Cmsnr - cmsnr (pronounced "commissioner") is a lightweight framework for running OPA in a sidecar alongside your applications in Kubernetes.

cmsnr

Description

cmsnr (pronounced "commissioner") is a lightweight framework for running OPA in a sidecar alongside your applications in Kubernetes.

Purpose

This project gives Kubernetes users a simple way to deploy OPA policies for their apps. It has the ability to define which applications should have which policies, and allows for adding multiple policies into the same sidecar. When a policy is added or updated in the cluster, the client in each sidcar will check if the deployment name matches the name in their own deployment. If the name is a match each client then uploads that policy into it's own OPA giving that Kubernetes deployment access to that policy.

OPA Policy CRD

cmsnr uses an OPA policy CRD to store the Rego policy in the cluster. The CRD also takes a deployment name and a policy name. The deployment name should match the deployment name in the pod annotation for the deployment/pod where you want the policy to be available. The policy name is the name cmsnr will use when putting the policy in OPA.

Client

cmsnr uses the cli tool cmsnrctl to do all of it's work. It contains a lightweight client that will watch the cluster for new and updated OPA policies and update them in the corresponding deployments.

Pod Labels

cmsnr uses a mutating webhook to watch for pods with the annotation cmsnr.com/inject: enabled. Cmsnr will then inject two lightweight containers in the pod: OPA and cmsnr itself. It injects the statically linked OPA container and cmsnr itself is just a statically linked binary.

Deploy cmsnr

To deploy cmsnr, first download the most recent version from the releases page. Then simply run cmsnrctl server deploy | kubectl apply -f -

Examples

To see the functionality of cmsnr, run download the most recent version. Then run cmsnrctl server deploy | kubectl apply -f -. Then run kubectl apply -f examples/

This will create an annotated deployment and two OPA policies which will be injected into the sidecar.

Owner
John Hooks
John Hooks
https://github.com/hooksie1/cmsnr
Comments
  • cmsnr client keeps pushing policy even though it hasn't changed

    cmsnr client keeps pushing policy even though it hasn't changed

    I have just one opapolicy, but the cmsnr client keeps thinking the policy has changed and constantly pushed out a new one to opa even though the policy has not changed. If you're no longer working on this, I understand.

    time="2022-11-08T21:49:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T21:50:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T21:51:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T21:52:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T21:53:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T21:54:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T21:55:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T21:56:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T21:57:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T21:58:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T21:59:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:00:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:01:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:02:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:03:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:04:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:05:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:06:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:07:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:08:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:09:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:10:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:11:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
time="2022-11-08T22:12:50Z" level=info msg="found update for opa policy portfolios for deployment apisix"
  • Logging continually shows

    Logging continually shows "found update for opa policy xxxxx"

    Once per minute the cmsnr client is logging "found update for opa policy xxxxx" even though that opapolicy yaml has not changed. Wondering if this is just a logging issue or does cmsnr really think the opapolicy is changing every minute?

  • Bump github.com/open-policy-agent/opa from 0.40.0 to 0.43.1

    Bump github.com/open-policy-agent/opa from 0.40.0 to 0.43.1

    Bumps github.com/open-policy-agent/opa from 0.40.0 to 0.43.1.

    Release notes

    Sourced from github.com/open-policy-agent/opa's releases.

    v0.43.1

    This is a security release fixing the following vulnerabilities:

    v0.43.0

    This release contains a number of fixes, enhancements, and performance improvements.

    Object Insertion Optimization

    Rego Object insertion operations did not scale linearly (#4625) in the past, and experienced noticeable reallocation/memory movement overheads once the Object grew past 120k-150k keys in size.

    This release introduces different handling of Object internals during insert operations to avoid pathological reallocation behavior, and allows linear performance scaling up into the 500k key range and beyond.

    Tooling, SDK, and Runtime

    • Add lines covered/not covered counts to test coverage report (authored by @​FarisR99)
    • Plugins: Status and logs plugins now accept any HTTP 2xx status code (authored by @​lvisterin)
    • Runtime: Generalize OS check for MacOS to other Unix-likes (authored by @​iamleot)

    Bundles Fixes

    The Bundles system received several bugfixes and performance improvements in this release:

    • Bundle: opa bundle command now supports .yml files (#4859) authored by @​Joffref reported by @​rdrgmnzsakt
    • Plugins/Bundle: Use unique temporary files for persisting activated bundles to disk (#4782) authored by @​FredrikAppelros reported by @​FredrikAppelros
    • Server: Old policy path is now checked for bundle ownership before update (#4846)
    • Storage+Bundle: Old bundle data is now cleaned before new bundle activation (#4940)
    • Bundle: Paths are now normalized before bundle root check occurs to ensure checks are os-independent

    Storage Fixes

    The Storage system received mostly bugfixes, with a notable performance improvement for large bundles in this release:

    • storage/inmem: Speed up bundle activation by avoiding unnecessary read operations (#4898)
    • storage/inmem: Paths are now created during truncate operations if they did not exist before
    • storage/disk: Symlinks work with relative paths now (#4869)

    Rego and Topdown

    ... (truncated)

    Changelog

    Sourced from github.com/open-policy-agent/opa's changelog.

    0.43.1

    This is a security release fixing the following vulnerabilities:

    0.43.0

    This release contains a number of fixes, enhancements, and performance improvements.

    Object Insertion Optimization

    Rego Object insertion operations did not scale linearly (#4625) in the past, and experienced noticeable reallocation/memory movement overheads once the Object grew past 120k-150k keys in size.

    This release introduces different handling of Object internals during insert operations to avoid pathological reallocation behavior, and allows linear performance scaling up into the 500k key range and beyond.

    Tooling, SDK, and Runtime

    • Add lines covered/not covered counts to test coverage report (authored by @​FarisR99)
    • Plugins: Status and logs plugins now accept any HTTP 2xx status code (authored by @​lvisterin)
    • Runtime: Generalize OS check for MacOS to other Unix-likes (authored by @​iamleot)

    Bundles Fixes

    The Bundles system received several bugfixes and performance improvements in this release:

    • Bundle: opa bundle command now supports .yml files (#4859) authored by @​Joffref reported by @​rdrgmnzsakt
    • Plugins/Bundle: Use unique temporary files for persisting activated bundles to disk (#4782) authored by @​FredrikAppelros reported by @​FredrikAppelros
    • Server: Old policy path is now checked for bundle ownership before update (#4846)
    • Storage+Bundle: Old bundle data is now cleaned before new bundle activation (#4940)
    • Bundle: Paths are now normalized before bundle root check occurs to ensure checks are os-independent

    Storage Fixes

    The Storage system received mostly bugfixes, with a notable performance improvement for large bundles in this release:

    ... (truncated)

    Commits
    • 196c92d Release v0.43.1
    • 3e8c754 ast/compile: respect unsafeBuiltinMap for 'with' replacements
    • b78756f build: bump golang: 1.18 -> 1.18.6
    • d75bbdd Prepare v0.43.0 release (#4949)
    • a99e5a9 docs: add warning about importing 'future.keywords' (#4947)
    • 8f63046 storage+bundle: Clean old bundle data before new activation (#4944)
    • 462d518 docs: Add note about counter_server_query_cache_hit metric (#4946)
    • eff91f7 build(deps): bump aquasecurity/trivy-action from 0.6.0 to 0.6.1 (#4941)
    • 1c1957c topdown/copypropagation: keep refs into livevars (#4936)
    • 7f78653 build: run 'make generate' in release container (#4934)
    • Additional commits viewable in compare view

    Dependabot compatibility score

    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

    Dependabot commands and options

    You can trigger Dependabot actions by commenting on this PR:

    • @dependabot rebase will rebase this PR
    • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • @dependabot merge will merge this PR after your CI passes on it
    • @dependabot squash and merge will squash and merge this PR after your CI passes on it
    • @dependabot cancel merge will cancel a previously requested merge and block automerging
    • @dependabot reopen will reopen this PR if it is closed
    • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
    • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
    • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
    • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
    • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

    You can disable automated security fix PRs for this repo from the Security Alerts page.

  • Deleting an opapolicies should delete the corresponding policy in the opa sidecar

    Deleting an opapolicies should delete the corresponding policy in the opa sidecar

    If I create/modify an opapolicies yaml and apply it, it correctly creates/modifies the policy in the opa sidecar, however if I delete the opapolicies it does not remove the policy from the opa sidecar

  • Bump github.com/open-policy-agent/opa from 0.40.0 to 0.42.0

    Bump github.com/open-policy-agent/opa from 0.40.0 to 0.42.0

    Bumps github.com/open-policy-agent/opa from 0.40.0 to 0.42.0.

    Release notes

    Sourced from github.com/open-policy-agent/opa's releases.

    v0.42.0

    This release contains a number of fixes and enhancements.

    New built-in function: object.subset

    This function checks if a collection is a subset of another collection. It works on objects, sets, and arrays.

    If both arguments are objects, then the operation is recursive, e.g. {"c": {"x": {10, 15, 20}} is considered a subset of {"a": "b", "c": {"x": {10, 15, 20, 25}, "y": "z"}.

    See the built-in functions docs for all details

    This implementation fixes #4358 and was authored by @​charlesdaniels.

    New keywords: "contains" and "if"

    These new keywords let you increase the expressiveness of your policy code:

    Before

    package authz
allow { not denied } # `denied` left out for presentation purposes

    deny[msg] {
count(violations) > 0
msg := sprintf("there are %d violations", [count(violations)])
}

    After

    package authz
import future.keywords

    allow if not denied # one expression only => no { ... } needed!
    

    deny contains msg if {
count(violations) > 0
msg := sprintf("there are %d violations", [count(violations)])
}

    Note that rule bodies containing only one expression can be abbreviated when using if.

    To use the new keywords, use import future.keywords.contains and import future.keywords.if; or import all of them at once via import future.keywords. When these future imports are present, the pretty printer (opa fmt) will introduce contains and if where applicable.

    if is allowed in all places to separate the rule head from the body, like

    </tr></table>

    ... (truncated)

    Changelog

    Sourced from github.com/open-policy-agent/opa's changelog.

    0.42.0

    This release contains a number of fixes and enhancements.

    New built-in function: object.subset

    This function checks if a collection is a subset of another collection. It works on objects, sets, and arrays.

    If both arguments are objects, then the operation is recursive, e.g. {"c": {"x": {10, 15, 20}} is considered a subset of {"a": "b", "c": {"x": {10, 15, 20, 25}, "y": "z"}.

    See the built-in functions docs for all details

    This implementation fixes #4358 and was authored by @​charlesdaniels.

    New keywords: "contains" and "if"

    These new keywords let you increase the expressiveness of your policy code:

    Before

    package authz
allow { not denied } # `denied` left out for presentation purposes

    deny[msg] {
count(violations) > 0
msg := sprintf("there are %d violations", [count(violations)])
}

    After

    package authz
import future.keywords

    allow if not denied # one expression only => no { ... } needed!
    

    deny contains msg if {
count(violations) > 0
msg := sprintf("there are %d violations", [count(violations)])
}

    Note that rule bodies containing only one expression can be abbreviated when using if.

    To use the new keywords, use import future.keywords.contains and import future.keywords.if; or import all of them at once via import future.keywords. When these future imports are present, the

    ... (truncated)

    Commits

    Dependabot compatibility score

    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

    Dependabot commands and options

    You can trigger Dependabot actions by commenting on this PR:

    • @dependabot rebase will rebase this PR
    • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • @dependabot merge will merge this PR after your CI passes on it
    • @dependabot squash and merge will squash and merge this PR after your CI passes on it
    • @dependabot cancel merge will cancel a previously requested merge and block automerging
    • @dependabot reopen will reopen this PR if it is closed
    • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
    • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
    • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
    • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
    • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

    You can disable automated security fix PRs for this repo from the Security Alerts page.

  • Bump github.com/open-policy-agent/opa from 0.35.0 to 0.37.0

    Bump github.com/open-policy-agent/opa from 0.35.0 to 0.37.0

    Bumps github.com/open-policy-agent/opa from 0.35.0 to 0.37.0.

    Release notes

    Sourced from github.com/open-policy-agent/opa's releases.

    v0.37.0

    This release contains a number of fixes and enhancements.

    This is the first release that includes a binary and a docker image for linux/arm64, opa_linux_arm64_static and openpolicyagent/opa:0.37.0-static. Thanks to @​ngraef for contributing the build changes necessary.

    Strict Mode

    There have been numerous possible checks in the compiler that fall into this category:

    1. They would help avoid common mistakes; but
    2. Introducing them would potentially break some uncommon, but legitimate use.

    We've thus far refrained from introducing them. Now, a new "strict mode" allows you to opt-in to these checks, and we encourage you to do so!

    With OPA 1.0, they will become the new default behaviour.

    For more details, see the docs on Compiler Strict Mode.

    Delta Bundles

    Delta bundles provide a more efficient way to make data changes by containing patches to data instead of snapshots. Using them together with HTTP Long Polling, you can propagate small changes to bundles without waiting for polling delays.

    See the documentation for more details.

    Tooling and Runtime

    • Bundles bug fix: Roundtrip manifest before hashing to allow changing the manifest and still using signature verification of bundles (#4233), reported by @​CristianJena

    • The test runner now also supports custom builtins, when invoked through the Golang interface (authored by @​MIA-Deltat1995)

    • The compile package and the opa build command support a new output format: "plan". It represents a query plan, steps needed to take to evaluate a query (with policies). The plan format is a JSON encoding of the intermediate representation (IR) used for compiling queries and policies into Wasm.

      When calling opa build -t plan ..., the plan can be found in plan.json at the top- level directory of the resulting bundle.tar.gz. See the documentation for details..

    ... (truncated)

    Changelog

    Sourced from github.com/open-policy-agent/opa's changelog.

    0.37.0

    This release contains a number of fixes and enhancements.

    This is the first release that includes a binary and a docker image for linux/arm64, opa_linux_arm64_static and openpolicyagent/opa:0.37.0-static. Thanks to @​ngraef for contributing the build changes necessary.

    Strict Mode

    There have been numerous possible checks in the compiler that fall into this category:

    1. They would help avoid common mistakes; but
    2. Introducing them would potentially break some uncommon, but legitimate use.

    We've thus far refrained from introducing them. Now, a new "strict mode" allows you to opt-in to these checks, and we encourage you to do so!

    With OPA 1.0, they will become the new default behaviour.

    For more details, see the docs on Compiler Strict Mode.

    Delta Bundles

    Delta bundles provide a more efficient way to make data changes by containing patches to data instead of snapshots. Using them together with HTTP Long Polling, you can propagate small changes to bundles without waiting for polling delays.

    See the documentation for more details.

    Tooling and Runtime

    • Bundles bug fix: Roundtrip manifest before hashing to allow changing the manifest and still using signature verification of bundles (#4233), reported by @​CristianJena

    • The test runner now also supports custom builtins, when invoked through the Golang interface (authored by @​MIA-Deltat1995)

    • The compile package and the opa build command support a new output format: "plan". It represents a query plan, steps needed to take to evaluate a query (with policies). The plan format is a JSON encoding of the intermediate representation (IR) used for compiling queries and policies into Wasm.

      When calling opa build -t plan ..., the plan can be found in plan.json at the top- level directory of the resulting bundle.tar.gz. See the documentation for details..

    ... (truncated)

    Commits
    • ad4f4f1 Prepare 0.37.0 release (#4309)
    • a18f53d compile: adds metadata field to .manifest (#4306)
    • 01ca4a6 build(deps): bump ansi-regex in /docs/website/scripts/live-blocks (#4308)
    • 42a559c build(deps): bump github.com/prometheus/client_golang (#4307)
    • 503a520 ast: Deprecating any() and all() built-in functions (#4271)
    • 59810d0 ast: Making input and data reserved keywords in strict-mode (#4301)
    • dd02a7f Add support for delta bundles
    • cb867a1 ast/compile: 'every' rewriting steps (#4231)
    • d12fb7c docs: Update generated CLI docs
    • 4449d96 docs: add explanation of the IR
    • Additional commits viewable in compare view

    Dependabot compatibility score

    Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

    Dependabot commands and options

    You can trigger Dependabot actions by commenting on this PR:

    • @dependabot rebase will rebase this PR
    • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • @dependabot merge will merge this PR after your CI passes on it
    • @dependabot squash and merge will squash and merge this PR after your CI passes on it
    • @dependabot cancel merge will cancel a previously requested merge and block automerging
    • @dependabot reopen will reopen this PR if it is closed
    • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
    • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
    • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
    • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
    • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
    • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
    • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

    You can disable automated security fix PRs for this repo from the Security Alerts page.

  • The injector doesn't work if the deployment is in a different namespace

    The injector doesn't work if the deployment is in a different namespace

    Seems to only work if the deployment to be injected is in the same namespace as the mutating webhook. Otherwise repeatedly throws the error:

    time="2022-02-07T21:22:59Z" level=info msg="Injecting sidecar for "
time="2022-02-07T21:22:59Z" level=info msg="no service account defined, adding cmsnr account"
  • Validating Policies that Reference Other Packages

    Validating Policies that Reference Other Packages

    If a policy references another package the validating webhook cannot validate the policy because it doesn't have access to the policy being referenced.

Related tags
DevOps Tools cmsnr
A plugin for running Open Policy Agent (OPA) in AWS Lambda as a Lambda Extension.

opa-lambda-extension-plugin A custom plugin for running Open Policy Agent (OPA) in AWS Lambda as a Lambda Extension. To learn more about how Lambda Ex

Jan 2, 2023
twtr (pronounced "tweeter") is a drop-in replacement of the original twtxt client

twtr twtr (pronounced "tweeter") is a drop-in replacement of the original twtxt client, with some extensions and bonus features, so you can make the s

Jun 24, 2022
A docker container that can be deployed as a sidecar on any kubernetes pod to monitor PSI metrics

CgroupV2 PSI Sidecar CgroupV2 PSI Sidecar can be deployed on any kubernetes pod with access to cgroupv2 PSI metrics. About This is a docker container

Nov 23, 2021
Helper sidecar for exposing Prometheus metrics as service

metrics-server-go Helper sidecar service for exposing prometheus metrics. Application expose endpoints to update defined metrics. Whats inside? The se

Feb 3, 2022
Tcpdump-webhook - Toy Sidecar Injection with Mutating Webhook

tcpdump-webhook A simple demonstration of Kubernetes Mutating Webhooks. Injects

Feb 8, 2022
KEDA is a Kubernetes-based Event Driven Autoscaling component. It provides event driven scale for any container running in Kubernetes
KEDA is a Kubernetes-based Event Driven Autoscaling component. It provides event driven scale for any container running in Kubernetes

Kubernetes-based Event Driven Autoscaling KEDA allows for fine-grained autoscaling (including to/from zero) for event driven Kubernetes workloads. KED

Jan 7, 2023
Carrier is a Kubernetes controller for running and scaling game servers on Kubernetes.
 Carrier is a Kubernetes controller for running and scaling game servers on Kubernetes.

Carrier is a Kubernetes controller for running and scaling game servers on Kubernetes. This project is inspired by agones. Introduction Genera

Nov 25, 2022
The OCI Service Operator for Kubernetes (OSOK) makes it easy to connect and manage OCI services from a cloud native application running in a Kubernetes environment.

OCI Service Operator for Kubernetes Introduction The OCI Service Operator for Kubernetes (OSOK) makes it easy to create, manage, and connect to Oracle

Sep 27, 2022
kitex running in kubernetes cluster and discover each other in kubernetes Service way

Using kitex in kubernetes Kitex [kaɪt'eks] is a high-performance and strong-extensibility Golang RPC framework. This go module helps you to build mult

Feb 21, 2022
Sign Container Images with cosign and Verify signature by using Open Policy Agent (OPA)
 Sign Container Images with cosign and Verify signature by using Open Policy Agent (OPA)

Sign Container Images with cosign and Verify signature by using Open Policy Agent (OPA) In the beginning, I believe it is worth saying that this proje

Nov 30, 2022
runtime - an abstraction library on top of the Open Policy Agent (OPA)

runtime - an abstraction library on top of the Open Policy Agent (OPA) Introduction The "runtime" project is a library that sits on top of OPA. The go

Nov 7, 2022
🔮 ✈️ to integrate OPA Gatekeeper's new ExternalData feature with cosign to determine whether the images are valid by verifying their signatures

cosign-gatekeeper-provider To integrate OPA Gatekeeper's new ExternalData feature with cosign to determine whether the images are valid by verifying i

Dec 8, 2022
Generic inquiry tool to OPA server for CI process, such as GitHub Actions

opaq opaq is a generic inquiry tool to OPA server. A major purpose of this tool is for inquiry in GitHub Actions. Features Data formatting: OPA server

Jan 20, 2022
Hot-swap Kubernetes clusters while keeping your microservices up and running.

Okra Okra is a Kubernetes controller and a set of CRDs which provide advanced multi-cluster appilcation rollout capabilities, such as canary deploymen

Nov 23, 2022
This repo includes several winrm applications like transfering files, running commands.
 This repo includes several winrm applications like transfering files, running commands.

WinRM Tools This repo includes several WinRM tools written with Go: File transfering between two Powershell session. Running command on remote Powersh

Nov 26, 2022
🛅 Backup your Kubernetes Stateful Applications

Stash Stash by AppsCode is a cloud-native data backup and recovery solution for Kubernetes workloads. If you are running production workloads in Kuber

Jan 7, 2023
Kubernetes OS Server - Kubernetes Extension API server exposing OS configuration like sysctl via Kubernetes API

KOSS is a Extension API Server which exposes OS properties and functionality using Kubernetes API, so it can be accessed using e.g. kubectl. At the moment this is highly experimental and only managing sysctl is supported. To make things actually usable, you must run KOSS binary as root on the machine you will be managing.

May 19, 2021
An Easy to use Go framework for Kubernetes based on kubernetes/client-go

k8devel An Easy to use Go framework for Kubernetes based on kubernetes/client-go, see examples dir for a quick start. How to test it ? Download the mo

Mar 25, 2022
A kubernetes plugin which enables dynamically add or remove GPU resources for a running Pod
 A kubernetes plugin which enables dynamically add or remove GPU resources for a running Pod

GPU Mounter GPU Mounter is a kubernetes plugin which enables add or remove GPU resources for running Pods. This Introduction(In Chinese) is recommende

Jan 5, 2023