Skip to content

Commit 70d03aa

Browse files
alcampagalcampag
committed
Added OKE policies.md
1 parent c23775b commit 70d03aa

File tree

2 files changed

+138
-0
lines changed

2 files changed

+138
-0
lines changed

‎app-dev/devops-and-containers/oke/README.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ Reviewed: 20.12.2023
5151
- [Selecting a cloud native microservice framework](https://louwersj.medium.com/selecting-a-cloud-native-microservice-framework-9974e9534da1)
5252
- [Deploying a spring boot microservice in K8s](https://techdozo.dev/deploying-a-restful-spring-boot-microservice-on-kubernetes/)
5353
- [Collection of Labs](https://oracle.github.io/cloudtestdrive/AppDev/cloud-native/livelabs/)
54+
- [OKE policies](./oke-policies/policies.md)
5455

5556
# Reusable Assets Overview
5657

‎app-dev/devops-and-containers/oke/oke-policies/policies.md

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
## OKE Policies
2+
3+
4+
5+
### VCN NATIVE CNI
6+
7+
When network compartment is not the same as OKE compartment AND OKE is using VCN\_NATIVE CNI
8+
9+
[https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengpodnetworking\_topic-OCI\_CNI\_plugin.htm](https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengpodnetworking_topic-OCI_CNI_plugin.htm)
10+
11+
```
12+
Allow any-user to manage instances in compartment <compartment-ocid-of-nodepool> where all { request.principal.id = '<cluster-ocid>' }
13+
Allow any-user to use private-ips in compartment <compartment-ocid-of-network-resources> where all { request.principal.id = '<cluster-ocid>' }
14+
Allow any-user to use network-security-groups in compartment <compartment-ocid-of-network-resources> where all { request.principal.id = '<cluster-ocid>' }
15+
```
16+
17+
18+
19+
### USE IPv6 WITH VCN NATIVE CNI
20+
21+
[https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengpodnetworking\_topic-OCI\_CNI\_plugin.htm](https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengpodnetworking_topic-OCI_CNI_plugin.htm)
22+
23+
[https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/conteng\_ipv4-and-ipv6.htm](https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/conteng_ipv4-and-ipv6.htm)
24+
25+
UNCLEAR: Maybe this policy is necessary for every IPv6 cluster
26+
27+
```
28+
Allow any-user to use ipv6s in compartment <compartment-ocid-of-network-resources> where all { request.principal.id = '<cluster-ocid>' }
29+
```
30+
31+
32+
33+
### ENCRYPT BOOT VOLUME WITH KEY
34+
35+
To encrypt OKE worker nodes boot volume with a key that is in a different compartment than the worker nodes
36+
37+
[https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengpolicyconfig.htm#contengpolicyconfig\_topic\_Create\_Policies\_for\_User\_Managed\_Encryption](https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengpolicyconfig.htm#contengpolicyconfig_topic_Create_Policies_for_User_Managed_Encryption)
38+
39+
```
40+
Allow any-user to use key-delegates in <compartment-key> where ALL {request.principal.type='nodepool', target.key.id = '<key_OCID>'}
41+
Allow service blockstorage to use keys in compartment <compartment-key> where target.key.id = '<key_OCID>'
42+
Allow any-user to use key-delegates in compartment <compartment-key> where ALL {request.principal.type='nodepool', target.key.id = '<key_OCID>'}
43+
```
44+
45+
46+
47+
### ENCRYPT BLOCK VOLUME WITH KEY
48+
49+
To enable encryption on block volumes with a key in a different compartment than the worker nodes
50+
51+
[https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengpolicyconfig.htm#contengpolicyconfig\_topic\_Create\_Policies\_for\_User\_Managed\_Encryption](https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengpolicyconfig.htm#contengpolicyconfig_topic_Create_Policies_for_User_Managed_Encryption)
52+
53+
```
54+
Allow service blockstorage to use keys in compartment <compartment-key> where target.key.id = '<key-ocid>'
55+
Allow any-user to use key-delegates in compartment <compartment-key> where ALL {request.principal.type = 'cluster', target.key.id = '<key-ocid>'}
56+
```
57+
58+
59+
60+
### ENCRYPT FILE SYSTEM
61+
62+
To enable in-transit/in-place encryption of FSS
63+
64+
[https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengpolicyconfig.htm#contengpolicyconfig\_topic\_Create\_Policies\_for\_User\_Managed\_Encryption](https://docs.oracle.com/en-us/iaas/Content/ContEng/Concepts/contengpolicyconfig.htm#contengpolicyconfig_topic_Create_Policies_for_User_Managed_Encryption)
65+
66+
```
67+
Dynamic Group
68+
ALL { resource.type='filesystem', resource.compartment.id = '<file_system_compartment_OCID>' }
69+
70+
Allow dynamic-group <domain>/<dynamic-group-name> to use keys in compartment <key-compartment-name>
71+
Allow any-user to use key-delegates in compartment <compartment-key> where ALL {request.principal.type = 'cluster', target.key.id = '<key_OCID>'}
72+
```
73+
74+
75+
76+
### ENABLE CCM TO MANAGE NSGs FOR LBs and NLBs
77+
78+
[https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengconfiguringloadbalancersnetworkloadbalancers-subtopic.htm#contengcreatingloadbalancer\_topic-Specifying\_Load\_Balancer\_Security\_Rule\_Management\_Annotation](https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengconfiguringloadbalancersnetworkloadbalancers-subtopic.htm#contengcreatingloadbalancer_topic-Specifying_Load_Balancer_Security_Rule_Management_Annotation)
79+
80+
```
81+
ALLOW any-user to manage network-security-groups in compartment <compartment-name> where request.principal.type = 'cluster'
82+
ALLOW any-user to manage vcns in compartment <compartment-name> where request.principal.type = 'cluster'
83+
ALLOW any-user to manage virtual-network-family in compartment <compartment-name> where request.principal.type = 'cluster'
84+
```
85+
86+
87+
88+
### TAGGING RESOURCES DIFFERENT COMPARTMENT
89+
90+
[https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengtaggingclusterresources\_iam-tag-namespace-policy.htm#contengtaggingclusterresources\_iam-tag-namespace-policy](https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengtaggingclusterresources_iam-tag-namespace-policy.htm#contengtaggingclusterresources_iam-tag-namespace-policy)
91+
92+
```
93+
Allow any-user to use tag-namespace in compartment <compartment-ocid-tag-namespace> where all { request.principal.id = '<cluster-ocid>' }
94+
```
95+
96+
97+
98+
### USE MANAGED NODE POOL WITH CAPACITY RESERVATION
99+
100+
[https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengmakingcapacityreservations.htm#contengmakingcapacityreservations\_topic\_Using\_capacity\_reservations](https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengmakingcapacityreservations.htm#contengmakingcapacityreservations_topic_Using_capacity_reservations)
101+
102+
```
103+
Allow service oke to use compute-capacity-reservations in compartment id <compartment_capacity>
104+
Allow any-user to use compute-capacity-reservations in tenancy where request.principal.type = 'nodepool'
105+
```
106+
107+
108+
109+
### USE RESERVED PUBLIC IP IN DIFFERENT COMPARTMENTS THAN OKE
110+
111+
[https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengconfiguringloadbalancersnetworkloadbalancers-subtopic.htm#contengcreatingloadbalancer\_topic\_Specifying\_Load\_Balancer\_Reserved\_IP](https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengconfiguringloadbalancersnetworkloadbalancers-subtopic.htm#contengcreatingloadbalancer_topic_Specifying_Load_Balancer_Reserved_IP)
112+
113+
If it is a LB:
114+
115+
```
116+
ALLOW any-user to read public-ips in tenancy where request.principal.type = 'cluster'
117+
ALLOW any-user to manage floating-ips in tenancy where request.principal.type = 'cluster'
118+
```
119+
120+
121+
122+
If it is a NLB:
123+
124+
```
125+
ALLOW any-user to use private-ips in TENANCY where ALL {request.principal.type = 'cluster', request.principal.compartment.id = 'target.compartment.id'}
126+
ALLOW any-user to manage public-ips in TENANCY where ALL {request.principal.type = 'cluster', request.principal.compartment.id = 'target.compartment.id'}
127+
```
128+
129+
130+
131+
### ATTACH NSGs WHEN THEY ARE IN DIFFERENT COMPARTMENTS THAN OKE
132+
133+
[https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengconfiguringloadbalancersnetworkloadbalancers-subtopic.htm#contengcreatingloadbalancer\_topic\_Specifying\_Load\_Balancer\_Network\_Security\_Group](https://docs.oracle.com/en-us/iaas/Content/ContEng/Tasks/contengconfiguringloadbalancersnetworkloadbalancers-subtopic.htm#contengcreatingloadbalancer_topic_Specifying_Load_Balancer_Network_Security_Group)
134+
135+
```
136+
Allow any-user to use network-security-groups in compartment <network-compartment-ocid> where all { request.principal.id = '<cluster-ocid>' }
137+
```

0 commit comments

Comments
 (0)