intents-operator
Kyverno
intents-operator | Kyverno | |
---|---|---|
10 | 35 | |
278 | 5,119 | |
1.8% | 1.6% | |
9.3 | 9.9 | |
4 days ago | 8 days ago | |
Go | Go | |
Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
intents-operator
-
Otterize launches open-source, declarative IAM permissions for workloads on AWS EKS clusters
No more! The open-source intents-operator and credentials-operator enable you to achieve the same, except without all that work: do it all from Kubernetes, declaratively, and just-in-time, through the magic of IBAC (intent-based access control).
-
Alternative to Network Policys
As you've mentioned, it is not possible to define deny rules using the native NetworkPolicy resource. Instead, you could use your CNI’s implementation for network policies. If you use Calico as your CNI you can use Calico's network policies to create deny rules. You can also take a look at Otterize OSS, an open-source solution my team and I are working on recently. It simplifies network policies by defining them from the client’s perspective in a ClientIntents resource. You can use the network mapper to auto-generate those ClientIntents from the traffic in your cluster, and then deploy them and let the intents-operator manage the network policies for you.
-
Did I miss something here, regarding network policies and helm templates? (Slightly ranty)
However, if you want to control pod-to-pod communication, you might be better suited with managing network policies using ClientIntents, which let you specify which pods should communicate with which, from the client's point of view, and without requiring labels beforehand. It's open source, have a look at the intents operator here: https://github.com/otterize/intents-operator
-
Can I create a NetworkPolicy with podSelector that matches a pod name instead of its labels?
You can try it out by installing an open source, standalone Kubernetes operator that implements them using network policies - https://github.com/otterize/intents-operator
-
Monthly 'Shameless Self Promotion' thread - 2022/12
Hi! I'm Tomer, the CEO of Otterize - a cloud-native open-source tool that makes secure access transparent for developers with a declarative approach to service-to-service authorization. Otterize allows you to automate the creation of network policies and Kafka ACLs in a Kubernetes cluster using a human-readable format. Just declare which services your code intends to call using a Kubernetes custom resource, and access will be granted automatically while blocking anything else. Give it a try! It's free and takes 5 min to get started. https://github.com/otterize/intents-operator
-
Creating network policies for pods with services
You can use https://github.com/otterize/intents-operator to easily configure network policies using only pod names by specifying logical connections (a->b, c->b), and the operator configures network policies and labels for cluster resources automatically.
- otterize/intents-operator: Manage network policies and Kafka ACLs in a Kubernetes cluster with ease.
- Show HN: Intents Operator, turns dev intent into K8s netpolicies and Kafka ACLs
-
What's your take on Zero Trust for Kubernetes?
I'm very passionate about this as I think cybersecurity and ops people lean too far into control -- controlling people, that is, not just programs, and they end up shooting themselves in the foot. Instead, I think you should make it easy for devs in your team to create the right access controls, and that this is the only way to achieve zero trust. Zero-trust inherently relies on all access being intentional and authorized, so if other engineers don't declare which access their code needs, it's impossible to achieve. There's an open source Kubernetes operator that aims to get this concept right with network policies and Kafka ACLs - make it easy for one person to declare which access is intentional and start rolling out zero trust using network policies, and have the access control policy live alongside the client code. Check it out at https://github.com/otterize/intents-operator. Full disclosure - I'm one of the contributors, so I'm a bit biased ;) I'm there on the Slack, so feel free to hit me up (Ori).
-
Manage network policies and Kafka ACLs in a Kubernetes cluster with ease
Hi all, I’m Tomer @Otterize. We just launched an open-source tool to easily automate the creation of network policies and Kafka ACLs in a Kubernetes cluster using a human-readable format, via a custom resource. Check it out - https://github.com/otterize/intents-operator
Kyverno
-
Stop 'k rollout restart deploy' from restarting everything?
Anyway, I haven’t checked for sure as I’m away from laptop but it should be possible to use something like Kyverno to block that operation. We had to do similar in the past to hotfix a bug in our CLI tool. I wrote a blog post about it that might give you an idea: https://www.giantswarm.io/blog/restricting-cluster-admin-permissions
-
An Overview of Kubernetes Security Projects at KubeCon Europe 2023
Cosign is used for signing containers through a variety of different methods. It has strong integration with other open source tools, such as Kyverno.
- Kyverno
-
container signing and verification using cosign and kyverno
cosign: https://docs.sigstore.dev/cosign/overview/ kyverno: https://kyverno.io/
-
Introduction to Day 2 Kubernetes
Kyverno - Kubernetes Native Policy Management
-
Admission controller to mutate cpu requests?
You could use a policy tool like kyverno or OPA.
-
Multi-tenancy with ProjectSveltos
Kyverno is present in the management cluster;
-
Did I miss something here, regarding network policies and helm templates? (Slightly ranty)
You do still have to create a policy for every namespace, but don't have to worry about labeling individual pods. We're starting to move to Helm/kustomize for our namespaces to deploy default things like network policies to each one, and we're also starting to use kyverno more, which I think is a little more purpose built for this type of thing than metacontroller is.
-
kubernetes provider resources v1 vs non-v1 is it just me or is this dumb?
I knew it was unsupported so about 6 months ago I had started an effort to switch to Kyverno, which is far better and actually supported. The version of Kyverno I was using had a v1beta1 AdmissionController. Fortunately that was in a helm chart so easily caught by pluto before my upgrade.
-
Kyverno Policy As Code Using CDK8S
Kyverno Kyverno is a policy engine designed for Kubernetes, Kyverno policies can validate, mutate, and generate Kubernetes resources plus ensure OCI image supply chain security.
What are some alternatives?
kubelet-csr-approver - Kubernetes controller to enable automatic kubelet CSR validation after a series of (configurable) security checks
falco - Cloud Native Runtime Security
certify - :lock: Create private CA and Issue Certificates without hassle
gatekeeper - 🐊 Gatekeeper - Policy Controller for Kubernetes
network-mapper - Map Kubernetes traffic: in-cluster, to the Internet, and to AWS IAM and export as text, intents, or an image
Kubewarden - Kubewarden is a policy engine for Kubernetes. It helps with keeping your Kubernetes clusters secure and compliant. Kubewarden policies can be written using regular programming languages or Domain Specific Languages (DSL) sugh as Rego. Policies are compiled into WebAssembly modules that are then distributed using traditional container registries.
argocd-example-apps - Example Apps to Demonstrate Argo CD
OPA (Open Policy Agent) - Open Policy Agent (OPA) is an open source, general-purpose policy engine.
ziti - The parent project for OpenZiti. Here you will find the executables for a fully zero trust, application embedded, programmable network @OpenZiti
k-rail - Kubernetes security tool for policy enforcement
Lux - Lux is a command-line interface for controlling and monitoring Govee lighting, built in Go.
checkov - Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.