demos VS Kyverno

can be found here.

The ConfigMap referenced by EventBasedAddOn instance contains all resources that will be deployed in each cluster where a Pod in crashing state is found. In this case:

All YAMLs used in this example can be found here


https://github.com/projectsveltos/sveltosctl#display-outcome...

But I was still not happy. Main reason, users still had to go and manage cluster labels. I wanted clusters' labels to change as cluster runtime state was changing. So I can express my intent and then forget about it.

So I introduced a second concept in Sveltos. Classifier CRD (https://github.com/projectsveltos/demos/blob/main/classifier...) which allows users to classify clusters based on cluster runtime state (currently kubernetes version and/or resources deployed, but I am working on adding more).

Doing so I can easily now say:

1) I wanted a controller running in the management cluster, so I can express my intent and as clusters come and go or change their runtime state, controller can make sure my intent is applied. For instance, combing Classifier and ClusterProfile I can say things like, in any cluster running kubernetes version v1.24.x install calico v3.23 and in any cluster running kubernetes version v1.25.x install calico v3.24. as clusters are created/upgraded, sveltos makes sure my intent is deployed (https://github.com/projectsveltos/demos/blob/main/classifier/classifier.gif)

So a second concept was introduced in Sveltos: Classifier CRD (https://github.com/projectsveltos/demos/blob/main/classifier/classifier.gif) which allows users to classify clusters based on cluster runtime state (currently Kubernetes version and/or resources deployed, but I am working on adding more).

Anyway, I haven’t checked for sure as I’m away from laptop but it should be possible to use something like Kyverno to block that operation. We had to do similar in the past to hotfix a bug in our CLI tool. I wrote a blog post about it that might give you an idea: https://www.giantswarm.io/blog/restricting-cluster-admin-permissions

Cosign is used for signing containers through a variety of different methods. It has strong integration with other open source tools, such as Kyverno.

cosign: https://docs.sigstore.dev/cosign/overview/ kyverno: https://kyverno.io/

Kyverno - Kubernetes Native Policy Management

You could use a policy tool like kyverno or OPA.

Kyverno is present in the management cluster;

You do still have to create a policy for every namespace, but don't have to worry about labeling individual pods. We're starting to move to Helm/kustomize for our namespaces to deploy default things like network policies to each one, and we're also starting to use kyverno more, which I think is a little more purpose built for this type of thing than metacontroller is.

I knew it was unsupported so about 6 months ago I had started an effort to switch to Kyverno, which is far better and actually supported. The version of Kyverno I was using had a v1beta1 AdmissionController. Fortunately that was in a helm chart so easily caught by pluto before my upgrade.

Kyverno Kyverno is a policy engine designed for Kubernetes, Kyverno policies can validate, mutate, and generate Kubernetes resources plus ensure OCI image supply chain security.