docs: modifying Tracee Policies

[AnaisUrlichs]

Question: Do all new Tracee Policies have to be added directly to the Tracee ConfigMap as detailed in the tutorial? If I have 64 Policies that would make the file very long.

It's detailed to add all Policies to the data section in the ConfigMap:

kubectl get configmap/tracee-policies -n tracee-system -o yaml     
apiVersion: v1
data:
  signatures.yaml: |-

From a user experience perspective, it would be much nicer to just apply the Policy directly to the tracee-system namespace: traceepolicyone.yaml

apiVersion: aquasecurity.github.io/v1beta1
kind: TraceePolicy
metadata:
  name: syscall-events
  namespace: tracee-system
  annotations:
    description: traces open syscall event
spec:
  scope:
    - global
  rules:
    - event: open

and then

kubectl apply -f traceepolicyone.yaml -n tracee-system

[josedonizetti]

Tracee policies will be CRDs in the future, it is a planned feature, but there is some work that needs to happen before, like allowing policies to be dynamically changed (something that we are changing right now) so we can have an operator change policies on the fly. While it the configmap should be used.