Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Requests from "always allowed" namespace should not be sent to Wasm evaluators #599

Open
flavio opened this issue Nov 24, 2023 · 0 comments

Comments

@flavio
Copy link
Member

flavio commented Nov 24, 2023

Policy Server administrator can configure a special namespace that is not affected by the policies, meaning all the operations inside of it are always allowed. This is commonly used to exclude Kubewarden's namespace, preventing user's policies from damaging the whole stack (and hence causing an outage to the whole cluster).

Currently, the requests assigned to this namespace are still processed by the WebAssembly evaluators, but later the evaluation results are simply discarded and the request is accepted. As a minor optimization, we should change our code to immediately accept a request involving the "special namespace", without having to waste CPU cycles doing WebAssembly evaluations.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: No status
Development

No branches or pull requests

2 participants