Should I expect k-rail to stop tiller being installed? about k-rail HOT 3 CLOSED

Ok, I'll close now.

Thanks for all the extra info.

from k-rail.

The No Tiller policy is not very robust, because there isn't a great way to detect Tiller. We created that policy not as a strong security control, but a reminder to our engineers that Tiller should not be used, and to seek alternate methods that we provide. All the policy does is check for the substring /tiller in the image name, which matches what the official docs specify for Helm 2: https://helm.sh/docs/using_helm/#upgrading-tiller
It likely isn't triggering for you because your image name does not contain /tiller.

On a related note, the No Docker Sock policy is also not very robust because it blocks hostPath mounts with /var/run/docker.sock but not one with /var/run or /var. It is more useful for analyzing usage of that mount and as a step towards blocking all hostPath mounts. It is recommended that you apply the No Bind Mount policy (no hostPath mounts) because it does block all paths.

from k-rail.

I've updated the readme with notes on the aforementioned policies.

from k-rail.