Skip to content

Commit 541d606

Browse files
butler54butler54
authored
feat: initial drop (#2)
* feat: initial drop Signed-off-by: Chris Butler <[email protected]> * chore: actually add the files Signed-off-by: Chris Butler <[email protected]> * fix: restrict access rights further Signed-off-by: Chris Butler <[email protected]> * fix: linting issues Signed-off-by: Chris Butler <[email protected]> * fix: revert superlinter for now to simpler workflow Signed-off-by: Chris Butler <[email protected]> --------- Signed-off-by: Chris Butler <[email protected]>
1 parent ed5e9ec commit 541d606

File tree

11 files changed

+249
-21
lines changed

11 files changed

+249
-21
lines changed

‎.github/workflows/conventional-pr.yml‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
name: "Lint PR title"
2+
3+
on:
4+
pull_request_target:
5+
types:
6+
- opened
7+
- edited
8+
- synchronize
9+
branches:
10+
- 'main'
11+
12+
permissions:
13+
contents: read
14+
pull-requests: read
15+
16+
jobs:
17+
lint:
18+
if: ${{ github.head_ref != 'develop' }}
19+
runs-on: ubuntu-latest
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@v4
23+
with:
24+
persist-credentials: false
25+
- name: Install dependencies
26+
run: npm install @commitlint/cli @commitlint/config-conventional
27+
28+
- name: Validate PR title
29+
run: |
30+
PR_TITLE=$(jq -r '.pull_request.title' "$GITHUB_EVENT_PATH")
31+
echo "$PR_TITLE" | npx commitlint --config commitlint.config.js

‎.github/workflows/superlinter.yml‎

Lines changed: 38 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,39 @@
11
---
2-
name: Super linter
3-
4-
on:
5-
pull_request:
6-
branches: [main]
7-
8-
permissions:
9-
contents: read
10-
11-
jobs:
12-
lint:
13-
uses: validatedpatterns/github-actions-library/.github/workflows/superlinter.yml@v1
14-
with:
15-
sl_env: |
16-
VALIDATE_BIOME_FORMAT=false
2+
name: Super linter
3+
4+
on: [push, pull_request]
5+
permissions: read-all
6+
7+
jobs:
8+
build:
9+
# Name the Job
10+
name: Super linter
11+
# Set the agent to run on
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Checkout Code
16+
uses: actions/checkout@v5
17+
with:
18+
# Full git history is needed to get a proper list of changed files within `super-linter`
19+
fetch-depth: 0
20+
21+
################################
22+
# Run Linter against code base #
23+
################################
24+
- name: Lint Code Base
25+
uses: super-linter/super-linter/slim@v7
26+
env:
27+
VALIDATE_ALL_CODEBASE: true
28+
DEFAULT_BRANCH: main
29+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
30+
# These are the validation we disable atm
31+
# Temporarily
32+
VALIDATE_CHECKOV: false
33+
VALIDATE_JSON_PRETTIER: false
34+
VALIDATE_KUBERNETES_KUBECONFORM: false
35+
VALIDATE_MARKDOWN: false
36+
VALIDATE_MARKDOWN_PRETTIER: false
37+
VALIDATE_YAML: false
38+
VALIDATE_YAML_PRETTIER: false
39+

‎.prettierrc‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
{
2+
"singleQuote": true,
3+
"semi": false
4+
}

‎Chart.yaml‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,9 @@
11
apiVersion: v2
2-
description: A Helm chart to serve as the Validated Patterns Template
2+
description: A Helm chart to build and push polcies to support sandboxed containers into the spoke cluster of a validated pattern.
33
keywords:
44
- pattern
5-
name: vp-template
5+
- sandboxed-containers
6+
- confidential-computing
7+
- confidential-containers
8+
name: sandboxed-policies
69
version: 0.0.1

‎README.md‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,29 @@
1-
# vp-template
1+
# sandboxed-policies
22

33
![Version: 0.0.1](https://img.shields.io/badge/Version-0.0.1-informational?style=flat-square)
44

5-
A Helm chart to serve as the Validated Patterns Template
5+
A Helm chart to build and push polcies to support sandboxed containers into the spoke cluster of a validated pattern.
66

7-
This chart is used to serve as the template for Validated Patterns Charts
7+
This chart is intended for use with the [coco-pattern](https://github.com/validatedpatterns/coco-pattern) and other validated patterns.
8+
9+
It is part of three charts that are intended to be used together:
10+
11+
1. [trustee](https://github.com/validatedpatterns/trustee-chart) intended to deploy the Key Broker Service (KBS) and related infrastructure to the ub cluster.
12+
2. [sandboxed-containers](https://github.com/validatedpatterns/sandboxed-containers-chart) intended to be deployed on an ACM spoke cluster where there is access to confidential hardware
13+
3. [sandboxed-policies](https://github.com/validatedpatterns/sandboxed-policies-chart), this chart, intended to be deployed on an ACM hub cluster which pushes polices to the spoke cluster.
14+
15+
A small number of imperative jobs are also part of the coco pattern which are used to push the polices to the spoke cluster.
816

917
## Notable changes
1018

19+
## Values
20+
21+
| Key | Type | Default | Description |
22+
| ---------------------------------- | ------ | ---------------------------------------------------------------------------- | ----------- |
23+
| global.clusterPlatform | string | `""` | |
24+
| global.coco.azure.VMFlavours | string | `"Standard_DC2as_v5,Standard_DC4as_v5,Standard_DC8as_v5,Standard_DC16as_v5"` | |
25+
| global.coco.azure.defaultVMFlavour | string | `"Standard_DC2as_v5"` | |
26+
1127
---
1228

1329
Autogenerated from chart metadata using [helm-docs v1.14.2](https://github.com/norwoodj/helm-docs/releases/v1.14.2)

‎README.md.gotmpl‎

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,15 @@
55

66
{{ template "chart.description" . }}
77

8-
This chart is used to serve as the template for Validated Patterns Charts
8+
This chart is intended for use with the [coco-pattern](https://github.com/validatedpatterns/coco-pattern) and other validated patterns.
9+
10+
It is part of three charts that are intended to be used together:
11+
12+
1. [trustee](https://github.com/validatedpatterns/trustee-chart) intended to deploy the Key Broker Service (KBS) and related infrastructure to the ub cluster.
13+
2. [sandboxed-containers](https://github.com/validatedpatterns/sandboxed-containers-chart) intended to be deployed on an ACM spoke cluster where there is access to confidential hardware
14+
3. [sandboxed-policies](https://github.com/validatedpatterns/sandboxed-policies-chart), this chart, intended to be deployed on an ACM hub cluster which pushes polices to the spoke cluster.
15+
16+
A small number of imperative jobs are also part of the coco pattern which are used to push the polices to the spoke cluster.
917

1018
## Notable changes
1119

‎commitlint.config.js‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
module.exports = { extends: ['@commitlint/config-conventional'] }

‎templates/.keep‎

Whitespace-only changes.

‎templates/hub-to-spoke-initdata-policy.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
apiVersion: policy.open-cluster-management.io/v1
3+
kind: Policy
4+
metadata:
5+
name: hub-to-spoke-initdata-policy
6+
namespace: imperative
7+
annotations:
8+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
9+
spec:
10+
remediationAction: enforce
11+
disabled: false
12+
policy-templates:
13+
- objectDefinition:
14+
apiVersion: policy.open-cluster-management.io/v1
15+
kind: ConfigurationPolicy
16+
metadata:
17+
name: hub-to-spoke-initdata-cp
18+
namespace: imperative
19+
spec:
20+
remediationAction: enforce
21+
severity: medium
22+
namespaceSelector:
23+
include:
24+
- imperative
25+
object-templates:
26+
- complianceType: mustonlyhave
27+
objectDefinition:
28+
apiVersion: v1
29+
kind: ConfigMap
30+
metadata:
31+
name: initdata
32+
namespace: imperative
33+
data:
34+
INITDATA: '{{ `{{hub fromConfigMap "imperative" "initdata" "INITDATA" hub}}` }}'
35+
36+
---
37+
apiVersion: policy.open-cluster-management.io/v1
38+
kind: PlacementBinding
39+
metadata:
40+
name: hub-to-spoke-initdata-placement-binding
41+
namespace: imperative
42+
annotations:
43+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
44+
placementRef:
45+
name: hub-to-spoke-initdata-placement-rule
46+
kind: PlacementRule
47+
apiGroup: apps.open-cluster-management.io
48+
subjects:
49+
- name: hub-to-spoke-initdata-policy
50+
kind: Policy
51+
apiGroup: policy.open-cluster-management.io
52+
53+
---
54+
apiVersion: apps.open-cluster-management.io/v1
55+
kind: PlacementRule
56+
metadata:
57+
name: hub-to-spoke-initdata-placement-rule
58+
namespace: imperative
59+
spec:
60+
clusterConditions:
61+
- status: 'True'
62+
type: ManagedClusterConditionAvailable
63+
clusterSelector:
64+
matchExpressions:
65+
# Only apply to spoke clusters (exclude local-cluster which is typically the hub)
66+
- key: name
67+
operator: NotIn
68+
values: ["local-cluster"]

‎templates/peer-pods-cm.yaml‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
---
2+
apiVersion: policy.open-cluster-management.io/v1
3+
kind: Policy
4+
metadata:
5+
name: peerpods-cm-policy
6+
spec:
7+
remediationAction: enforce
8+
disabled: false
9+
policy-templates:
10+
- objectDefinition:
11+
apiVersion: policy.open-cluster-management.io/v1
12+
kind: ConfigurationPolicy
13+
metadata:
14+
name: peerpods-cm-cp
15+
spec:
16+
remediationAction: enforce
17+
severity: medium
18+
object-templates:
19+
20+
- complianceType: mustonlyhave
21+
objectDefinition:
22+
apiVersion: v1
23+
kind: ConfigMap
24+
metadata:
25+
name: peer-pods-cm
26+
namespace: openshift-sandboxed-containers-operator
27+
data:
28+
CLOUD_PROVIDER: "azure"
29+
VXLAN_PORT: "9000"
30+
AZURE_IMAGE_ID: '{{ `{{if (lookup "v1" "ConfigMap" "openshift-sandboxed-containers-operator" "peer-pods-cm").metadata.name }}{{ fromConfigMap "openshift-sandboxed-containers-operator" "peer-pods-cm" "AZURE_IMAGE_ID" }}{{ else }}{{ end }}` }}'
31+
AZURE_INSTANCE_SIZE: "{{ .Values.global.coco.azure.defaultVMFlavour }}"
32+
AZURE_INSTANCE_SIZES: "{{ .Values.global.coco.azure.VMFlavours }}"
33+
AZURE_RESOURCE_GROUP: '{{ `{{ (fromJson (fromConfigMap "openshift-cloud-controller-manager" "cloud-conf" "cloud.conf" | toLiteral)).vnetResourceGroup }}` }}'
34+
AZURE_REGION: '{{ `{{ (fromJson (fromConfigMap "openshift-cloud-controller-manager" "cloud-conf" "cloud.conf" | toLiteral)).location }}` }}'
35+
AZURE_SUBNET_ID: '/subscriptions/{{ `{{ (fromJson (fromConfigMap "openshift-cloud-controller-manager" "cloud-conf" "cloud.conf" | toLiteral)).subscriptionId }}` }}/resourceGroups/{{ `{{ (fromJson (fromConfigMap "openshift-cloud-controller-manager" "cloud-conf" "cloud.conf" | toLiteral)).vnetResourceGroup }}` }}/providers/Microsoft.Network/virtualNetworks/{{ `{{ (fromJson (fromConfigMap "openshift-cloud-controller-manager" "cloud-conf" "cloud.conf" | toLiteral)).vnetName }}` }}/subnets/{{ `{{ (fromJson (fromConfigMap "openshift-cloud-controller-manager" "cloud-conf" "cloud.conf" | toLiteral)).subnetName }}` }}'
36+
AZURE_NSG_ID: '/subscriptions/{{ `{{ (fromJson (fromConfigMap "openshift-cloud-controller-manager" "cloud-conf" "cloud.conf" | toLiteral)).subscriptionId }}` }}/resourceGroups/{{ `{{ (fromJson (fromConfigMap "openshift-cloud-controller-manager" "cloud-conf" "cloud.conf" | toLiteral)).resourceGroup }}` }}/providers/Microsoft.Network/networkSecurityGroups/{{ `{{ (fromJson (fromConfigMap "openshift-cloud-controller-manager" "cloud-conf" "cloud.conf" | toLiteral)).securityGroupName }}` }}'
37+
DISABLECVM: "false"
38+
PROXY_TIMEOUT: "5m"
39+
INITDATA: '{{ `{{ fromConfigMap "imperative" "initdata" "INITDATA" }}` }}'
40+
41+
---
42+
apiVersion: policy.open-cluster-management.io/v1
43+
kind: PlacementBinding
44+
metadata:
45+
name: peerpods-placement-binding
46+
annotations:
47+
argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
48+
placementRef:
49+
name: peerpods-placement-rule
50+
kind: PlacementRule
51+
apiGroup: apps.open-cluster-management.io
52+
subjects:
53+
- name: peerpods-cm-policy
54+
kind: Policy
55+
apiGroup: policy.open-cluster-management.io
56+
---
57+
apiVersion: apps.open-cluster-management.io/v1
58+
kind: PlacementRule
59+
metadata:
60+
name: peerpods-placement-rule
61+
spec:
62+
clusterConditions:
63+
- status: 'True'
64+
type: ManagedClusterConditionAvailable
65+
clusterSelector:
66+
matchLabels:
67+
cloud: Azure
68+
---

0 commit comments

Comments
 (0)