Currently all OPA image variants except "rootless" use
uid/gid 0 (i.e. root). Per container security best
practices it is better to run as non-root. So now OPA
defaults to non-root uid/gid in images. If root user
if needed, it can be explicitly set.
The "rootless" image variant is no longer needed and
will be not published in future releases.
Also currently the debug variant is published
for `linux/amd64` platform. For `linux/arm64` only static
images are generated. The debug variant can be useful
for debugging purposes and hence this change adds that
to the static image which can then be used on amd64 and arm64 arch.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Two unrelated issues would break the Kubernetes tutorial in
recent kube versions. The first one being the SHA1 hash used
by default in at least older versions of OpenSSL, which is no
longer accepted by Kubernetes. Easy fix.
The next one is definitely a head scratcher - for whatever
reason, the subjectAltName previously provided in the config
didn't seem to be picked up in certificate signing requests.
Older versions of Kubernetes - or Go, really - would accept
the common name (CN), but more recent ones require the use of
subjectAltName, so it's possible this never "worked" as intended
but was ignored as the CN was used instead.
The docs on the topic however all suggest that the previous
config _should_ have worked, and after having spent a long time
trying to figure out why it didn't, I've found nothing to
provide any insights here. Best I have is "works on my
machine", so if anyone else would want to try this out to make
sureit works on theirs too, that'd be great.
* Use explicit hashing algorithm
* Specify -extensions as this does not seem to be picked up when
provided in config only.
Fixes#4902
Signed-off-by: Anders Eknert <anders@eknert.com>
By default, in an OpenShift cluster, pods will run as a randomly
generated non-root user. That works fine with opa, but this example
attempts to bind to port 443. Moving to bind at 8443 allows the pod to
run as a non-root user successfully (tested).
By doing this, we can also use the rootless image which is a more secure
deployment method for all Kubernetes clusters.
Signed-off-by: James Hewitt <james.hewitt@uk.ibm.com>
The tutorial had not been updated to refer to the latest version which
has an important fixes to improve performance and consistency.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The health check now supports a `?plugin` option which will make the
response depend on whether or not all configured plugins are in an OK
state.
The `bundle` parameter will now use the bundle *and* discovery plugin
statuses to determine if the bundles are ready. This corrects an issue
where discovery bundles, and bundles defined by the discovery dynamic
config, were not included with `/health?bundle=true` checks.
The URL parameter parsing has also changed to allow for omitting the
value for the `bundle` option. It will default to `true` so that
`/health?bundle=true` can be shortened to `/health?bundle`.
Fixes: #2010Fixes: #2015
Signed-off-by: Patrick East <east.patrick@gmail.com>
The *bold* strings are consistently the filename to be created in the tutorial, except for the one fixed in this PR.
Signed-off-by: Dr Nic Williams <drnicwilliams@gmail.com>
Previously the docs detailing the OPA-k8s integration only distinguished
between v1 (kube-mgmt) and v3 (gatekeeper) in the introduction page.
The debugging, primer, and tutorial pages did not explicitly state
which version they were detailing.
This change clarifies that those pages refer to the kube-mgmt
version and provide a pointer to the Gatekeeper readme.
Signed-off-by: Tim Hinrichs <tim@styra.com>
The docs have grown organically and it was time for a reorganization, specifically
helping people understand at a single glance the information
that is available in the docs.
The new docs are organized as follows:
- Core docs (policy and data)
- Use-case specific docs
- Operations
- Support
As part of the reorganization, several files were renamed and/or combined.
Also made an editing pass over what was previously the user-attribute docs
and generalized them to focus on data-replication, an issue that is
now promoted to the core docs. As part of that, updated the images
and removed the old ones; new image sources are in google slides.
Tweaked the navigation bar to give more space on the left-hand column
so that more of the topics are visible without scrolling.
Signed-off-by: Tim Hinrichs <tim@styra.com>
These changes update most of the docs to use live blocks. The
following pages have not been touched or updated significantly:
* Get Started - this page is based entirely on the REPL. We should
revisit the "Get Started" page once these changes have
landed. The existing page can live on as an introduction to the REPL
while the Get Started page can be tailored to live blocks.
* Ceph Authorization - this page has not been updated aside from
making the policy example use the live blocks for syntax
highlighting. We need to revisit the policy example and refactor the
tutorial a bit to emphasize the policy as opposed to the manifests
required to install.
* Terraform - this page has not been touched because @vgramer is
planning to update for Terraform v0.12. We can update this page once
those changes are in to avoid conflicts.
These changes also remove the use of non-Markdown code examples. All
the examples are inlined into Markdown now.
A few OPA deployment examples have been updated to enable the console
decision logging. This is better than the request/response debug logs.
Fixes#1650
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The goal is to have the Kubernetes admission control content organized
into one section. This should make it easier to incorporate Gatekeeper
content in the future.
Since the layouts are not versioned the layout logic had to be
enhanced to filter out sections that have no content for the current
version. Doing a semantic version comparison was considered but it was
unclear how to implement that properly within the Hugo template
system. Since it's unlikely that we will want to ever display empty
sections this approach seems fine.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Ashutosh Narkar