aws / aws/eks-anywhere

Security enhancement: enable Validating Admission Policy for EKS-A clusters

Open
#6,782 1 comment 15 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
2.1k
Forks
328
Avg merge
1d 4h
Merged PRs (30d)
9

Description

**What would you like to be added**:
[Validating Admission Policy](https://kubernetes.io/docs/reference/access-authn-authz/validating-admission-policy/) has been alpha since 1.26 and it graduated to beta in Kubernetes 1.28.
We would like to start to use it on our EKS-A clusters.

**Why is this needed**:
To be able to use a Kubernetes native feature for admission controller. While there are existing 3rd party solutions like Kyverno, OPA/Gatekeeper, Datree, these tools need to be maintained by the platform admins and some of them have very steep learning curve (rego).
While Validating Admission Policy may not be a fit for all use cases (no external context during decision making) it is definitely provides enough flexibility to cover most of the use cases that a kubernetes platform require.

Contributor guide

Open the contributing guide

Research direction

No files, tests, or entry points are named. Start by locating the EKS-A cluster configuration and Kubernetes version handling, then check how admission-controller features are enabled and which supported versions can use Validating Admission Policy. Done means the supported configuration and validation path are identified and the policy can be used on an EKS-A cluster.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws
Domain
infrastructure, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.