kura
kura copied to clipboard
feat(container.orchestration.provider): implemented enforcement allowlist
This PR introduces the Enforcement Allowlist into the Container Orchestration bundle: this adds another security level when managing containers.
The user can enable the Enforcement
through a new component option and write the list of image digests that are allowed to be run on the device.
If a container is run, the container orchestration will retrieve the container's image digests and compare it/them to the ones in the Enforcement Allowlist
:
- If the image digest is in the allowlist, the container will be allowed to start
- If not, the container is immediately stopped and deleted
Related Issue:
Description of the solution adopted:
Screenshots:
Manual Tests:
Any side note on the changes made:
The build succeeds locally but we are facing an issue in the CI connection to Sonar. An issue has been raised few weeks ago to the Eclipse Team: https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/4422
Merging without waiting for the CI to complete because we're experiencing even more issues with it (lack of executors, Sonar broken). The check introduced in the last commit doesn't change the code behaviour.