Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove uds-dev-stack namespace exclusion from Pepr defaults #1193

Open
mjnagel opened this issue Jan 15, 2025 · 0 comments
Open

Remove uds-dev-stack namespace exclusion from Pepr defaults #1193

mjnagel opened this issue Jan 15, 2025 · 0 comments
Labels
operator Issues pertaining to the UDS Operator (Pepr) policy-engine Issues pertaining to UDS Policy Engine (Pepr) security

Comments

@mjnagel
Copy link
Contributor

mjnagel commented Jan 15, 2025

Describe what should be investigated or refactored

Currently uds-core ignores the uds-dev-stack namespace entirely for any pepr code (validations, mutations, watches). While this does make sense for the deployments of the dev/demo bundle this really should not be set by default for all core deployments as it represents an extra area of risk/namespace to audit.

With the changes upstream in pepr we should be able to remove uds-dev-stack from our defaults, and instead move it to the helm value additionalIgnoredNamespaces as a bundle override for the dev/demo bundles. This may need special handling for single-layer tests since they do not deploy with a bundle.

Links to any relevant code

This will be dependent on defenseunicorns/pepr#1641 being released in a new Pepr version.

Additional context

This will be a breaking change that should be noted as such since end users could be relying on this namespace being ignored. It may also be worth noting this bundle override in the documentation to help in scenarios where there are other system namespaces that need to be ignored. This should be done with a note of caution due to the security implications of making this change.

@mjnagel mjnagel added operator Issues pertaining to the UDS Operator (Pepr) policy-engine Issues pertaining to UDS Policy Engine (Pepr) security labels Jan 15, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
operator Issues pertaining to the UDS Operator (Pepr) policy-engine Issues pertaining to UDS Policy Engine (Pepr) security
Projects
None yet
Development

No branches or pull requests

1 participant