https://github.com/google/gke-policy-automation Skip to content Sign up * Product + Features + Mobile + Actions + Codespaces + Copilot + Packages + Security + Code review + Issues + Discussions + Integrations + GitHub Sponsors + Customer stories * Team * Enterprise * Explore + Explore GitHub + Learn and contribute + Topics + Collections + Trending + Skills + GitHub Sponsors + Open source guides + Connect with others + The ReadME Project + Events + Community forum + GitHub Education + GitHub Stars program * Marketplace * Pricing + Plans + Compare plans + Contact Sales + Education [ ] * # In this repository All GitHub | Jump to | * No suggested jump to results * # In this repository All GitHub | Jump to | * # In this organization All GitHub | Jump to | * # In this repository All GitHub | Jump to | Sign in Sign up {{ message }} google / gke-policy-automation Public * Notifications * Fork 7 * Star 261 Tool and policy library for reviewing Google Kubernetes Engine clusters against best practices License Apache-2.0 license 261 stars 7 forks Star Notifications * Code * Issues 12 * Pull requests 0 * Actions * Security * Insights More * Code * Issues * Pull requests * Actions * Security * Insights google/gke-policy-automation This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository. main Switch branches/tags [ ] Branches Tags Could not load branches Nothing to show {{ refName }} default View all branches Could not load tags Nothing to show {{ refName }} default View all tags 3 branches 6 tags Code Latest commit @mikouaj mikouaj Failed cluster discovery was not returning an error (#104) ... ca5cffc Jul 25, 2022 Failed cluster discovery was not returning an error (#104) * Additional logging for collectors + policy evaluations ca5cffc Git stats * 120 commits Files Permalink Failed to load latest commit information. Type Name Latest commit message Commit time .github Introduced check commands and multiple packages handling (#89) Jul 1, 2022 assets Added SCC output docs (#103) Jul 22, 2022 docs Added SCC output docs (#103) Jul 22, 2022 gke-policies Minor fixes (#102) Jul 22, 2022 internal Failed cluster discovery was not returning an error (#104) Jul 25, 2022 scripts Fixed license headers + added workflow to check (#23) Apr 5, 2022 terraform Introduced check commands and multiple packages handling (#89) Jul 1, 2022 .gitignore Terraform serverless deployment (#75) May 24, 2022 .goreleaser.yml Added user-agent to GCP API calls (#78) May 24, 2022 .markdownlint.yml Added markdown linter and links checker (#30) Apr 13, 2022 .mlc_config.json MD links check fails with HTTP 403 on Github PR guide link (#44) Apr 25, 2022 CHANGELOG.md v1.2.0 CHANGELOG update Jul 22, 2022 CONTRIBUTING.md Updated GH PR link in CONTRIBUTING guide Apr 24, 2022 DEVELOPMENT.md Go 1.17 -> 1.18 in readme and dev guide Jul 21, 2022 Dockerfile Fixed license headers + added workflow to check (#23) Apr 5, 2022 GNUmakefile Added user-agent to GCP API calls (#78) May 24, 2022 LICENSE Fixed license headers + added workflow to check (#23) Apr 5, 2022 README.md Added SCC output docs (#103) Jul 22, 2022 go.mod Security Command Center integration (#100) Jul 21, 2022 go.sum Security Command Center integration (#100) Jul 21, 2022 main.go os.Exit(1) or err in main + added logging in a few places (#81) May 25, 2022 View code [ ] GKE Policy Automation Table of Contents Installation Container image Binary Source code Usage Checking the cluster Checking multiple clusters Discovering and checking multiple clusters Defining outputs Custom Policy repository Authentication Serverless execution Contributing Development Policy authoring License README.md GKE Policy Automation This is not an officially supported Google product. This repository contains the tool and the policy library for validating GKE clusters against configuration best practices. Build Policy tests Version Go Report Card GoDoc GitHub GKE Policy Automation Demo --------------------------------------------------------------------- Table of Contents * Installation * Usage * Contributing * License Installation Container image The container images with GKE Policy Automation tool are hosted on ghcr.io. Check the packages page for a list of all tags and versions. docker pull ghcr.io/google/gke-policy-automation:latest docker run --rm ghcr.io/google/gke-policy-automation check \ -project my-project -location europe-west2 -name my-cluster Binary Binaries for Linux, Windows and Mac are available as tarballs in the release page. Source code Go v1.18 or newer is required. Check the development guide for more details. git clone https://github.com/google/gke-policy-automation.git cd gke-policy-automation make build ./gke-policy check \ --project my-project --location europe-west2 --name my-cluster Usage Full user guide: GKE Policy Automation User Guide. Checking the cluster Check the GKE cluster against the default set of best practices with command line flags. ./gke-policy check \ --project my-project --location europe-west2 --name my-cluster Checking multiple clusters Check multiple GKE clusters against the default set of best practices with a config file. ./gke-policy check -c config.yaml The config.yaml file: clusters: - name: prod-central project: my-project-one location: europe-central2 - id: projects/my-project-two/locations/europe-west2/clusters/prod-west Discovering and checking multiple clusters Discover clusters in a selected GCP projects, folders or in the entire organization using Cloud Asset Inventory and check them against the default set of best practices. ./gke-policy check -c config.yaml The config.yaml file: clusterDiscovery: enabled: true organization: "123456789012" It is possible to use cluster discovery on a given project using command line flags only: ./gke-policy check --discovery -p my-project-id Defining outputs The cluster validation results can be published to multiple outputs, including JSON file, Pub/Sub topic, Cloud Storage bucket or Security Command Center. Check Outputs user guide for more details. Examples: * JSON file output with command line flags ./gke-policy check \ --project my-project --location europe-west2 --name my-cluster \ --out-file output.json * All outputs enabled in a configuration file clusters: - name: my-cluster project: my-project location: europe-west2 outputs: - file: output.json - pubsub: topic: Test project: my-pubsub-project - cloudStorage: bucket: bucket-name path: path/to/write - securityCommandCenter: organization: "153963171798" Custom Policy repository Specify custom repository with the GKE cluster best practices and check the cluster against them. * Custom policies source with command line flags ./gke-policy check \ --project my-project --location europe-west2 --name my-cluster \ --git-policy-repo "https://github.com/google/gke-policy-automation" \ --git-policy-branch "main" \ --git-policy-dir "gke-policies" * Custom policies source with configuration file ./gke-policy check -c config.yaml The config.yaml file: clusters: - name: my-cluster project: my-project location: europe-west2 policies: - repository: https://domain.com/your/custom/repository branch: main directory: gke-policies Authentication The tool is fetching GKE cluster details using GCP APIs. The application default credentials are used by default. * When running the tool in GCP environment, the tool will use the attached service account by default * When running locally, use gcloud auth application-default login command to get application default credentials * To use credentials from service account key file pass --creds parameter with a path to the file. The minimum required IAM role is roles/container.clusterViewer on a cluster projects. Additional roles may be needed, depending on configured outputs - check authentication section in the user guide. Serverless execution The GKE Policy Automation tool can be executed in a serverless way to perform automatic evaluations of a clusters running in your organization. Please check our reference Terraform Solution that leverages GCP serverless solutions including Cloud Scheduler and Cloud Run. Contributing Please check out Contributing and Code of Conduct docs before contributing. Development Please check GKE Policy Automation development for guides on building and developing the application. Policy authoring Please check GKE Policy authoring guide for guides on authoring REGO rules for GKE Policy Automation. License Apache License 2.0 About Tool and policy library for reviewing Google Kubernetes Engine clusters against best practices Topics gcp policy gke opa rego Resources Readme License Apache-2.0 license Code of conduct Code of conduct Stars 261 stars Watchers 6 watching Forks 7 forks Releases 6 v1.2.0 Latest Jul 22, 2022 + 5 releases Packages 1 Contributors 8 * @mikouaj * @danielmarzini * @ewojtach * @rickygodoy * @steenblik * @dependabot[bot] * @ravi-dalal * @annamuscarella Languages * Go 73.5% * Open Policy Agent 22.5% * HCL 2.3% * Python 0.7% * Makefile 0.5% * Shell 0.3% * Dockerfile 0.2% Footer (c) 2022 GitHub, Inc. Footer navigation * Terms * Privacy * Security * Status * Docs * Contact GitHub * Pricing * API * Training * Blog * About You can't perform that action at this time. You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session.