Skip to content

Security

secureKubernetesWithRbacPolice

Warning

This function is only available on Linux at the moment.

Secure Kubernetes clusters with rbac-police.

Types:

  • secureKubernetesWithRbacPolice (attrsOf kubernetesWithRbacPolice): Optional. Defaults to { }.
  • kubernetesWithRbacPolice (submodule):
    • severity (str): Only evaluate policies with severity >= threshold. Defaults to Low.
    • setup (listOf package): Makes Environment or Makes Secrets to source (as in Bash's source) before anything else. Defaults to [ ].

Example:

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
{
  outputs,
  secretsForAwsFromGitlab,
  secretsForKubernetesConfigFromAws,
  secureKubernetesWithRbacPolice,
  ...
}: {
  secretsForAwsFromGitlab = {
    makesProd = {
      roleArn = "arn:aws:iam::123456789012:role/prod";
      duration = 7200;
      retries = 30;
    };
  };
  secretsForKubernetesConfigFromAws = {
    makes = {
      cluster = "makes-k8s";
      region = "us-east-1";
    };
  };
  secureKubernetesWithRbacPolice = {
    makes = {
      severity = "Low";
      setup = [
        outputs."/secretsForAwsFromGitlab/makesProd"
        outputs."/secretsForKubernetesConfigFromAws/makes"
      ];
    };
  };
}

1
m . /secureKubernetesWithRbacPolice/makes

securePythonWithBandit

Secure Python code with Bandit.

Types:

  • securePythonWithBandit (attrsOf projectType): Optional. Definitions of directories of python packages/modules to lint. Defaults to { }.
  • projectType (submodule):
    • target (str): Relative path to the package/module.

Example:

1
2
3
4
5
{
  securePythonWithBandit = {
    cli.target = "/src/cli";
  };
}

1
m . /securePythonWithBandit/cli