mentoring VS Kyverno

Very saddened to hear this, look at this oppportunity - https://github.com/cncf/mentoring/tree/main/programs/lfx-mentorship/2023/02-Jun-Aug if u feel that u are atleast 50-60% aware with the required skills do apply.

Maybe check out the CNCF Mentorship Program. Lots of projects to contribute to: https://github.com/cncf/mentoring/blob/main/lfx-mentorship/README.md

Every quarter, this program begins with different organizations proposing project ideas that they’d like the mentees to work on. For a period of around 2 weeks, they propose their ideas over the cncf/mentorship repository.

The LFX mentorship is a remote learning opportunity for the open-source contributors who will be working for 12 weeks under the guidance of mentors who are maintainers and developers of the particular project and they help the mentees to contribute to the community and project. This mentorship program is organized thrice a year i.e. Spring, Summer, and Fall months. There are many organizations like CNCF, Hyperledger, and so on which provide mentorships in different projects of it under the umbrella of LFX.

As part of the program, CNCF is encouraging Open Source contributors to get paid while working on various cloud-native projects like Kubernetes, Litmus, Prometheus, etc. The application process is explained in detail here.

This program would never have finished without the hard work of Ihor Dvoretskyi and CNCF community members, thank you so much for everything.

Anyway, I haven’t checked for sure as I’m away from laptop but it should be possible to use something like Kyverno to block that operation. We had to do similar in the past to hotfix a bug in our CLI tool. I wrote a blog post about it that might give you an idea: https://www.giantswarm.io/blog/restricting-cluster-admin-permissions

Cosign is used for signing containers through a variety of different methods. It has strong integration with other open source tools, such as Kyverno.

cosign: https://docs.sigstore.dev/cosign/overview/ kyverno: https://kyverno.io/

Kyverno - Kubernetes Native Policy Management

You could use a policy tool like kyverno or OPA.

Kyverno is present in the management cluster;

You do still have to create a policy for every namespace, but don't have to worry about labeling individual pods. We're starting to move to Helm/kustomize for our namespaces to deploy default things like network policies to each one, and we're also starting to use kyverno more, which I think is a little more purpose built for this type of thing than metacontroller is.

I knew it was unsupported so about 6 months ago I had started an effort to switch to Kyverno, which is far better and actually supported. The version of Kyverno I was using had a v1beta1 AdmissionController. Fortunately that was in a helm chart so easily caught by pluto before my upgrade.

Kyverno Kyverno is a policy engine designed for Kubernetes, Kyverno policies can validate, mutate, and generate Kubernetes resources plus ensure OCI image supply chain security.