Windows Policy Work

[Mark Rossetti (marosset)]

This discussion will track policies we'd like to implement in https://github.com/open-policy-agent/gatekeeper-library to better secure Windows workloads.

1 comment per proposed policy.

[Mark Rossetti (marosset)]

TODO: figure out how to target Windows Pods.
Node selector is recommended way in upstream docs. If require different scenario such as runtime classes may require changes to change the target.

[Mark Rossetti (marosset)]

Add policy to enforce limits are set (and if requests are set they equal limits) for Windows containers

[Mark Rossetti (marosset)]

Add RunAsUsername policy to Gatekeeper
open-policy-agent/gatekeeper-library#4

[Mark Rossetti (marosset)]

Add gMSA policy to gatekeeper
open-policy-agent/gatekeeper-library#5