mirror of
https://github.com/NVIDIA/OpenShell.git
synced 2026-10-21 06:11:31 +08:00
Kris Hicks
7d843b32c2
Install a ValidatingAdmissionPolicy, on by default in managed and operator workspace modes, that matches only the gateway ServiceAccount. It admits Secret, Pod, Sandbox, Service, ServiceAccount, and NetworkPolicy writes only in namespaces labeled as owned by this gateway and namespaces matching the operator selector. Secret writes are also admitted in the credential namespace when the Kubernetes Secrets credential driver is enabled. Namespace writes are admitted only for namespaces owned by this gateway, judged by their existing labels. - Skip rendering the policy when rbac.create or rbac.clusterScoped.create is false; a cluster-admin applies it with the other cluster-scoped objects. - Require Kubernetes 1.30. - Fail rendering with operatorNamespaceFile or set-based operator selectors, which the policy cannot evaluate. admissionPolicy.enabled set to false opts out. - Add e2e checks in managed and operator modes that send server-side dry-run requests as the gateway ServiceAccount outside its namespaces, including Pod creation in the sandbox and credential namespace, and assert the policy rejects them. - Document the policy and opt-out, raise the minimum Kubernetes version in the docs and support matrix, and add policy denials to the cluster debugging skill. Signed-off-by: Kris Hicks <khicks@nvidia.com>
34 lines
1.3 KiB
YAML
34 lines
1.3 KiB
YAML
# SPDX-FileCopyrightText: Copyright (c) 2025-2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
|
|
# SPDX-License-Identifier: Apache-2.0
|
|
|
|
# Namespace-admin overlay — renders only namespaced objects.
|
|
#
|
|
# Use this when a cluster-admin applies the gateway ClusterRole,
|
|
# ClusterRoleBinding, and admission policy once, out of band, and the OpenShell
|
|
# release is installed
|
|
# and upgraded by an installer that holds no cluster-scoped permissions.
|
|
#
|
|
# Generate the cluster-scoped objects for the cluster-admin step from the same
|
|
# release values, then apply them as cluster-admin:
|
|
# helm template openshell oci://ghcr.io/nvidia/openshell/helm-chart \
|
|
# --version <version> --namespace openshell -f my-values.yaml \
|
|
# --set rbac.create=true \
|
|
# --set rbac.clusterScoped.create=true \
|
|
# --set agentSandbox.preflight.enabled=false \
|
|
# --show-only templates/clusterrole.yaml \
|
|
# --show-only templates/clusterrolebinding.yaml \
|
|
# --show-only templates/workspace-admission-policy.yaml | kubectl apply -f -
|
|
#
|
|
# Omit the admission policy template in shared workspace mode, which renders
|
|
# no policy.
|
|
#
|
|
# The gateway ServiceAccount name and release namespace are unchanged, so the
|
|
# pre-created ClusterRoleBinding still matches this release.
|
|
|
|
rbac:
|
|
clusterScoped:
|
|
create: false
|
|
|
|
admissionPolicy:
|
|
enabled: false
|