNF is re-instantiated on a backup Node, that Node's kernel may not have the same hacks.",
"exceptionProcess": "Exception possible only for workloads that's cluster wide in nature and absolutely needs cluster level roles \u0026 role bindings",
"remediation": "In most cases, Pod's should not have ClusterRoleBindings. The suggested remediation is to remove the need for ClusterRoleBindings, if possible. Cluster roles and cluster role bindings discouraged unless absolutely needed by CNF (often reserved for cluster admin only)."
Expand Down
2 changes: 1 addition & 1 deletion docs/assets/images/claim-compare-cni.svg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
2 changes: 1 addition & 1 deletion docs/assets/images/claim-compare-results.svg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Loading
Loading