There are tools that can work as policy checker/enforcer for kubernetes and basically can help us drop all our custom admissions controllers and replace their logic with some YAML files.
The main contenders are:
All have an overlapping featureset, kyverno a bit more lightweight, OPA being a bit more complex and featureful.
Arturo: My personal suggestion would be to try with kyverno.
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Open | None | T362869 Upgrade Toolforge to Uwubernetes | |||
| Open | None | T362868 Upgrade Toolforge Kubernetes to version 1.29 | |||
| Open | None | T362867 Upgrade Toolforge Kubernetes to version 1.28 | |||
| Open | None | T359641 [infra,k8s] Upgrade Toolforge Kubernetes to version 1.27 | |||
| Open | None | T327025 Upgrade Toolforge Kubernetes to version 1.26 | |||
| Open | None | T316107 Upgrade Toolforge Kubernetes to version 1.25 | |||
| In Progress | aborrero | T279110 [infra] Replace PodSecurityPolicy in Toolforge Kubernetes | |||
| Open | None | T335131 Toolforge: replace admission controllers with an existing policy admin project |
In the 2023-05-02 council meeting it was decided to move forward with this project as part of the PSP deprecation process.