Skip to content

feat(enforcer): enable context-aware policy decisions via custom functions #5

@AKonnyaku

Description

@AKonnyaku

Policy decisions rely solely on the incoming admission review request body at present. However a more dynamic approach is preferred:

  • we should implement custom casbin functions to query the live kubernetes cluster state;
  • it will allows policies to verify global constraints such as total pod counts;
  • furthermore integrating a kubernetes client within the enforcer helps fetch related resources dynamically;
  • caching frequent queries is also recommended to minimize api server load and latency;
  • consequently these improvements empower complex policies that require a broader cluster context.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions