This repository has been archived by the owner on May 8, 2024. It is now read-only.
-
Notifications
You must be signed in to change notification settings - Fork 96
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
5291761
commit dc486df
Showing
1 changed file
with
19 additions
and
0 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,19 @@ | ||
## Kyverno Policy Integration | ||
|
||
PodSecurityPolicy(PSP) is being deprecated in Kubernetes v1.21 and will be removed in v1.25. So, the suitable alternative is Kyverno. | ||
|
||
<img width="200" align="right" alt="Kyverno Logo" src="https://github.com/cncf/artwork/blob/master/projects/kyverno/stacked/color/kyverno-stacked-color.png" xmlns="http://www.w3.org/1999/html"> | ||
|
||
Kyverno is an Open source policy engine designed specifically for Kubernetes. The word "Kyverno" is a Greek word for "Govern". It was originally developed by Nirmata and is now a CNCF sandbox project. It can validate, mutate, and generate configurations using admission controls and background scans. | ||
|
||
### Installation | ||
|
||
1.Install kyverno via [Helm](https://kyverno.io/docs/installation/#install-kyverno-using-helm) or [YAMLs](https://kyverno.io/docs/installation/#install-kyverno-using-yamls) in Kubernetes cluster. | ||
|
||
2.After that install kyverno policies with OpenEBS using flag 'rbac.kyvernoEnabled=true'. | ||
|
||
`helm install openebs openebs/openebs --namespace openebs --create-namespace --set legacy.enabled=false --set cstor.enabled=true --set openebs-ndm.enabled=true` | ||
|
||
3.Check the list of policies which has been created by using. | ||
|
||
`kubectl get pol` |