►
Description
Kubernetes Policy WG : CNCF Security SIG Policy Team Meeting 2020-09-16
B
A
A
A
D
A
So
the
only
other
item
I
mentioned
towards
the
top
of
the
hour
that
I
could
quickly
cover
is
just
some
pull
requests
which
were
merged
in
this
last
couple
of
weeks
and
so
I'll
just
give
a
quick
update
on
the
policy
report
cr
and
then
I
think
kirsten
said
that
jaya's
out
this
week,
so
I
don't
think
we
have
any
updates
from
her
or
her
team
yeah.
So
that's,
I
think
those
were
the
only
items
on
the
agenda.
A
Okay,
all
right
so
in
terms
of
the
policy
in
a
report
and
the
custom
resource
definition,
a
few.
The
small
changes
that
were
introduced
that
I
can
quickly
highlight
one
is
in
the
in
the
policy
report
itself.
If
you
recall
there
was
a
scope
selector
and
at
one
point
this
got
dropped
because
we
didn't
have
a
good
use
case
for
it.
A
So
one
of
the
use
cases
was
to
use
the
selector
to
actually
highlight
that
the
policy
report
was,
for
a
workload
run
through
a
helm,
chart
right
and
that
seemed
like
a
pretty
nice
way
of
tying
in
or
selecting
a
set
of.
You
know,
resources
that
belong
to
a
workload,
so
we
brought
back
the
the
scope
selector.
So
that's
this
field,
which
is
now
in
the
policy
report,
so
that
that's
part
of
the
cr
and
another
change
that
you
know
somewhat
related,
but
also
in
the
policy
report
result
instances
there.
A
A
So
the
previously,
what
we
had
was
just
a
resource
with
an
object
reference,
but
the
feedback
was
if
the
same
result
so
like
if
the
same
violation
applied
to
five
different
resources.
There
was
a
lot
of
duplication
in
terms
of
the
the
type
of
data
which
we
wanted
to
show
in
the
policy
result
element
right
so,
like
the
rule
details
the
message
things
like
that,
so
to
try
and
keep
things
more
more
condensed
what
we
did
was
we
changed
this
resources
field
to
be
a
list.
A
So
that
way,
you
could
have
one
result
element
which
has
a
list
of
resources,
or
you
could
also
use
a
selector
here
if
labels
are
applicable,
but
in
some
cases
it
seems
like
these
could
be
heterogeneous
resources
where
labels
may
not
apply
so
just
having
a
list
provides
a
lot
of
flexibility
and
that
way
a
particular
result
like,
for
example,
if
there's
a
violation
with
like
some,
you
know.
Let's
say
a
pod
is
running
as
root
user.
A
A
So
those
are
the
two
two
main
things
just
looking
at
the
list
of
issues,
I
haven't
seen
any
updates.
I
know
we
discussed
some
of
these
with
jail
last
time,
but
I
think
we
need
to
figure
out
what
we
do
with
the
time
fields
and
then
again,
if
you
want
to
put
more
data
in
the
policy
status
like
a
reason
or
remediation
and
some
more
more
information
there,
so
yeah
and
then
adding
things
like
again,
category
severity,
etc.
So
we
can
quickly
close
those
as
we
see
examples.
A
So
those
are
the
main
updates
from
my
side
also
like
in
terms
of
using
the
report
in
more
places.
We
need
to
decide
how
we
you
know.
We
talked
about
whether
in
picking
something
like
falco
or
also
potentially
coupe
bench
and
then
starting
to
look
at
transforming
or
reporting
the
the
follow,
creating
the
policy
report
from
those
tools.
A
D
A
Yeah,
maybe
if
erica,
if
you
want
to
start
like
a
thread
on
slack,
maybe
that's
the
best
way
to
communicate.
I
know
oz
was
on
there.
I
haven't,
I
don't
have
the
usernames
for
some
of
the
other
folks
from
the
team,
but
perhaps
we
can
just
kick
off
some
discussions
on
slack
and
that
way
get
quicker
feedback
than
waiting
for
the
next
call.
A
A
B
C
B
A
C
A
B
D
A
Okay,
yeah
and
you're.
Our
focus
has
been
so
there's
a
couple
of
projects.
We've
been
working
on
the
policy
report,
which
I
was
just
sharing,
some
updates
briefly
on.
That's
been
one
of
the
topics
and
then
just
generally
in
terms
of
how
to
rationalize
across
different
policy
engines
and
create
some
standard
tools
for
running
reporting,
etc
is
what
our
main
interest
is.