kadras-io / package-for-contour Goto Github PK

After a Carvel package for the Kyverno Policies is available, add tests to verify the cert-manager package compliance to the Pod Security Standards.

See: https://kyverno.io/policies/pod-security/

Consider:

#! Specify which fields should be removed before diff-ing against last applied resource.
#! See more: https://carvel.dev/kapp/docs/latest/config/#diffagainstlastappliedfieldexclusionrules
diffAgainstLastAppliedFieldExclusionRules:
- path: [metadata, annotations]
  type: copy
  sources: [existing, new]
  resourceMatchers:
  - kindNamespaceNameMatcher:
      kind: Service
      namespace: #@ data.values.namespace
      name: envoy

• Configure bundle for private registry with Carvel
• Docs on configuring a private registry
• Integration tests

See https://projectcontour.io/docs/v1.24.1/guides/gatekeeper/

• Validation (unique FQDN)
• Policies (retries)
• Audit

Add overlay for Contour deployment (Envoy is fine already).
See: https://kyverno.io/policies/other/restrict-automount-sa-token/restrict-automount-sa-token/

Add roles that can be aggregated into different platform roles, such as developer and operator.

Include configuration options for CPU and memory.

See:

• https://projectcontour.io/docs/latest/deploy-options/
• https://projectcontour.io/guides/resource-limits/

See: https://projectcontour.io/docs/1.25/config/tracing/

Container port needs to be configurable to allow config as in https://projectcontour.io/docs/v1.24.1/guides/deploy-aws-tls-nlb/