isabella232 / gke-policy-automation

Tool and policy library for reviewing GKE clusters against best practices

GKE Policy Automation

This is not an officially supported Google product.

This repository contains the tool and policy library for validating selected GKE clusters against configuration best practices.

---

Table of Contents

• Install
• Usage
• Test
• Contributing
• License

Install

make

or

make build

Usage

Tool can be used from command line with gcloud CLI installed. CLI can be previously authenticated with gcloud auth application-default login command, or credentials may be passed with --creds parameter.

Parameters for GKE cluster review can be provided as command parameters or via configuration .yaml file.

gke-policy [global options] command [command options] [arguments...]

For cluster review with manually provided parameters:

./gke-policy cluster review -p <GCP_PROJECT_ID> -n <CLUSTER_NAME> -l <CLUSTER_LOCATION>

and with .yaml file with format:

silent: true
credentialsFile: ./test_credentials.json
clusters:
  - name: my-cluster
    project: my-project
    location: europe-central2
  - name: another
    project: my-project
    location: europe-central2
policies:
  - local: /tmp
outputs:
  - file: /some/file.json

Custom policies can be provided via local directory or remote Github repository. Example for local directory:

./gke-policy cluster review -p my_project -n my_cluster -l europe-central2-a \
--local-policy-dir ./gke-policies/policy

and for Github repository:

./gke-policy cluster review -p my_project -n my_cluster -l europe-central2-a \
--git-policy-repo "https://github.com/google/gke-policy-automation" \
--git-policy-branch main \
--git-policy-dir gka-policies

Test

Testing policy files with OPA Policy testing framework

opa test <POLICY_DIR>

for project policy folder:

opa test gke-policies

Contributing

Please check out Contributing and Code of Conduct docs before contributing. See also README for policies

License

Apache License 2.0