Kubernetes Admission Controller

[ogarrett]

Use Case: I would like to protect my Kubernetes cluster by preventing the deployment of containers that appear to contain malware.

Requirement: a "validating" Kubernetes admission controller that executes IOCScanner against workloads and prevents the deployment of workloads that appear to contain malware.

• https://kubernetes.io/docs/reference/access-authn-authz/admission-controllers/

Documentation requirements:

• HOWTO documentation
• Explanation of logging in success and failure cases, to assist troubleshooting
• Worked example, using a false-positive known-bad container that fails the IOCScan checks
• HOWTO configure Admission Controller to skip tests for certain containers ("in emergency, break glass"), for example, not blocking deployment of containers with certain labels.