Policy Module provides runtime policy enforcement for SIGHUP Distribution (SD).
If you are new to SD please refer to the official documentation on how to get started with SD.
Tip
Starting from Kubernetes v1.25, Pod Security Standards (PSS) are promoted to stable. For most use cases, the policies defined in the Pod Security Standards are a great starting point; consider applying them before switching to one of the tools provided by this module.
For more advanced use cases, where custom policies that are not included in the PSS must be enforced, this module is the right choice.
The Kubernetes API server provides a mechanism to review every request that is made (object creation, modification or deletion) through a Validating Admission Webhook that validates each request and tells the API server whether it is allowed based on some logic (policy).
Policy Module is based on Gatekeeper and Kyverno, two popular open-source Kubernetes-native policy engines that run as Validating Admission Webhooks. It allows writing custom constraints (policies) and enforcing them at runtime. SIGHUP provides a set of base constraints that can be used both as a starting point and as a reference for implementing new rules matching your requirements.
The following packages are included in Policy Module:
| Package | Version | Description |
|---|---|---|
| Gatekeeper Core | v3.22.2 |
Gatekeeper deployment, ready to enforce rules. |
| Gatekeeper Rules | N.A. |
A set of custom rules to get started with policy enforcement. |
| Gatekeeper Monitoring | N.A. |
Metrics, alerts and dashboard for monitoring Gatekeeper. |
| Gatekeeper Policy Manager | v1.1.1 |
Gatekeeper Policy Manager, a simple to use web UI for Gatekeeper. |
| Kyverno | v1.18.1 |
Kyverno is a policy engine designed for Kubernetes. It can validate, mutate and generate configurations using admission controls and background scans. |
Click on each package to see its full documentation.
| Kubernetes Version | Compatibility | Notes |
|---|---|---|
1.33.x |
✅ | No known issues |
1.34.x |
✅ | No known issues |
1.35.x |
✅ | No known issues |
Check the compatibility matrix for additional information about previous releases of the module.
Policy Module is part of SIGHUP Distribution (SD) and is deployed automatically by furyctl when you create or update a cluster. You don't need to download, vendor or install its packages manually.
You configure the module under spec.distribution.modules.policy in your furyctl.yaml. The type field selects the policy engine to deploy: gatekeeper, kyverno, or none to disable the module. The other fields are optional and fall back to sensible defaults.
apiVersion: kfd.sighup.io/v1alpha2
kind: KFDDistribution
spec:
distribution:
modules:
policy:
# Select the policy engine: none, gatekeeper or kyverno
type: gatekeeper
gatekeeper:
enforcementAction: deny
installDefaultPolicies: true
additionalExcludedNamespaces: []To use Kyverno instead of Gatekeeper, set type: kyverno and configure the kyverno block:
apiVersion: kfd.sighup.io/v1alpha2
kind: KFDDistribution
spec:
distribution:
modules:
policy:
type: kyverno
kyverno:
validationFailureAction: Enforce
installDefaultPolicies: true
additionalExcludedNamespaces: []See the configuration reference for your cluster kind for the full list of available options: EKSCluster, KFDDistribution or OnPremises.
To install SD from scratch, follow the Getting started guide.
Before contributing, please read first the Contributing Guidelines.
In case you experience any problem with the module, please open a new issue.
This module is open-source and it's released under the following LICENSE.