{"id":30883420,"url":"https://github.com/globocom/enforcement","last_synced_at":"2025-09-08T09:45:41.781Z","repository":{"id":47309770,"uuid":"293807836","full_name":"globocom/enforcement","owner":"globocom","description":"Project focused on the implementation of policies in Kubernetes clusters through GitOps.","archived":false,"fork":false,"pushed_at":"2022-11-01T00:57:44.000Z","size":1304,"stargazers_count":13,"open_issues_count":5,"forks_count":6,"subscribers_count":10,"default_branch":"master","last_synced_at":"2025-04-06T08:36:36.898Z","etag":null,"topics":["hacktoberfest","kubernetes","python"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"bsd-3-clause","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/globocom.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-09-08T12:45:49.000Z","updated_at":"2022-06-18T17:22:25.000Z","dependencies_parsed_at":"2022-08-24T13:37:41.480Z","dependency_job_id":null,"html_url":"https://github.com/globocom/enforcement","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/globocom/enforcement","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/globocom%2Fenforcement","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/globocom%2Fenforcement/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/globocom%2Fenforcement/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/globocom%2Fenforcement/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/globocom","download_url":"https://codeload.github.com/globocom/enforcement/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/globocom%2Fenforcement/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":274166947,"owners_count":25233959,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-09-08T02:00:09.813Z","response_time":121,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["hacktoberfest","kubernetes","python"],"created_at":"2025-09-08T09:45:39.778Z","updated_at":"2025-09-08T09:45:41.768Z","avatar_url":"https://github.com/globocom.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"[![Actions Status](https://github.com/globocom/enforcement/workflows/build/badge.svg)](https://github.com/{owner}/{repo}/actions)\n\n# Enforcement\n## Introduction\nEnforcement is an open source project focused on the management and simultaneous deployment of applications and policies across multiple clusters through GitOps.\n\\\n\\\nEnforcement allows users to manage many clusters as easily as one. Users can deploy packages (resource collection) to clusters created from a cluster source (Rancher, GKE, EKS, etc.) and control deployments by specifying rules, which define a filter to select a group of clusters and the packages that should be installed in that group.\n\\\n\\\nWhen Enforcement detects the creation of a cluster in the cluster source, it checks whether the cluster fits into any specified rule, if there is any match, the packages configured in the rule are automatically installed in the cluster.\n\\\n\\\nThe packages include not just application deployment manifests, but anything that can be described as a feature of Kubernetes.\n\n## How does it work?\n\nEnforcement works as a Kubernetes Operator, which observes the creation of ClusterRule objects. These objects define rules that specify a set of clusters and the packages they are to receive.\n\\\n\\\nWhen Enforcement detects the creation of a cluster in cluster source, it registers the cluster and asks ArgoCD to install the packages configured for the cluster.\n\\\n\\\nArgoCD installs all packages in the cluster and ensures that they are always present.\n\n\\\n![alt text](https://raw.githubusercontent.com/globocom/enforcement-service/master/architecture.png)\n\n## Installation \n\nEnforcement can be installed on Kubernetes using a helm chart. See the following page for information on how to get Enforcement up and running.\n\\\n\\\n[Installing the helm chart](https://github.com/globocom/charts/tree/master/sources/enforcement)\n\n## Running Local \nInstall the dependencies using PipEnv. \n\n```shell\npipenv install \n```\nactivate the Pipenv shell. \n\n```shell\npipenv shell\n```\nRun the application. \n```shell\nkopf run main.py\n```\nBuild the Docker image. \n```shell\ndocker build -t enforcement . \n```\n## Configuration \nEnforcement uses the environment variables described in the table below to run locally or in the production and you have\nthe option of create a config.ini to configure as well instead variables and last option is use secret to configure you \nsources(rancher, gke, eks). You can see the examples below. \n\n### Creating an environment variables\n Environment Variable |      Example     |          Description         |\n|:--------------------:|:----------------:|:----------------------------:|\n | ARGO_URL                   | https://myargourl.domain.com                  | Argo URL          |\n| ARGO_USERNAME              | admin                                         | Argo Username            |\n| ARGO_PASSWORD              | password                                      | Argo Password            |\n| OPERATOR_NAMESPACE              | argocd                                      | Operator Namespace            |\n\n## Supported cluster sources\nEnforcement aims to detect the creation of clusters in several services of managed Kubernetes and cluster orchestration. Currently, the only cluster source supported is Rancher. We are developing support for EKS, GKE and AKS.\n\n## Creating a ClusterRule\nSee a complete example of creating ClusterRule for clusters created through Rancher.\n\\\n\\\nThe enforcements field defines all packages that will be installed in the clusters that match the criteria established within the source.rancher field. \n\n```yaml\napiVersion: enforcement.globo.com/v1beta1\nkind: ClusterRule\nmetadata:\n  name: dev-rules\nspec:\n  enforcements:\n    - name: helm-guestbook\n      repo: https://github.com/argoproj/argocd-example-apps\n      path: helm-guestbook\n      namespace: default\n      helm:\n        parameters:\n          replicaCount: 1\n    - name: guestbook\n      repo: https://github.com/argoproj/argocd-example-apps\n      path: guestbook\n  source:\n    rancher:\n      filters:\n        driver: googleKubernetesEngine\n      labels:\n        cattle.io/creator: \"norman\"\n      ignore:\n        - cluster1\n        - cluster2\n        - cluster3\n```\nThe rancher.filters, rancher.labels and rancher.ignore fields are specific to Rancher. Other cluster sources may have other values. You can get all the examples of ClusterRules objects [here](https://github.com/globocom/enforcement-service/tree/master/examples/sourcers).\n\nA ClusterRule also supports dynamic configurations using the Jinja expression language. You can create dynamic models \nusing cluster fields returned by cluster source, or any other valid Python code.\n\n```yaml\napiVersion: enforcement.globo.com/v1beta1\nkind: ClusterRule\nmetadata:\n  name: dynamic-rule\nspec:\n  enforcements: \n      #The variable name references the cluster name defined in the Cluster source.\n    - name: ${% if name=='cluster1' %} guestbook-cluster1 ${% else %} guestbook-other ${% endif %} \n      repo: https://github.com/argoproj/argocd-example-apps #Git repository\n      path: helm-guestbook \n      namespace: ${{ name }} #Cluster name\n      helm:\n        parameters: \n          replicaCount: ${{ 2*5 }}\n          clusterURL: ${{ url }} #Cluster URL\n  source:\n    rancher: {}\n```\nThe ***name***, ***url*** and ***id*** fields are available for all cluster sources, however there are also specific fields for each \nCluster source, see the list [here](https://github.com/globocom/enforcement-service/tree/master/examples/dynamic/dynamic.md).\n\nYou can also configure your ClusterRule using HTTP request returns using the Python [requests](https://docs.python-requests.org/en/master/) library.\n\n```yaml\napiVersion: enforcement.globo.com/v1beta1\nkind: ClusterRule\nmetadata:\n  name: dynamic-rule\nspec:\n  enforcements: \n    - name: guestbook\n      repo: https://github.com/argoproj/argocd-example-apps \n      path: helm-guestbook \n      helm:\n        parameters: \n          uuid: ${{ requests.get('https://httpbin.org/uuid').json()['uuid'] }}\n  source:\n    rancher: {}\n```\n\n## Triggers\n\nYou can configure triggers to be notified every time enforcement is installed on a cluster. Triggers are HTTP requests that Enforcement will make every time a package is installed on some cluster selected by cluster rule.\n\n```yaml\napiVersion: enforcement.globo.com/v1beta1\nkind: ClusterRule\nmetadata:\n  name: dev-rule #Rule name\nspec:\n  enforcements:\n   - name: guestbook #Name\n     repo: https://github.com/argoproj/argocd-example-apps #Git repository\n     path: guestbook #Package folder within the repository\n  source:\n    rancher: {}\n  triggers:\n    beforeInstall:\n      endpoint: http://myendpoint.com/before\n      timeout: 5 #Optional. 5 seconds is the default\n    afterInstall:\n      endpoint: http://myendpoint.com/after\n      timeout: 15 #Optional. 5 seconds is the default\n```\n### Creating a Secret\n\nEnforcement obtains the credentials to connect to the cluster source through a secret that must be previously created.\nSee an example of a secret created for the Rancher Cluster Source. \n\n```yaml\napiVersion: v1\nkind: Secret\nmetadata:\n  name: rancher-secret\ntype: Opaque\nstringData:\n  token: abc94943#434!\n  url: https://rancher.test.com\n``` \n\nIn this example of a secret for Rancher, we need to put two values that are the url and token however for other sources \nit could be different. You can see others example of secret objects [here](https://github.com/globocom/enforcement-service/tree/master/examples/secrets). \n\nYou can specify the name of the secret in the ***spec.source.secretName*** field of the cluster source object. When no secret name is specified, Enforcement looks for a secret with the same name as the source cluster used.\n\n## HOW TO TEST\nTo run the tests without coverage you may call: \n  ```shell\n  make test\n  ```\n\nTo run the tests with coverage you may call and before called make test: \n  ```shell\n  make coverage \n  ```\n\nTo generate the html you may call and called make test and make coverage before: \n  ```shell\n  make generate\n  ```  \n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fglobocom%2Fenforcement","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fglobocom%2Fenforcement","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fglobocom%2Fenforcement/lists"}