{"id":25412920,"url":"https://github.com/flomesh-io/demo-policy-as-code","last_synced_at":"2025-04-18T04:55:31.368Z","repository":{"id":98155824,"uuid":"402596183","full_name":"flomesh-io/demo-policy-as-code","owner":"flomesh-io","description":"Demo of Policy As pipy js Code","archived":false,"fork":false,"pushed_at":"2022-02-09T13:00:22.000Z","size":6765,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2025-02-16T13:49:54.921Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/flomesh-io.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-09-03T00:11:20.000Z","updated_at":"2022-04-30T20:42:16.000Z","dependencies_parsed_at":"2023-03-13T16:04:49.320Z","dependency_job_id":null,"html_url":"https://github.com/flomesh-io/demo-policy-as-code","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flomesh-io%2Fdemo-policy-as-code","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flomesh-io%2Fdemo-policy-as-code/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flomesh-io%2Fdemo-policy-as-code/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/flomesh-io%2Fdemo-policy-as-code/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/flomesh-io","download_url":"https://codeload.github.com/flomesh-io/demo-policy-as-code/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":249190114,"owners_count":21227298,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-02-16T13:38:16.015Z","updated_at":"2025-04-16T03:26:06.193Z","avatar_url":"https://github.com/flomesh-io.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Demo\n\n## 说明\n\n这个 demo 是在 [Rego 不好用？用 Pipy 实现 OPA](https://mp.weixin.qq.com/s/uZ_Q5Fn3XpfUEHBOFxWdvg) 的 helm chart 版本。使用 Pipy 来实现可信镜像仓库检查。\n\n\u003e 从互联网（或可信镜像仓库库以外的任何地方）拉取未知镜像会带来风险——例如恶意软件。但是还有其他很好的理由来维护单一的可信来源，例如在企业中实现可支持性。通过确保镜像仅来自受信任的镜像仓库，可以密切控制镜像库存，降低软件熵和蔓延的风险，并提高集群的整体安全性。除此以外，有时还会需要检查镜像的 tag，比如禁止使用 latest 镜像。\n\n## 运行 \n\n### 1. 准备工作\n这里使用 pipy 模拟策略服务器，本仓库中提供了 arm64 平台的版本，其他平台前往 [Pipy Releasees](https://github.com/flomesh-io/pipy/releases) 下载。\n\n截止目前当前最新版本是 `0.8.0-31`。\n\n```shell\n# 模拟策略服务器\n$ pipy scripts/rule-server.js\n```\n\n### 2. 更新配置\n\n1. 更新 `policy-as-code/values.yaml` 中的策略服务器 ip 地址\n2. 更新镜像 tag，如果是在 arm64 平台上部署，请修改为对应的 arm64 版本。比如 `0.8.0-31-arm64`\n\n\n### 3. 安装\n\n执行 helm 命令，安装 webhook。\n\n```shell\n$ helm install policy-as-code ./policy-as-code -n default\n$ kubectl get pod -n pipy\n```\n\n### 4. 测试\n\n```shell\n$ kubectl apply -f test/bad.yaml\nError from server (hello-world:linux repo not start with any repo [docker.io, k8s.gcr.io]): error when creating \"test/bad.yaml\": admission webhook \"validating-webhook.pipy.flomesh-io.cn\" denied the request: hello-world:linux repo not start with any repo [docker.io, k8s.gcr.io]\n$ kubectl apply -f test/bad2.yaml\nError from server (docker.io/library/hello-world:latest tag end with :latest): error when creating \"test/bad2.yaml\": admission webhook \"validating-webhook.pipy.flomesh-io.cn\" denied the request: docker.io/library/hello-world:latest tag end with :latest\n\n$ kubectl apply -f test/ok.yaml\npod/hello-world-success created\n$ kubectl logs -n default hello-world-success\n```\n\n修改 `scripts/image.js` 的策略规则，可以实时（每 5s 检查一次更新）查看策略的效果。","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fflomesh-io%2Fdemo-policy-as-code","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fflomesh-io%2Fdemo-policy-as-code","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fflomesh-io%2Fdemo-policy-as-code/lists"}