PodDisruptionBudget check about gatekeeper-library HOT 10 CLOSED

I can take a look at this issue if no one is working on it 😄

from gatekeeper-library.

no, sorry. completely fell off my radar.

https://open-policy-agent.github.io/gatekeeper/website/docs/sync/ might be useful for helping solve it.

from gatekeeper-library.

I can take a look at this issue if no one is working on it smile
If you have time, Could you take a look this link?
open-policy-agent/community#69

from gatekeeper-library.

I'd be very interested in this as well. @kfox1111 have you found a workaround?

from gatekeeper-library.

not yet.

from gatekeeper-library.

If you have any updates, could you please share @kfox1111 ?

from gatekeeper-library.

I'd add one other recommendation. I've seen the elasticsearch operator adjust pdb to be equal to statefulset.replica's in times when the elasticsearch cluster is not green. This is a desirable feature I think. So the check should probably ignore enforcement on things that have ownerReference's

from gatekeeper-library.

As in, if a deployment has an owner reference, ignore the check?

Is there any risk of a user using this exception maliciously, such as by setting a false owner reference? It could reference a real K8s object, but the object could just not be managing the resource-under-test.

from gatekeeper-library.

Yeah. I don't think there's a way to deal with malicious in this context. There's probably quite a few ways besides just owner references to still make pdb's that block rolling upgrades. I think this check is probably useful just to try and prevent accidental configurations that block rolling upgrades.

from gatekeeper-library.

If we want to selectively disable it for certain services, would using match criteria be a better fit for that? It would leave more flexibility for configuration on the user's end.

from gatekeeper-library.