Skip to content

kubectl_plugin.adoc

Latest commit

 

History

History
102 lines (70 loc) · 2.93 KB

kubectl_plugin.adoc

File metadata and controls

102 lines (70 loc) · 2.93 KB
Raw

kubectl runtime-enforcer

The kubectl runtime-enforcer plugin wraps common operations for WorkloadPolicyProposal and WorkloadPolicy CRDs.

Installation

Download a pre-built binary

Pre-built binaries for linux/amd64, linux/arm64, darwin/amd64, and darwin/arm64 are published on each GitHub Release.

# Example: linux/amd64
VERSION=latest
curl -Lo kubectl-runtime_enforcer \
  "https://github.com/rancher-sandbox/runtime-enforcer/releases/download/${VERSION}/kubectl-runtime_enforcer-linux-amd64"
chmod +x kubectl-runtime_enforcer
sudo mv kubectl-runtime_enforcer /usr/local/bin/

Verify checksums with the .sha256 file published next to the binary.

sha256sum --check kubectl-runtime_enforcer-linux-amd64.sha256

Build from source

From the repository root:

# Current platform
make kubectl-plugin          # output: bin/kubectl-runtime_enforcer
# All supported platforms at once
make kubectl-plugin-cross    # output: bin/kubectl-plugin/kubectl-runtime_enforcer-<os>-<arch>

Verify

- `kubectl runtime-enforcer` or `kubectl runtime-enforcer -h/--help` — show help
- `kubectl runtime-enforcer -v/--version` — print version

Enable auto-completion

To enable auto-completion, make sure that you enable the auto-completion of kubectl. Then, create a script called kubectl_complete-runtime_enforcer following the below steps:

cat <<EOF > kubectl_complete-runtime_enforcer
#!/bin/bash
kubectl runtime-enforcer __complete "\$@"
EOF
chmod +x kubectl_complete-runtime_enforcer
sudo mv kubectl_complete-runtime_enforcer /usr/local/bin/

Promote a proposal (Learn → Monitor)

Promoting a WorkloadPolicyProposal sets the security.rancher.io/promote=true label and lets the controller create a WorkloadPolicy.

Plugin:

kubectl runtime-enforcer proposal promote <PROPOSAL_NAME> -n <namespace>

Use kubectl runtime-enforcer proposal promote --dry-run to validate without persisting.

Switch monitor ↔ protect

Plugin:

Switching the mode of a WorkloadPolicy between monitor and protect.

kubectl runtime-enforcer policy protect <POLICY_NAME> -n <namespace>
kubectl runtime-enforcer policy monitor <POLICY_NAME> -n <namespace>

Use --dry-run on policy protect and policy monitor to preview.

Allowing/denying executables

To limit or expand allowed executables, add or remove executable paths on a per-container basis:

Plugin:

kubectl runtime-enforcer policy exec allow <POLICY> <container> <executable-path> [<executable-path>...]
kubectl runtime-enforcer policy exec deny  <POLICY> <container> <executable-path> [<executable-path>...]

Show protection mappings

Lists workloads and how they map to policies (table or JSON).

kubectl runtime-enforcer policy show protection
kubectl runtime-enforcer policy show protection -A -o json