feat: Kyverno-based cc_init_data injection for OSC 1.12#77
Open
butler54 wants to merge 2 commits intovalidatedpatterns:mainfrom
Open
feat: Kyverno-based cc_init_data injection for OSC 1.12#77butler54 wants to merge 2 commits intovalidatedpatterns:mainfrom
butler54 wants to merge 2 commits intovalidatedpatterns:mainfrom
Conversation
…e 1.1 Replace broken io.katacontainers.config.agent.policy annotation with Kyverno MutatingPolicy that injects cc_init_data from ConfigMaps into pods with kata runtime classes. - Add coco-kyverno-policies chart with MutatingPolicy, ValidatingPolicy, and ClusterPolicy for ConfigMap namespace propagation - Update imperative job to generate both default and debug initdata ConfigMaps with Kyverno validation fields - Update workload pod templates to use coco.io/initdata-configmap annotation instead of inline policy - Update values-simple.yaml: OSC 1.12, Trustee 1.1, Kyverno Helm app - Add conditional memory annotation for non-Azure platforms - Delete insecure-policy.rego (policy now embedded in cc_init_data) BREAKING CHANGE: Requires Kyverno and OSC 1.12 / Trustee 1.1.0 Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Temporarily targets butler54/trustee-chart feature/trustee-1.1-compat branch instead of released chart version. Revert to chart: trustee + chartVersion: 0.2.* after trustee-chart PR is merged and released. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
cc_init_datainto pods with kata runtime classes, replacing brokenio.katacontainers.config.agent.policyannotationimperativenamespace to workload namespacesvalues-simple.yaml: OSC 1.12.0, Trustee 1.1.0, Kyverno Helm chart, OpenShift SCC overridesfeature/trustee-1.1-compatbranch (revert after trustee-chart PR merged)Three initdata modes
coco.io/initdata-configmap: initdatacoco.io/initdata-configmap: debug-initdatacc_init_dataannotationDependencies
Test plan
main.clusterGroupName: simpleon Azurekyvernonamespaceoc get mpol,vpol,cpolinitdataanddebug-initdataConfigMaps createdhello-openshiftandkbs-accessnamespacesio.katacontainers.config.hypervisor.cc_init_datainjectedcoco.io/initdata-configmap: debug-initdatacc_init_data, nococo.ioannotation → no mutationchart: trustee+chartVersion: 0.2.*after trustee-chart release🤖 Generated with Claude Code