Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add policy annotations to all GKE hardening related polices #180

Open
dekuhn opened this issue Oct 7, 2019 · 4 comments
Open

Add policy annotations to all GKE hardening related polices #180

dekuhn opened this issue Oct 7, 2019 · 4 comments
Assignees

Comments

@dekuhn
Copy link
Contributor

dekuhn commented Oct 7, 2019

Based on go/policy-bundles - the recommended annotations would look something like:
bundles.validator.forsetisecurity.org/[bundle_key]: [control]

Please add details for all GKE Hardening Policies
Example:
description: Disable the Kubernetes web UI (Dashboard)
bundles.validator.forsetisecurity.org/gke-hardening-guideline:

@dekuhn
Copy link
Contributor Author

dekuhn commented Oct 7, 2019

@joecheuk we might to define some method for the [control] value related to GKE hardening guidelines or leave it blank

@morgante
Copy link
Contributor

morgante commented Oct 8, 2019

@dekuhn I recommend not leaving the control value blank, but instead come up with a control name for each guideline. Ex.

bundles.validator.forsetisecurity.org/gke-hardening-guideline: DISABLE_WEB_UI

@dekuhn
Copy link
Contributor Author

dekuhn commented Oct 18, 2019

@morgante @ryanismert @blueandgold - FYI
@joecheuk lets move forward with the following annotation format for GKE Hardening Guidelines
bundles.validator.forsetisecurity.org/gke-hardening-v2019.11.11: DISABLE_DASHBOARD_UI

It will be up to the engineer when adding these annotations to determine the text control name e.g. DISABLE_DASHBOARD_UI for each GKE hardening guideline.

@dekuhn
Copy link
Contributor Author

dekuhn commented Oct 25, 2019

I spent a little time starting to update a few rules today.
#199
#200

@joecheuk joecheuk assigned gkowalski-google and unassigned joecheuk Jan 7, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants