{"repo":"k-cloud-labs/kinitiras","free":true,"listed":false,"github":"https://github.com/k-cloud-labs/kinitiras","clone":"git clone https://github.com/k-cloud-labs/kinitiras.git","description":"A programmable rule engine for k8s admission webhook","language":"Go","stars":160,"topics":["k8s","rules-engine","webhook","kubernetes"],"license":"Apache-2.0","category":"deployment-docker-iac","readme_excerpt":"kinitiras [中文] A lightweight but powerful and programmable rule engine for kubernetes admission webhook. If you want to use it in clientside with client-go, please use pidalio. Quick Start Add Helm source Install All resources will be applied to kinitiras-system namespace by default. You can modify the deployment files as your expect. Pay attention to the deploy/webhook-configuration.yaml file. The default config will mutate and validate all kubernetes resources filtered by label kinitiras.kcloudlabs.io/webhook: enabled . YOU NEED TO UPDATE THE RULES AS YOUR EXPECT TO MINIMIZE THE EFFECTIVE SCOPE OF THE ADMISSION WEBHOOK. After all changes done, just apply it to your cluster. Create policy Three kind of policy are supported. OverridePolicy is used to mutate object in the same namespace. ClusterOverridePolicy is used to mutate object in any namespace. ClusterValidatePolciy is used to validate object in any namespace. For cluster scoped resource: - Apply ClusterOverridePolicy by policies name in ascending; For namespaced scoped resource, apply order is: - First apply ClusterOverridePolicy; - Then apply OverridePolicy; Both mutate and validate policy are programmable via CUE. Constraint 1. The kubernetes object will be passed to CUE by object parameter. 2. The mutating result will be returned by patches parameter. 3. The Validating result will be returned by validate parameter. 4. Use processing to support data passing. It contains http and output schema. 1. http used to make a ","default_branch":null,"files":null,"tree":[],"storefront":"/r/k-cloud-labs","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/k-cloud-labs/kinitiras/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}