I've recently received an email from AWS about me running a deprecated EKS cluster with version 1.22 So I had to upgrade all of my clusters! So I've created this upgrade guide to EKS version 1.23 I Would love to hear your feedback and I hope this will help
Initially as it is in read-only mode, there are no risks. But once you enable policy enforcement it will block non-compliant deployments to your cluster. Your organisation has to be ready for it, as it might block a developer trying to apply a hotfix.. you need to have the right mechanisms of enabling skips and escalating critical deployments, as any security tool i suppose
congrats on the launch.. What is the added value in using Permit as oppose to just implementing ABAC on top of OPA by myself? if I implement it using Rego policies they will be in Git and managed in a GitOps way with tracking changes etc..
Ofc I understand that you aim for the permissions to be as easy as for a monkey.. Do you offer a way of auditing and tracking who made changes to permissions?
Who uses FreeBSD those days? As a company that runs on the cloud, AWS/GCP/Azure you run windows/linux, and on desktop people mainly run MacOS/Windows/Linux.
I am really asking as for what is the main use case of FreeBSD in 2022?
We just released support for custom rules :) from interviewing our users, we decided to start with [0] JSON Schema as it is very easy to write rules using it and you do not have to learn rego.
Having said that, we might add OPA .rego support in the near future :)
What is the desired way for you to write custom policy rules?
We are big believers in "shift-left" and trying to fix/avoid issues as early as possible.
We started with a CLI tool as it is agnostic and can be run in the devs IDE like VSCODE, in the terminal and finally in the CI/CD process.
We love OPA and think that GateKeeper is a good solution, but we want to provide feedback as early as possible. While Gatekeeper will block a deployment to the Kubernetes cluster at the end of the development process.
As a developer myself I would rather be notified for an issue as early as possible and not find our about it in the very last second before it goes live to production.
We might add support similar to GateKeeper in the future, but we wanted to be shift-left first :)
I know! I think that the fact that developers are dealing more and more with infra is very empowering but on the other hand brings new challenges. It is no longer Dev VS OPS, but now Devs also need to learn infra best practices, so tools like ours help them :) thank you for your Kudos! <3
The dashboard is also offered as part of our freemium offering :) we offer 1000 policy checks per month for free. Including the dashboard.
In terms of what we offer compared to Polaris: We offer pre-defined policies that comes out of the box along with the ability to write custom rules for your policy by your self.
Take us for a spin and let me know what you think! thank you
I think that this is a great approach to test out the files. Mistakes in those files can cause a production outage. I like doing those tests once a PR is open and before it is merged into master and executed on the production cluster. (Disclaimer i am a co-founder of datree.io)
I totally agree! you should rotate the keys! we explain how to get rid of it in terms of Git. This is in addition to rotating it. Sorry for not being clear
Currently, we support GitHub and working on releasing our support for GitLab and BitBucket. We plan on running on top of existing git hosting solutions