Skip to content

Commit

Permalink
Updating readme for v1
Browse files Browse the repository at this point in the history
Signed-off-by: Ben <[email protected]>
  • Loading branch information
slashben committed May 9, 2024
1 parent f820674 commit be93662
Show file tree
Hide file tree
Showing 2 changed files with 13 additions and 7 deletions.
8 changes: 3 additions & 5 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,12 +4,10 @@ This is a library of policies based on [Kubescape controls](https://hub.armosec.

## Using the library

*Note: Kubernetes Validating Admission Policy feature _is _still in _its_ early phase_.
It has been released as an betav1 feature in Kubernetes 1.28,
and you need to enable its feature gate to be able to use it. Therefore it is not yet production ready. Look [here](docs/validating-admission-policies/README.md) for _how to _set up_ a playground_.*
Kubernetes Validating Admission Policy (or *VAP*) feature was released as a GA feature in version 1.30 and it is a releatively new feature (this library supports alpha and beta versions as well). Before you start playing with it, make sure you have a cluster that supports this feature. Look [here](docs/validating-admission-policies/README.md) for _how to _set up_ a playground_.*


Install latest the release of the library:
Install latest the release of the library (`v1` version of *VAP*):
```bash
# Install configuration CRD
kubectl apply -f https://github.com/kubescape/cel-admission-library/releases/latest/download/policy-configuration-definition.yaml
Expand All @@ -26,7 +24,7 @@ You can apply policies to objects, for example, to apply control [C-0016](https:
```bash
# Creating a binding
kubectl apply -f - <<EOT
apiVersion: admissionregistration.k8s.io/v1beta1
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicyBinding
metadata:
name: c0016-binding
Expand Down
12 changes: 10 additions & 2 deletions docs/validating-admission-policies/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,11 @@

## Cluster

[Validating Admission Policies](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/) have been introduced in Kubernetes 1.26 and they are under feature gate. In order to enable them:
[Validating Admission Policies](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/) have been introduced in Kubernetes 1.26 and they are under feature-gate. This feature was released for GA in Kubernetes 1.30 (without feature-gate).

### Older Kubernetes versions (1.26 throughout 1.29)

You need to enable the feature-gate in the API Server. In order to enable them:
* turn on `ValidatingAdmissionPolicy` feature gate
* turn on `admissionregistration.k8s.io/v1alpha1` or `admissionregistration.k8s.io/v1beta1` depending on whether you are using 1.26/1.27 (alpha) or 1.28 (beta)

Expand All @@ -12,6 +16,10 @@ For minikube users, this is an example of how to enable:
minikube start --kubernetes-version=v1.28.0-rc.1 --extra-config=apiserver.runtime-config=admissionregistration.k8s.io/v1beta1 --feature-gates='ValidatingAdmissionPolicy=true'
```

### Newer versions (1.30 and above)

You don't need to do anything, *VAP* is available out of the box 😉

## Overview

We suggest reading:
Expand All @@ -29,7 +37,7 @@ kubectl label namespace vap-playground vap=enabled

Here is an example policy for denying Pods without `app` label:
```yaml
apiVersion: admissionregistration.k8s.io/v1beta1
apiVersion: admissionregistration.k8s.io/v1
kind: ValidatingAdmissionPolicy
metadata:
name: deny-pods-without-app-label
Expand Down

0 comments on commit be93662

Please sign in to comment.