Alignment to trustee v0.15.0 #104
Conversation
lmilleri
force-pushed
the
trustee-v0.15.0
branch
2 times, most recently
from
3271c3d to
a6825e0
Compare
|
@fitzthum @bpradipt PTAL, in particular the policy changes introduced for trustee v0.15.0 |
fitzthum
left a comment
fitzthum
left a comment
There was a problem hiding this comment.
A few notes about the resource policy.
You might want to check out how the built-in affirming policy has changed in Trustee. It now checks every submod rather than just cpu or cpu0
| allow { | ||
| input["submods"]["cpu"]["ear.status"] != "contraindicated" | ||
| not input["submods"]["cpu0"]["ear.veraison.annotated-evidence"]["sample"] | ||
| } |
There was a problem hiding this comment.
These policies mean different things.
There was a problem hiding this comment.
Yes you're right. Even though the policy is provided here as a sample, better to provide a better one.
What about this?
package policy
import rego.v1
default allow = false
allow if {
not any_not_affirming
count(input.submods) > 0
}
any_not_affirming if {
some _, submod in input.submods
submod["ear.status"] != "affirming"
}
There was a problem hiding this comment.
That's a good policy. It does still have a different meaning than the original one which simply checks if the CPU has a certain type. Actually that policy is still valid today.
Resource/attestation policy changes Attestation policy VolumeMount now includes subpath to allow writing on r/o filesystem Signed-off-by: Leonardo Milleri <[email protected]>
lmilleri
force-pushed
the
trustee-v0.15.0
branch
from
a6825e0 to
bb23cb7
Compare
2 participants
Resource/attestation policy changes
Attestation policy VolumeMount now includes
subpathto allow writing on container r/o filesystem