{"id":19622491,"url":"https://github.com/instrumenta/policies","last_synced_at":"2025-02-26T19:22:27.624Z","repository":{"id":54937818,"uuid":"244854658","full_name":"instrumenta/policies","owner":"instrumenta","description":"A set of shared policies for use with Conftest and other Open Policy Agent tools","archived":false,"fork":false,"pushed_at":"2021-01-20T13:43:37.000Z","size":12,"stargazers_count":67,"open_issues_count":5,"forks_count":10,"subscribers_count":10,"default_branch":"master","last_synced_at":"2025-01-09T11:45:19.644Z","etag":null,"topics":["conftest","open-policy-agent"],"latest_commit_sha":null,"homepage":null,"language":"Open Policy Agent","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"other","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/instrumenta.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-03-04T09:08:52.000Z","updated_at":"2024-05-29T05:34:24.000Z","dependencies_parsed_at":"2022-08-14T07:01:06.332Z","dependency_job_id":null,"html_url":"https://github.com/instrumenta/policies","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/instrumenta%2Fpolicies","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/instrumenta%2Fpolicies/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/instrumenta%2Fpolicies/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/instrumenta%2Fpolicies/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/instrumenta","download_url":"https://codeload.github.com/instrumenta/policies/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":240918855,"owners_count":19878506,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["conftest","open-policy-agent"],"created_at":"2024-11-11T11:28:04.030Z","updated_at":"2025-02-26T19:22:27.545Z","avatar_url":"https://github.com/instrumenta.png","language":"Open Policy Agent","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Policies\n\nOpen Policy Agent is a powerful library, and with tools like [Conftest](https://github.com/instrumenta/conftest),\n[Gatekeeper](https://github.com/open-policy-agent/gatekeeper) and more it has many uses.\n\nBy focusing on shared policies we can lower the barrier to entry to using these tools, as well as make it easier to\nlearn the Rego language.\n\n\n## An example\n\nA good example of where this is useful is with Conftest, and it's ability to pull policies from external sources.\nWithout being an expert in Rego, or needing to write any rules, it's possible to test your deployments with Conftest like so:\n\n```console\n$ conftest test --update github.com/instrumenta/policies.git//kubernetes deployment+service.yaml\nPASS - deployment+service.yaml - data.main.violation\nFAIL - deployment+service.yaml - hello-kubernetes in the Deployment hello-kubernetes does not have a memory limit set\nFAIL - deployment+service.yaml - hello-kubernetes in the Deployment hello-kubernetes does not have a CPU limit set\nFAIL - deployment+service.yaml - hello-kubernetes in the Deployment hello-kubernetes doesn't drop all capabilities\nFAIL - deployment+service.yaml - hello-kubernetes in the Deployment hello-kubernetes is not using a read only root filesystem\nFAIL - deployment+service.yaml - hello-kubernetes in the Deployment hello-kubernetes allows priviledge escalation\nFAIL - deployment+service.yaml - hello-kubernetes in the Deployment hello-kubernetes is running as root\n```\n\n## Interested?\n\nThis repository is hopefully a staging ground to collect together some useful policies in one place. This is not a unique idea,\nand the community is actively discussing sharing and reuse at the moment.\n\nIf you're interested in shared policies for Open Policy Agent please join the conversation. Join us on the Open Policy Agent\nSlack in the `#registry` channel, as well as the `#falco-opa-registry` channel on the [CNCF Slack](https://slack.cncf.io/).\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finstrumenta%2Fpolicies","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Finstrumenta%2Fpolicies","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Finstrumenta%2Fpolicies/lists"}