Skip to content

Commit

Permalink
Update gatekeeper versions (#77)
Browse files Browse the repository at this point in the history 
* Update gatekeeper charts and add external ips constraint

* Update gatekeeper chart version

* Run generate
  • Loading branch information
@phillebaba
phillebaba authored Dec 9, 2020
1 parent 54822b3 commit ee6ec42
Show file tree
Hide file tree
Showing 3 changed files with 14 additions and 3 deletions.
2 changes: 1 addition & 1 deletion modules/kubernetes/opa-gatekeeper/README.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -100,7 +100,7 @@ as the same values are passed to both of the charts, there will never be a diffe
| Name | Description | Type | Default | Required |
|------|-------------|------|---------|:--------:|
| additional\_constraints | Additional constraints that should be added | <pre>list(object({<br> kind = string<br> name = string<br> enforcement_action = string<br> match = object({<br> kinds = list(object({<br> apiGroups = list(string)<br> kinds = list(string)<br> }))<br> namespaces = list(string)<br> })<br> parameters = any<br> }))</pre> | `[]` | no |
| default\_constraints | Default constraints that should be added | <pre>list(object({<br> kind = string<br> name = string<br> enforcement_action = string<br> match = object({<br> kinds = list(object({<br> apiGroups = list(string)<br> kinds = list(string)<br> }))<br> namespaces = list(string)<br> })<br> parameters = any<br> }))</pre> | <pre>[<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPAllowPrivilegeEscalationContainer",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-allow-privilege-escalation-container",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPHostNamespace",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-host-namespace",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPHostNetworkingPorts",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-host-network-ports",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPFlexVolumes",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-flexvolume-drivers",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPPrivilegedContainer",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-privileged-container",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPProcMount",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-proc-mount",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPReadOnlyRootFilesystem",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-readonlyrootfilesystem",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPVolumeTypes",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-volume-types",<br> "parameters": {<br> "volumes": [<br> "configMap",<br> "downwardAPI",<br> "emptyDir",<br> "persistentVolumeClaim",<br> "secret",<br> "projected"<br> ]<br> }<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPCapabilities",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-capabilities",<br> "parameters": {<br> "allowedCapabilities": [<br> ""<br> ],<br> "requiredDropCapabilities": [<br> "NET_RAW"<br> ]<br> }<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sBlockNodePort",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "block-node-port",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sRequiredProbes",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "required-probes",<br> "parameters": {<br> "probeTypes": [<br> "tcpSocket",<br> "httpGet",<br> "exec"<br> ],<br> "probes": [<br> "readinessProbe"<br> ]<br> }<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPodPriorityClass",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "pod-priority-class",<br> "parameters": {}<br> }<br>]</pre> | no |
| default\_constraints | Default constraints that should be added | <pre>list(object({<br> kind = string<br> name = string<br> enforcement_action = string<br> match = object({<br> kinds = list(object({<br> apiGroups = list(string)<br> kinds = list(string)<br> }))<br> namespaces = list(string)<br> })<br> parameters = any<br> }))</pre> | <pre>[<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPAllowPrivilegeEscalationContainer",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-allow-privilege-escalation-container",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPHostNamespace",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-host-namespace",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPHostNetworkingPorts",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-host-network-ports",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPFlexVolumes",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-flexvolume-drivers",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPPrivilegedContainer",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-privileged-container",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPProcMount",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-proc-mount",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPReadOnlyRootFilesystem",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-readonlyrootfilesystem",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPVolumeTypes",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-volume-types",<br> "parameters": {<br> "volumes": [<br> "configMap",<br> "downwardAPI",<br> "emptyDir",<br> "persistentVolumeClaim",<br> "secret",<br> "projected"<br> ]<br> }<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPSPCapabilities",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "psp-capabilities",<br> "parameters": {<br> "allowedCapabilities": [<br> ""<br> ],<br> "requiredDropCapabilities": [<br> "NET_RAW"<br> ]<br> }<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sBlockNodePort",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "block-node-port",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sRequiredProbes",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "required-probes",<br> "parameters": {<br> "probeTypes": [<br> "tcpSocket",<br> "httpGet",<br> "exec"<br> ],<br> "probes": [<br> "readinessProbe"<br> ]<br> }<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sPodPriorityClass",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "pod-priority-class",<br> "parameters": {}<br> },<br> {<br> "enforcement_action": "",<br> "kind": "K8sExternalIPs",<br> "match": {<br> "kinds": [],<br> "namespaces": []<br> },<br> "name": "external-ips",<br> "parameters": {}<br> }<br>]</pre> | no |
| exclude | Namespaces to opt out of constraints | <pre>list(object({<br> excluded_namespaces = list(string)<br> processes = list(string)<br> }))</pre> | <pre>[<br> {<br> "excluded_namespaces": [<br> "kube-system",<br> "gatekeeper-system"<br> ],<br> "processes": [<br> "*"<br> ]<br> }<br>]</pre> | no |

## Outputs
Expand Down
4 changes: 2 additions & 2 deletions modules/kubernetes/opa-gatekeeper/main.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -96,8 +96,8 @@ terraform {
}

locals {
gatekeeper_version = "v3.2.1"
gatekeeper_library_version = "v0.4.3"
gatekeeper_version = "v3.2.2"
gatekeeper_library_version = "v0.5.1"
values = templatefile("${path.module}/templates/gatekeeper-library-values.yaml.tpl", { constraints = concat(var.default_constraints, var.additional_constraints), exclude = var.exclude })
}

Expand Down
11 changes: 11 additions & 0 deletions modules/kubernetes/opa-gatekeeper/variables.tf
View file
Original file line number Diff line number Diff line change
Expand Up @@ -142,6 +142,17 @@ variable "default_constraints" {
}
parameters = {}
},
# FIXES https://github.com/kubernetes/kubernetes/issues/97076
{
kind = "K8sExternalIPs"
name = "external-ips"
enforcement_action = ""
match = {
kinds = []
namespaces = []
}
parameters = {}
},
]
}

Expand Down

0 comments on commit ee6ec42

Please sign in to comment.