Uploaded image for project: 'Red Hat Advanced Cluster Security'
  1. Red Hat Advanced Cluster Security
  2. ROX-28708

Design policy as code for ACSCS

XMLWordPrintable

    • Design policy as code for ACSCS
    • Product / Portfolio Work
    • False
    • Hide

      None

      Show
      None
    • True
    • ROX-27859Policy as code for ACSCS (and other non Argo mechanisms)
    • Not Selected
    • Done
    • ROX-27859 - Policy as code for ACSCS (and other non Argo mechanisms)
    • 0% To Do, 0% In Progress, 100% Done
    • Hide

      2025-07-08:

      • Addressed a couple of review discussion, improving the guidelines document
      • Plan to publishing it this week, and creating the Epic for roxctl implementation

      2025-07-01:

      • Guideline doc for future Config as Code efforts sent to review by Kyle before publishing

      2025-06-24:

      • The design is done and we decided to build a roxctl reconciliation for policies
      • To wrap up the epic we need to talk to SensEco about the roxctl change / create an epic for them
      • Also @Johannes is writing a doc that summarizes our 3 different Config as Code approaches in ACS and when to choose which for future guideline regarding declarative config features.

      2025-05-20:

      • Discussed the design with CFW, general agreement to use roxctl for policy reconciliation
      • The discussion showed that there are a lot of open questions regarding general direction for config as code for the product (see desing doc for details)
      • A decision on whether those discussion should block the roxctl implementation is outstanding

      2025-05-13:

      • Ongoing design review

      2025-05-06:

      • Policy as Code for ACSCS design sent to review by other teams

      2025-04-29:

      • Restructured and extended Design doc.
      • Proposed solution is now extending roxctl with policy reconciliation

      2025-04-15:

      • Additional discussion showed that 2 of the 3 options have major drawbacks, which is why we're designing for roxctl reconciling the policy CRs now
      • Once the design is ready for review we'll reach out to SensEco (ownser of roxctl) to get more eyes on it

      2025-04-08:

      • Gathered Ideas for how to implement Policy as Code
      • Discussed those ideas with peers, leaving 3 potential implementation options
      • Next step: Detailed Design document outlining those options
      Show
      2025-07-08: Addressed a couple of review discussion, improving the guidelines document Plan to publishing it this week, and creating the Epic for roxctl implementation 2025-07-01: Guideline doc for future Config as Code efforts sent to review by Kyle before publishing 2025-06-24: The design is done and we decided to build a roxctl reconciliation for policies To wrap up the epic we need to talk to SensEco about the roxctl change / create an epic for them Also @Johannes is writing a doc that summarizes our 3 different Config as Code approaches in ACS and when to choose which for future guideline regarding declarative config features. 2025-05-20: Discussed the design with CFW, general agreement to use roxctl for policy reconciliation The discussion showed that there are a lot of open questions regarding general direction for config as code for the product (see desing doc for details) A decision on whether those discussion should block the roxctl implementation is outstanding 2025-05-13: Ongoing design review 2025-05-06: Policy as Code for ACSCS design sent to review by other teams 2025-04-29: Restructured and extended Design doc. Proposed solution is now extending roxctl with policy reconciliation 2025-04-15: Additional discussion showed that 2 of the 3 options have major drawbacks, which is why we're designing for roxctl reconciling the policy CRs now Once the design is ready for review we'll reach out to SensEco (ownser of roxctl) to get more eyes on it 2025-04-08: Gathered Ideas for how to implement Policy as Code Discussed those ideas with peers, leaving 3 potential implementation options Next step: Detailed Design document outlining those options
    • 0

      Overview:

      Epic to track the efforts to implement policy as code for ACSCS.

      Feature: ROX-27859

      Requirements:

      • All tenants of ACSCS should be able to use policy as code by default
      • Solution design should be generally applicable for deployments where users don't have direct Kube API access, not only ACSCS
      • Extending the managed configurations (e.g. additional CRs in case more config should be managed by the config-controller) should require no, or minimal effort from the end user

      Technical Scope:

      • Solution design and proposal for ACS and ACSCS changes required
      • Implementation tasks regarding ACSCS components

      Out of Scope:

      • Changes to the ACS core product. In case the solution design yield implementation tasks for the ACS core product a separate Epic tracking those tasks should be created.

              rh-ee-jmalsam Johannes Malsam
              rh-ee-jmalsam Johannes Malsam
              ACS Cloud Service
              Votes:
              0 Vote for this issue
              Watchers:
              2 Start watching this issue

                Created:
                Updated:
                Resolved: