Safeguard is a custom admission controller for kubernetes used to enforce protection on kubernetes resources.
-
Configure safeguard.yml with your own ca bundle base64 encoded.
-
Modify secret.yml with your own
tls.crt
andtls.key
NOTE: the certificates have to be signed by the same CA as your api server!
-
Run the following;
kubectl create -f safeguard.yml -n NAMESPACE
kubectl create -f contrib/secret.yml -n NAMESPACE
kubectl create -f contrib/deployment.yml -n NAMESPACE # this should be in the same namespace as the secret
kubectl create -f contrib/service.yml -n NAMESPACE # this should be in the same namespace as the deployment
- Decorate your resources with the following annotation to protect them.
---
apiVersion: v1
kind: Service
metadata:
name: example
annotations:
safeguard.jw-s.com/protected: 'true'
...
- Try to delete the protected resource!
- Go 1.12.x
- Make
go get -d github.com/jw-s/safeguard
cd $GOPATH/src/github.com/jw-s/safeguard
make build