kyma-webhook-poc

TODO:

• proper logging - done

• securityContexts etc - done

• istio-sidecar? - for now doesn't work, we might have to add destinationRule or sth else

• production/eval profiles ? - still not done

• readiness/liveness probes - done

• prometheus metrics - provided out of the box, done

• exempt serviceaccounts from denied namespaces (from iteration review)

• serviceacounts -> handled already

• groups/users -> see gke-user.png

• kubectl exec -> denied, special verb for that action is CONNECT (see webhooks[].rules.operations)

  • available verbs are:
    • CONNECT
    • CREATE
    • UPDATE
    • DELETE

• kubectl logs -> allowed

• kubectl get,list,watch -> allowed (- do not block reading (from iteration review))

• Which kubeconfig is used to install Kyma - Still don't know

kubectl -n kyma-system run busybox --image busybox --as=system:serviceaccount:default:test-deny -- sh -c "echo something; sleep 10000"