.github/workflows | ||
charts/policy-reporter | ||
cmd | ||
docs/images | ||
pkg | ||
.dockerignore | ||
.gitignore | ||
Dockerfile | ||
go.mod | ||
go.sum | ||
LICENSE.md | ||
main.go | ||
Makefile | ||
README.md |
PolicyReporter
Motivation
Kyverno ships with two types of validation. You can either enforce a rule or audit it. If you don't want to block developers or if you want to try out a new rule, you can use the audit functionality. The audit configuration creates PolicyReports which you can access with kubectl
. Because I can't find a simple solution to get a general overview of this PolicyReports and PolicyReportResults, I created this tool to send information from PolicyReports to Grafana Loki. As additional feature this tool provides an http server with Prometheus Metrics about ReportPolicy Summaries and ReportPolicyRules.
This project is in an early stage. Please let me know if anything did not work as expected or if you want to send your audits to other targets then Loki.
Installation with Helm v3
Installation via Helm Repository
helm repo add policy-reporter https://fjogeleit.github.io/policy-reporter
helm install policy-reporter policy-reporter/policy-reporter --set loki.host=http://lokihost:3100 -n policy-reporter --create-namespace
You can also customize the ./charts/policy-reporter/values.yaml
to change the default configurations.
Additional configurations for Loki
Configure loki.minimumPriority
to send only results with the configured minimumPriority or above, empty means all results. (info < warning < error)
Configure loki.skipExistingOnStartup
to skip all results who already existed before the PolicyReporter started. Can be used after the first deployment to prevent duplicated events.
loki:
minimumPriority: ""
skipExistingOnStartup: false
Configure Policy Priorities
By default kyverno PolicyReports has no priority or severity for policies. So every passed rule validation will be processed as notice, a failed validation is processed as error. To customize this you can configure a mapping from policies to fail priorities. So you can send them as warnings instead of errors. To configure the priorities create a ConfigMap in the policy-reporter
namespace with the name policy-reporter-priorities
. Configure each priority as value with the Policyname as key and the Priority as value. This Configuration is loaded and synchronized during runtime. Any change to this configmap will automaticly synchronized, no new deployment needed.
Example
kubectl create configmap policy-reporter-priorities --from-literal check-label-app=warning --from-literal require-ns-labels=warning -n policy-reporter
Monitoring
The Helm Chart includes optional Manifests for the MonitoringStack. The provided Dashboard works without Loki
- Enable a ServiceMonitor by setting
metrics.serviceMonitor
totrue
. - Enable a basic Dashboard as ConfigMap by setting
metrics.dashboard.enabled
totrue
.- Change the namespace to your required monitoring namespace by changing
metrics.dashboard.namespace
(default: cattle-dashboards)
- Change the namespace to your required monitoring namespace by changing
If you are not using the MonitoringStack you can import the dashboard from Grafana
Example Installation
helm install policy-reporter policy-reporter/policy-reporter --set metrics.serviceMonitor=true --set metrics.dashboard.enabled=true -n policy-reporter --create-namespace
Dashboard Preview
Example Outputs
Todos
Support for ClusterPolicyReports- Additional Targets