mirror of
https://github.com/rancher/rancher-docs.git
synced 2026-09-26 04:58:07 +00:00
391 lines
17 KiB
JavaScript
391 lines
17 KiB
JavaScript
"use strict";
|
||
(self["webpackChunkrancher_docs"] = self["webpackChunkrancher_docs"] || []).push([[32515],{
|
||
|
||
/***/ 3905:
|
||
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
|
||
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ Zo: () => (/* binding */ MDXProvider),
|
||
/* harmony export */ kt: () => (/* binding */ createElement)
|
||
/* harmony export */ });
|
||
/* unused harmony exports MDXContext, useMDXComponents, withMDXComponents */
|
||
/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67294);
|
||
|
||
|
||
function _defineProperty(obj, key, value) {
|
||
if (key in obj) {
|
||
Object.defineProperty(obj, key, {
|
||
value: value,
|
||
enumerable: true,
|
||
configurable: true,
|
||
writable: true
|
||
});
|
||
} else {
|
||
obj[key] = value;
|
||
}
|
||
|
||
return obj;
|
||
}
|
||
|
||
function _extends() {
|
||
_extends = Object.assign || function (target) {
|
||
for (var i = 1; i < arguments.length; i++) {
|
||
var source = arguments[i];
|
||
|
||
for (var key in source) {
|
||
if (Object.prototype.hasOwnProperty.call(source, key)) {
|
||
target[key] = source[key];
|
||
}
|
||
}
|
||
}
|
||
|
||
return target;
|
||
};
|
||
|
||
return _extends.apply(this, arguments);
|
||
}
|
||
|
||
function ownKeys(object, enumerableOnly) {
|
||
var keys = Object.keys(object);
|
||
|
||
if (Object.getOwnPropertySymbols) {
|
||
var symbols = Object.getOwnPropertySymbols(object);
|
||
if (enumerableOnly) symbols = symbols.filter(function (sym) {
|
||
return Object.getOwnPropertyDescriptor(object, sym).enumerable;
|
||
});
|
||
keys.push.apply(keys, symbols);
|
||
}
|
||
|
||
return keys;
|
||
}
|
||
|
||
function _objectSpread2(target) {
|
||
for (var i = 1; i < arguments.length; i++) {
|
||
var source = arguments[i] != null ? arguments[i] : {};
|
||
|
||
if (i % 2) {
|
||
ownKeys(Object(source), true).forEach(function (key) {
|
||
_defineProperty(target, key, source[key]);
|
||
});
|
||
} else if (Object.getOwnPropertyDescriptors) {
|
||
Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
|
||
} else {
|
||
ownKeys(Object(source)).forEach(function (key) {
|
||
Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
|
||
});
|
||
}
|
||
}
|
||
|
||
return target;
|
||
}
|
||
|
||
function _objectWithoutPropertiesLoose(source, excluded) {
|
||
if (source == null) return {};
|
||
var target = {};
|
||
var sourceKeys = Object.keys(source);
|
||
var key, i;
|
||
|
||
for (i = 0; i < sourceKeys.length; i++) {
|
||
key = sourceKeys[i];
|
||
if (excluded.indexOf(key) >= 0) continue;
|
||
target[key] = source[key];
|
||
}
|
||
|
||
return target;
|
||
}
|
||
|
||
function _objectWithoutProperties(source, excluded) {
|
||
if (source == null) return {};
|
||
|
||
var target = _objectWithoutPropertiesLoose(source, excluded);
|
||
|
||
var key, i;
|
||
|
||
if (Object.getOwnPropertySymbols) {
|
||
var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
|
||
|
||
for (i = 0; i < sourceSymbolKeys.length; i++) {
|
||
key = sourceSymbolKeys[i];
|
||
if (excluded.indexOf(key) >= 0) continue;
|
||
if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
|
||
target[key] = source[key];
|
||
}
|
||
}
|
||
|
||
return target;
|
||
}
|
||
|
||
var isFunction = function isFunction(obj) {
|
||
return typeof obj === 'function';
|
||
};
|
||
|
||
var MDXContext = /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createContext({});
|
||
var withMDXComponents = function withMDXComponents(Component) {
|
||
return function (props) {
|
||
var allComponents = useMDXComponents(props.components);
|
||
return /*#__PURE__*/React.createElement(Component, _extends({}, props, {
|
||
components: allComponents
|
||
}));
|
||
};
|
||
};
|
||
var useMDXComponents = function useMDXComponents(components) {
|
||
var contextComponents = react__WEBPACK_IMPORTED_MODULE_0__.useContext(MDXContext);
|
||
var allComponents = contextComponents;
|
||
|
||
if (components) {
|
||
allComponents = isFunction(components) ? components(contextComponents) : _objectSpread2(_objectSpread2({}, contextComponents), components);
|
||
}
|
||
|
||
return allComponents;
|
||
};
|
||
var MDXProvider = function MDXProvider(props) {
|
||
var allComponents = useMDXComponents(props.components);
|
||
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(MDXContext.Provider, {
|
||
value: allComponents
|
||
}, props.children);
|
||
};
|
||
|
||
var TYPE_PROP_NAME = 'mdxType';
|
||
var DEFAULTS = {
|
||
inlineCode: 'code',
|
||
wrapper: function wrapper(_ref) {
|
||
var children = _ref.children;
|
||
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(react__WEBPACK_IMPORTED_MODULE_0__.Fragment, {}, children);
|
||
}
|
||
};
|
||
var MDXCreateElement = /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.forwardRef(function (props, ref) {
|
||
var propComponents = props.components,
|
||
mdxType = props.mdxType,
|
||
originalType = props.originalType,
|
||
parentName = props.parentName,
|
||
etc = _objectWithoutProperties(props, ["components", "mdxType", "originalType", "parentName"]);
|
||
|
||
var components = useMDXComponents(propComponents);
|
||
var type = mdxType;
|
||
var Component = components["".concat(parentName, ".").concat(type)] || components[type] || DEFAULTS[type] || originalType;
|
||
|
||
if (propComponents) {
|
||
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(Component, _objectSpread2(_objectSpread2({
|
||
ref: ref
|
||
}, etc), {}, {
|
||
components: propComponents
|
||
}));
|
||
}
|
||
|
||
return /*#__PURE__*/react__WEBPACK_IMPORTED_MODULE_0__.createElement(Component, _objectSpread2({
|
||
ref: ref
|
||
}, etc));
|
||
});
|
||
MDXCreateElement.displayName = 'MDXCreateElement';
|
||
function createElement (type, props) {
|
||
var args = arguments;
|
||
var mdxType = props && props.mdxType;
|
||
|
||
if (typeof type === 'string' || mdxType) {
|
||
var argsLength = args.length;
|
||
var createElementArgArray = new Array(argsLength);
|
||
createElementArgArray[0] = MDXCreateElement;
|
||
var newProps = {};
|
||
|
||
for (var key in props) {
|
||
if (hasOwnProperty.call(props, key)) {
|
||
newProps[key] = props[key];
|
||
}
|
||
}
|
||
|
||
newProps.originalType = type;
|
||
newProps[TYPE_PROP_NAME] = typeof type === 'string' ? type : mdxType;
|
||
createElementArgArray[1] = newProps;
|
||
|
||
for (var i = 2; i < argsLength; i++) {
|
||
createElementArgArray[i] = args[i];
|
||
}
|
||
|
||
return react__WEBPACK_IMPORTED_MODULE_0__.createElement.apply(null, createElementArgArray);
|
||
}
|
||
|
||
return react__WEBPACK_IMPORTED_MODULE_0__.createElement.apply(null, args);
|
||
}
|
||
|
||
|
||
|
||
|
||
/***/ }),
|
||
|
||
/***/ 25778:
|
||
/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
|
||
|
||
__webpack_require__.r(__webpack_exports__);
|
||
/* harmony export */ __webpack_require__.d(__webpack_exports__, {
|
||
/* harmony export */ assets: () => (/* binding */ assets),
|
||
/* harmony export */ contentTitle: () => (/* binding */ contentTitle),
|
||
/* harmony export */ "default": () => (/* binding */ MDXContent),
|
||
/* harmony export */ frontMatter: () => (/* binding */ frontMatter),
|
||
/* harmony export */ metadata: () => (/* binding */ metadata),
|
||
/* harmony export */ toc: () => (/* binding */ toc)
|
||
/* harmony export */ });
|
||
/* harmony import */ var react__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(67294);
|
||
/* harmony import */ var _mdx_js_react__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3905);
|
||
/* @jsxRuntime classic */ /* @jsx mdx */ /* @jsxFrag React.Fragment */ function _define_property(obj, key, value) {
|
||
if (key in obj) {
|
||
Object.defineProperty(obj, key, {
|
||
value: value,
|
||
enumerable: true,
|
||
configurable: true,
|
||
writable: true
|
||
});
|
||
} else {
|
||
obj[key] = value;
|
||
}
|
||
return obj;
|
||
}
|
||
function _object_spread(target) {
|
||
for(var i = 1; i < arguments.length; i++){
|
||
var source = arguments[i] != null ? arguments[i] : {};
|
||
var ownKeys = Object.keys(source);
|
||
if (typeof Object.getOwnPropertySymbols === "function") {
|
||
ownKeys = ownKeys.concat(Object.getOwnPropertySymbols(source).filter(function(sym) {
|
||
return Object.getOwnPropertyDescriptor(source, sym).enumerable;
|
||
}));
|
||
}
|
||
ownKeys.forEach(function(key) {
|
||
_define_property(target, key, source[key]);
|
||
});
|
||
}
|
||
return target;
|
||
}
|
||
function ownKeys(object, enumerableOnly) {
|
||
var keys = Object.keys(object);
|
||
if (Object.getOwnPropertySymbols) {
|
||
var symbols = Object.getOwnPropertySymbols(object);
|
||
if (enumerableOnly) {
|
||
symbols = symbols.filter(function(sym) {
|
||
return Object.getOwnPropertyDescriptor(object, sym).enumerable;
|
||
});
|
||
}
|
||
keys.push.apply(keys, symbols);
|
||
}
|
||
return keys;
|
||
}
|
||
function _object_spread_props(target, source) {
|
||
source = source != null ? source : {};
|
||
if (Object.getOwnPropertyDescriptors) {
|
||
Object.defineProperties(target, Object.getOwnPropertyDescriptors(source));
|
||
} else {
|
||
ownKeys(Object(source)).forEach(function(key) {
|
||
Object.defineProperty(target, key, Object.getOwnPropertyDescriptor(source, key));
|
||
});
|
||
}
|
||
return target;
|
||
}
|
||
function _object_without_properties(source, excluded) {
|
||
if (source == null) return {};
|
||
var target = _object_without_properties_loose(source, excluded);
|
||
var key, i;
|
||
if (Object.getOwnPropertySymbols) {
|
||
var sourceSymbolKeys = Object.getOwnPropertySymbols(source);
|
||
for(i = 0; i < sourceSymbolKeys.length; i++){
|
||
key = sourceSymbolKeys[i];
|
||
if (excluded.indexOf(key) >= 0) continue;
|
||
if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue;
|
||
target[key] = source[key];
|
||
}
|
||
}
|
||
return target;
|
||
}
|
||
function _object_without_properties_loose(source, excluded) {
|
||
if (source == null) return {};
|
||
var target = {};
|
||
var sourceKeys = Object.keys(source);
|
||
var key, i;
|
||
for(i = 0; i < sourceKeys.length; i++){
|
||
key = sourceKeys[i];
|
||
if (excluded.indexOf(key) >= 0) continue;
|
||
target[key] = source[key];
|
||
}
|
||
return target;
|
||
}
|
||
|
||
|
||
const frontMatter = {
|
||
title: 'Advanced Policy Management with Kubewarden'
|
||
};
|
||
const contentTitle = undefined;
|
||
const metadata = {
|
||
"unversionedId": "integrations-in-rancher/kubewarden/kubewarden",
|
||
"id": "version-2.8/integrations-in-rancher/kubewarden/kubewarden",
|
||
"title": "Advanced Policy Management with Kubewarden",
|
||
"description": "Kubewarden is a Policy Engine that secures and helps manage your cluster resources. It allows for validation and mutation of resource requests via policies, including context-aware policies and verifying image signatures. It can run policies in monitor or enforcing mode and provides an overview of the state of the cluster.",
|
||
"source": "@site/versioned_docs/version-2.8/integrations-in-rancher/kubewarden/kubewarden.md",
|
||
"sourceDirName": "integrations-in-rancher/kubewarden",
|
||
"slug": "/integrations-in-rancher/kubewarden/",
|
||
"permalink": "/v2.8/integrations-in-rancher/kubewarden/",
|
||
"draft": false,
|
||
"editUrl": "https://github.com/rancher/rancher-docs/edit/main/versioned_docs/version-2.8/integrations-in-rancher/kubewarden/kubewarden.md",
|
||
"tags": [],
|
||
"version": "2.8",
|
||
"lastUpdatedAt": 1697741218,
|
||
"formattedLastUpdatedAt": "Oct 19, 2023",
|
||
"frontMatter": {
|
||
"title": "Advanced Policy Management with Kubewarden"
|
||
},
|
||
"sidebar": "tutorialSidebar",
|
||
"previous": {
|
||
"title": "Overview",
|
||
"permalink": "/v2.8/integrations-in-rancher/neuvector/overview"
|
||
},
|
||
"next": {
|
||
"title": "Operating System Management with Elemental",
|
||
"permalink": "/v2.8/integrations-in-rancher/elemental/"
|
||
}
|
||
};
|
||
const assets = {};
|
||
const toc = [
|
||
{
|
||
value: 'Kubewarden with Rancher',
|
||
id: 'kubewarden-with-rancher',
|
||
level: 2
|
||
},
|
||
{
|
||
value: 'Kubewarden with Rancher Prime',
|
||
id: 'kubewarden-with-rancher-prime',
|
||
level: 2
|
||
}
|
||
];
|
||
const layoutProps = {
|
||
toc
|
||
};
|
||
const MDXLayout = "wrapper";
|
||
function MDXContent(_param) {
|
||
var { components } = _param, props = _object_without_properties(_param, [
|
||
"components"
|
||
]);
|
||
return /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)(MDXLayout, _object_spread_props(_object_spread({}, layoutProps, props), {
|
||
components: components,
|
||
mdxType: "MDXLayout"
|
||
}), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("head", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("link", {
|
||
rel: "canonical",
|
||
href: "https://ranchermanager.docs.rancher.com/integrations-in-rancher/kubewarden"
|
||
})), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Kubewarden is a Policy Engine that secures and helps manage your cluster resources. It allows for validation and mutation of resource requests via policies, including context-aware policies and verifying image signatures. It can run policies in monitor or enforcing mode and provides an overview of the state of the cluster. `), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Kubewarden aims to be the Universal Policy Engine by enabling and simplifying Policy as Code. Kubewarden policies are compiled into WebAssembly: they are small (400KBs ~ 2MBs), sandboxed, secure, and portable. It aims to be universal by catering to each persona in your organization: `), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("ul", null, /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ul"
|
||
}, `Policy User: manage and declare policies using Kubernetes Custom Resources, reuse existing policies written in Rego (OPA and Gatekeeper). Test the policies outside the cluster in CI/CD. `), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ul"
|
||
}, `Policy Developer: write policies in your preferred Wasm-compiling language (Rego, Go, Rust, C#, Swift, Typescript, and more to come). Reuse the ecosystem of tools, libraries, and workflows you already know. `), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ul"
|
||
}, `Policy Distributor: policies are OCI artifacts, serve them through your OCI repository and use industry standards in your infrastructure, like Software-Bill-Of-Materials and artifact signatures. `), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ul"
|
||
}, `Cluster Operator: Kubewarden is modular (OCI registry, PolicyServers, Audit Scanner, Controller). Configure your deployment to suit your needs, segregating different tenants. Get an overview of past, current, and possible violations across the cluster with the Audit Scanner and the PolicyReports. `), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("li", {
|
||
parentName: "ul"
|
||
}, `Kubewarden Integrator: use it as a platform to write new Kubewarden modules and custom policies. `)), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
|
||
"id": "kubewarden-with-rancher"
|
||
}, `Kubewarden with Rancher`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Kubewarden’s upstream Helm charts are fully integrated as Rancher Apps, providing a UI for the install options. The charts also come with defaults that respect the Rancher stack (for example: not policing Rancher system namespaces), and default PolicyServer and Policies. Users have access to all Kubewarden features and can deploy PolicyServers and Policies manually by interacting with the Kubernetes API (e.g.: using kubectl). `), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `Kubewarden provides a full replacement of the removed Kubernetes Pod Security Policies. Kubewarden also integrates with the new Pod Security Admission feature introduced by a recent version of Kubernetes by augmenting its security capabilities. `), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("h2", {
|
||
"id": "kubewarden-with-rancher-prime"
|
||
}, `Kubewarden with Rancher Prime`), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The available Rancher UI Extension for Kubewarden integrates it into the Rancher UI. The UI Extension automates the installation and configuration of the Kubewarden stack and configures access to the policies maintained by SUSE. The UI Extension provides access to a curated catalog of ready-to-use policies. Using the UI Extension, one can browse, install, and configure these policies. `), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `The UI Extension provides an overview of the Kubewarden stack components and their behavior. This includes access to the Kubewarden metrics and trace events. An operator can understand the impact of policies on the cluster and troubleshoot issues. `), /*#__PURE__*/ (0,_mdx_js_react__WEBPACK_IMPORTED_MODULE_1__/* .mdx */ .kt)("p", null, `In addition, the UI Extension provides the Policy Reporter UI, which gives a visual overview of the compliance status of the Kubernetes cluster. With this UI, an operator can quickly identify all non-compliant Kubernetes resources, understand the reasons for violations and act accordingly.
|
||
All of this with the support offering of Rancher Prime.`));
|
||
}
|
||
MDXContent.isMDXComponent = true;
|
||
|
||
|
||
/***/ })
|
||
|
||
}]); |