kata-containers/src/tools/genpolicy

Agent Policy generation tool

The Kata Containers Policy generation tool (genpolicy):

1. Reads user's Kubernetes (K8s) YAML file.

2. Infers user's intentions based on the contents of that file.

3. Generates a Kata Containers Agent (kata-agent) Policy file corresponding to the input YAML, using the Open Policy Agent format.

4. Encodes the auto-generated Policy text in base64 format and appends the encoded string as an annotation to user's YAML file.

When the user deploys that YAML file through K8s, the Kata Agent uses the Policy specified by the YAML annotation to reject possible Agent API calls that are not consistent with the policy. For additional information, see How to use the Kata Agent Policy.

The Policy auto-generated by genpolicy is typically used for implementing confidential containers, where the Kata Shim and the Kata Agent have different trust properties.

Warning Users should review carefully the automatically-generated Policy, and modify the Policy file if needed to match better their use case, before using this Policy.

Building genpolicy from source code

Build in docker container:

$ git clone https://github.com/kata-containers/kata-containers.git
$ cd kata-containers
$ tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh --build=genpolicy

Executing genpolicy

Example:

$ genpolicy -y test.yaml

For a usage statement, run:

$ genpolicy --help

For advanced command line parameters, see genpolicy advanced command line parameters.

Supported Kubernetes YAML file types

genpolicy has support for automatic Policy generation based on Kubernetes DaemonSet, Deployment, Job, Pod, ReplicaSet, ReplicationController, and StatefulSet input YAML files.

Policy details

See auto-generated Policy details.