PoliFlow Enforcer

ℹ️ NoteThis repository is part of the PoliFlow framework.For more details, please refer to: https://doi.org/10.5281/zenodo.18632240 PoliFlow Enforcer Extension to the Knative queue-proxy for enforcing rules defined by the PoliFlow Extractor. Instructions The image can be built using the build.sh Bash script. However, before building, it is necessary to set the KO_DOCKER_REPO variable to the desired container registry to which the image will be pushed to. Then, the Kubernetes cluster where Knative Services protected by the Enforcer also needs some configurations. These can be automatically set by running the patch.sh script. Note, however, that the script will only run successfully if Knative is already installed in the cluster. Moreover, the script will also need a small modification to set the correct container registry (to the same set with KO_DOCKER_REPO in the build.sh script). Regarding the Enforcer usage, Knative Services must have the following metadata annotations to work with this plugin: spec: template: metadata: annotations: qpoption.knative.dev/flow-activate: enable qpoption.knative.dev/flow-config-allowed_json_flows: | qpoption.knative.dev/flow-config-type: event The plugin is activated for any service that has the annotation qpoption.knative.dev/flow-activate set to enable. Then, the allowed paths extracted by the PoliFlow Enforcer must be set (in JSON) as the value ot the qpoption.knative.dev/flow-config-allowed_json_flows annotation. Finally, qpoption.knative.dev/flow-config-type is an optional annotation that can be used to set the type of protected Knative Service. It accepts the values function (default) and event, used to define BaaS services (such as databases, that are called through callbacks within the workflow).