enforcer-k8s

enforcer-k8s

A Kubernetes validating admission webhook that checks any container images in a pod against a specified policy.

It's intended to be used alongside Rode to prevent deployments that fail to meet certain checks.

Local Development

This project requires Go 1.16 or newer.

1. Follow the instructions to run Rode locally
2. Run skaffold dev
   • Alternatively, if you have Telepresence installed, run the enforcer on the host:

   go run main.go --rode-host=rode.rode-demo.svc.cluster.local:50051 \
       --rode-insecure \
       --policy-id="$POLICY_ID" \
       --tls-secret=default/enforcer-k8s \
       --k8s-in-cluster=false \
       --debug \
       --registry-insecure-skip-verify=true
   

3. Make any changes, then use make test to run the unit tests
   • If necessary, use make fmt to address any formatting issues
4. If new files were added, use make license to add the required source code headers

Installation

See the rode/charts repository to use the Helm chart.

Flags