shimont

Seems cool, an open source alternative is always good to have

I've recently received an email from AWS about me running a deprecated EKS cluster with version 1.22 So I had to upgrade all of my clusters! So I've created this upgrade guide to EKS version 1.23 I Would love to hear your feedback and I hope this will help

woops! good catch! we will fix it - here are more policies https://hub.datree.io/built-in-rules

Initially as it is in read-only mode, there are no risks. But once you enable policy enforcement it will block non-compliant deployments to your cluster. Your organisation has to be ready for it, as it might block a developer trying to apply a hotfix.. you need to have the right mechanisms of enabling skips and escalating critical deployments, as any security tool i suppose

I agree, I dont know if it's a mental thing of feeling in control or really more convenient

I've created a basic index website https://crd.directory/

congrats on the launch.. What is the added value in using Permit as oppose to just implementing ABAC on top of OPA by myself? if I implement it using Rego policies they will be in Git and managed in a GitOps way with tracking changes etc.. Ofc I understand that you aim for the permissions to be as easy as for a monkey.. Do you offer a way of auditing and tracking who made changes to permissions?

Who uses FreeBSD those days? As a company that runs on the cloud, AWS/GCP/Azure you run windows/linux, and on desktop people mainly run MacOS/Windows/Linux.

I am really asking as for what is the main use case of FreeBSD in 2022?

Thank you Varchol :) Also you can use Helm which might help on top of Kubernetes manifests

We just released support for custom rules :) from interviewing our users, we decided to start with [0] JSON Schema as it is very easy to write rules using it and you do not have to learn rego.

Having said that, we might add OPA .rego support in the near future :)

What is the desired way for you to write custom policy rules?

[0] - https://json-schema.org/

Hey, this is a great question.

We are big believers in "shift-left" and trying to fix/avoid issues as early as possible. We started with a CLI tool as it is agnostic and can be run in the devs IDE like VSCODE, in the terminal and finally in the CI/CD process.

We love OPA and think that GateKeeper is a good solution, but we want to provide feedback as early as possible. While Gatekeeper will block a deployment to the Kubernetes cluster at the end of the development process.

As a developer myself I would rather be notified for an issue as early as possible and not find our about it in the very last second before it goes live to production.

We might add support similar to GateKeeper in the future, but we wanted to be shift-left first :)

I hope this answers your question Thank you