genpolicy-msft: remove settings patch for env #159
Conversation
|
cc @3u13r: Depending on how the demodir images are built, they may stop working with this change. There are two workarounds:
Please let me know which way you'd prefer. |
burgerdev
force-pushed
the
burgerdev/policy
branch
from
87b0c25 to
1c9092e
Compare
|
I split this PR: the added PATH vars now go into #156 to unblock that, while the settings change stays here - potentially blocked until we fix the demo images. |
|
Which |
|
Yes, emojovoto - I meant the images for |
|
Turns out none of them do, as they are all produced with buildkit. |
The genpolicy-settings.json allow overriding the permissible set of environment variables, and come with a generic list of env vars suitable for the AKS environment. We want to have a dev setting that allows debugging (e.g. pod network settings like iptables), but that is otherwise as close to the upstream as possible. Environment variable allowlists are generated by genpolicy, and should thus not need blanket exemptions, even in dev setups. Thus, we remove the blanket allowlist and work around the limitations in our deployment yaml.
burgerdev
force-pushed
the
burgerdev/policy
branch
from
1c9092e to
ac8d9d4
Compare
|
With the changes from #156 this is now good to go, ptal. |
The genpolicy-settings.json allow overriding the permissible set of
environment variables, and come with a generic list of env vars suitable
for the AKS environment.
We want to have a dev setting that allows debugging (e.g. pod network
settings like iptables), but that is otherwise as close to the upstream
as possible. Environment variable allowlists are generated by genpolicy,
and should thus not need blanket exemptions, even in dev setups. Thus,
we remove the blanket allowlist and work around the limitations in our
deployment yaml.