Skip to content
This repository has been archived by the owner on Jan 12, 2023. It is now read-only.

Enforce a label policy on pods #42

Open
alpe opened this issue Jan 9, 2020 · 2 comments
Open

Enforce a label policy on pods #42

alpe opened this issue Jan 9, 2020 · 2 comments

Comments

@alpe
Copy link
Contributor

alpe commented Jan 9, 2020

Organisations usually come up with some best practices for monitoring and managing pods. A new policy could enforce a configurable list of labels to be mandatory to run a pod in the environment.
For example all pods should have an app label.

The policies.Config would need to be extended with a new field.

type Config struct {
...
PolicyMandatoryPodLabels  []string
}

🤔 Extensions

  • While this issue is for pods only it makes sense to think about enforcing labels for other components as well.
  • Another extension could be enforcing annotations on a type. For example kubernetes.io/ingress.class must not be empty for an ingress on a multi ingress-controller environment.
@dustin-decker
Copy link
Contributor

Good idea.

To facilitate checking labels or annotations for other kinds of resources, we could accept that in the configuration for a more generic policy:

type LabelConfig struct{
    Kinds []string
    Labels []string
    Annotations []string
}

type Config struct {
...
PolicyMandatoryLabelsOrAnnotations  struct {
    []LabelConfig
}

To do this we'd need to add another resource extractor that pulls out v1.TypeMeta and v1.ObjectMeta

@mark-adams
Copy link
Contributor

👋 The k-rail project has been deprecated and is no longer under active development. We recommend taking a look at OPA Gatekeeper to see if it might meet your needs going forward.

Thanks for your contribution(s) to the project!

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Development

No branches or pull requests

3 participants