Uploaded image for project: 'OpenShift Request For Enhancement'
  1. OpenShift Request For Enhancement
  2. RFE-8241

RHACS: Provide an option to Quarantine the running pods in Enforce mode of Security Policies

XMLWordPrintable

    • Icon: Feature Request Feature Request
    • Resolution: Unresolved
    • Icon: Major Major
    • None
    • None
    • rhacs, rhacs-policy
    • None
    • Product / Portfolio Work
    • None
    • False
    • Hide

      None

      Show
      None
    • None
    • None
    • None
    • None
    • None
    • None
    • None
    • None

      1. Proposed title of this feature request - Provide an option to Quarantine the running pods in Enforce mode of Security Policies

      2. What is the nature and description of the request? - Apart from the option to Inform, inform and enforce (pod deletion), can there be an option to quarantine the running pods, i.e. block all the ingress and egress traffic out of the running pods. 

       

      3. Why does the customer need this? (List the business requirements here) - For few customers, killing the running pods is of no use as the pods spin back automatically after the old one killed. To avoid security risks, they want to ensure no traffic goes in and out of the affected pods.

      As a workaround, there is an way we can apply AdminNetworkPolicy (ANP) to the cluster on a specific label (say, security: quarantine) and upon security incidents apply this label to the affected pods to block the ingress and egress traffic as implemented in ANP. Engineering team can review this provide it as a feature out-of-the-box for easy action upon security incidents.

      4. List any affected packages or components.

       

              rh-ee-masimonm Maria Simon Marcos
              rh-ee-asaket Ashish Saket
              None
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                None
                None