Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

k8s aligned GPM view permissions #261

Open
DrackThor opened this issue Sep 20, 2021 · 2 comments
Open

k8s aligned GPM view permissions #261

DrackThor opened this issue Sep 20, 2021 · 2 comments
Assignees
Labels
enhancement New feature or request python Pull requests that update Python code

Comments

@DrackThor
Copy link

Hello Team,

first and foremost - awesome project, thank you very much! 😄
I would like to ask for/propose a new security enhancement: GPM permissions based on k8s roles.
My team was recently discussing about the fact that everybody with access to GPM can see all policy violations across all namespaces.
It would be great for us to have some kind of restriction method to let users only see violations of workloads they can see in the cluster as well.

Thanks in advance!

@niccoloraspa niccoloraspa added the enhancement New feature or request label Sep 20, 2021
@niccoloraspa
Copy link

Hi @DrackThor,
we are glad that you find GPM useful and thanks for submitting the issue.

Regarding your proposal, I like the idea. We will have a talk internally and see if it's feasible.

Happy coding,
Nick

@ralgozino
Copy link
Member

Hi @DrackThor !

This would be kind of tricky to implement actually because GPM is a Server Side Rendered application (so you would have to pass the credentials every time or something like that). I get where you are coming from though.

You can always limit the access to GPM using the supported OIDC authentication, if you want something more granular, like letting some people access the /constraints view but only admins the /constrainttemplates view you can do it with your ingress using something like pomerium (see this for example).

I'll leave the issue open so we can revisit it in the feature.

Thanks for reaching out! keep the suggestions coming :-)
Ramiro.

@ralgozino ralgozino added the python Pull requests that update Python code label Oct 11, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature or request python Pull requests that update Python code
Projects
None yet
Development

No branches or pull requests

3 participants