{"id":15649266,"url":"https://github.com/garethr/policykit","last_synced_at":"2025-04-03T03:09:59.132Z","repository":{"id":57453982,"uuid":"218015061","full_name":"garethr/policykit","owner":"garethr","description":"A set of utilities and classes for working with Open Policy Agent based tools, including Gatekeeper and Conftest","archived":false,"fork":false,"pushed_at":"2024-10-31T16:28:59.000Z","size":45,"stargazers_count":39,"open_issues_count":1,"forks_count":1,"subscribers_count":4,"default_branch":"master","last_synced_at":"2025-03-26T06:51:45.366Z","etag":null,"topics":["openpolicyagent"],"latest_commit_sha":null,"homepage":null,"language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/garethr.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-10-28T09:52:58.000Z","updated_at":"2023-09-18T20:53:49.000Z","dependencies_parsed_at":"2024-12-27T12:01:07.308Z","dependency_job_id":null,"html_url":"https://github.com/garethr/policykit","commit_stats":{"total_commits":36,"total_committers":2,"mean_commits":18.0,"dds":"0.11111111111111116","last_synced_commit":"5b138ac5d7c9a149e0680f9598517dd5a6af3a35"},"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garethr%2Fpolicykit","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garethr%2Fpolicykit/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garethr%2Fpolicykit/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/garethr%2Fpolicykit/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/garethr","download_url":"https://codeload.github.com/garethr/policykit/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246927835,"owners_count":20856198,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["openpolicyagent"],"created_at":"2024-10-03T12:29:03.810Z","updated_at":"2025-04-03T03:09:59.089Z","avatar_url":"https://github.com/garethr.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Policy Kit\n\n[![CircleCI](https://circleci.com/gh/garethr/policykit.svg?style=svg)](https://circleci.com/gh/garethr/policykit)\n\nA set of utilities and classes for working with [Open Policy Agent](https://www.openpolicyagent.org/) based tools, including [Gatekeeper](https://github.com/open-policy-agent/gatekeeper) and [Conftest](https://github.com/instrumenta/conftest).\n\n\n## Installation\n\nPolicy Kit can be installed from PyPI using `pip` or similar tools:\n\n```\npip install policykit\n```\n\n\n## CLI\n\nThe module provides a CLI tool called `pk` for using some of the functionality.\n\n```console\n$ pk build *.rego\n[SecurityControls] Generating a ConstraintTemplate from \"SecurityControls.rego\"\n[SecurityControls] Searching \"lib\" for additional rego files\n[SecurityControls] Adding library from \"lib/kubernetes.rego\"\n[SecurityControls] Saving to \"SecurityControls.yaml\"\n```\n\nYou can also use the tool via Docker:\n\n```\ndocker run --rm -it -v $(pwd):/app  garethr/policykit build\n```\n\n\n## Python\n\nThis module currently contains several classes, the first for working with `ConstraintTemplates` in Gatekeeper.\n\n```python\nfrom policykit import ConstraintTemplate\n\nwith open(path_to_rego_source_file, \"r\") as rego:\n    ct = ConstraintTemplate(name, rego.read())\nprint(ct.yaml())\n```\n\nThe `Conftest` class makes interacting with [Conftest](https://github.com/instrumenta/conftest) from Python easy.\nNote that this requires the `conftest` executable to be available on the path.\n\n```python\n\u003e\u003e\u003e from policykit import Conftest\n\u003e\u003e\u003e cli = Conftest(\"policy\")\n\u003e\u003e\u003e result = cli.test(\"deployment.yaml\")\n\u003e\u003e\u003e result\nConftestRun(code=1, results=[ConftestResult(filename='/Users/garethr/Documents/conftest/examples/kubernetes/deployment.yaml', Warnings=[], Failures=['hello-kubernetes must include Kubernetes recommended labels: https://kubernetes.io/docs/concepts/overview/working-with-objects/common-labels/#labels ', 'Containers must not run as root in Deployment hello-kubernetes', 'Deployment hello-kubernetes must provide app/release labels for pod selectors'], Successes=[])]\n\u003e\u003e\u003e result.success\nFalse\n```\n\nPassing in a dictionary to `json_input` is parsed as JSON then sent as stdin to the `confest` executable.\n```python\nfrom policykit import Conftest\n\nresult = Conftest(\"policy\").test(json_input={\"foo\": \"bar\"})\nprint(result)\n```\n\n## Action\n\nPolicy Kit can also be easily used in GitHub Actions, using the following Action. This example also demonstrates\ncommitting the generated files back into the Git repository. Update the the values in `\u003c\u003e` as required.\n\n```yaml\non: push\nname: Gatekeeper\njobs:\n  build:\n    runs-on: ubuntu-latest\n    steps:\n    - uses: actions/checkout@master\n    - name: Generate ConstraintTemplates for Gatekeeper\n      uses: garethr/policykit/action@master\n      with:\n        args: \u003cdirectory-of-rego-source-files\u003e\n    - name: Commit to repository\n      env:\n        GITHUB_TOKEN: ${{ secrets.github_token }}\n        COMMIT_MSG: |\n          Generated new ConstraintTemplates from Rego source\n          skip-checks: true\n      run: |\n        # Hard-code user config\n        git config user.email \"\u003cyour-email-address\u003e\"\n        git config user.name \"\u003cyour-username\u003e\"\n        git config --get-regexp \"user\\.(name|email)\"\n        # Update origin with token\n        git remote set-url origin https://x-access-token:${GITHUB_TOKEN}@github.com/${GITHUB_REPOSITORY}.git\n        # Checkout the branch so we can push back to it\n        git checkout master\n        git add .\n        # Only commit and push if we have changes\n        git diff --quiet \u0026\u0026 git diff --staged --quiet || (git commit -m \"${COMMIT_MSG}\"; git push origin master\n```\n\n\n## Notes\n\nA few caveats for anyone trying to use this module.\n\n* [Loading libraries with `lib`](https://github.com/open-policy-agent/frameworks/commit/55fa33d1cca93f3b133e76a48d2e19adbdeb9de3) is only supported in Gatekeeper HEAD today but should be in the next release.\n* This module does not support parameterized ConstraintTemplates\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgarethr%2Fpolicykit","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fgarethr%2Fpolicykit","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fgarethr%2Fpolicykit/lists"}