https://github.com/infracloudio/ci-cd-standards-using-opa

A github-action to validate your infrastructure configuration manifests (eg. kubernetes resource yaml manifests) against the ci-cd standards using OpenPolicyAgent (OPA).
https://github.com/infracloudio/ci-cd-standards-using-opa

ci-cd github-actions kubernetes openpolicyagent

Last synced: 11 months ago
JSON representation

A github-action to validate your infrastructure configuration manifests (eg. kubernetes resource yaml manifests) against the ci-cd standards using OpenPolicyAgent (OPA).

• Host: GitHub
• URL: https://github.com/infracloudio/ci-cd-standards-using-opa
• Owner: infracloudio
• License: mit
• Created: 2020-04-21T15:43:15.000Z (over 6 years ago)
• Default Branch: master
• Last Pushed: 2021-08-23T07:08:56.000Z (almost 5 years ago)
• Last Synced: 2025-04-02T15:45:28.275Z (over 1 year ago)
• Topics: ci-cd, github-actions, kubernetes, openpolicyagent
• Language: Shell
• Homepage:
• Size: 16.6 KB
• Stars: 6
• Watchers: 2
• Forks: 3
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • License: LICENSE

Awesome Lists containing this project

README

          
# ci-cd-standards-using-opa

[![Actions Status](https://github.com/ameydev/ci-cd-standards-using-opa/workflows/Build./badge.svg?branch=master)](https://github.com/ameydev/ci-cd-standards-using-opa/actions) [![Actions Status](https://github.com/ameydev/ci-cd-standards-using-opa/workflows/Opa%20tests/badge.svg?branch=master)](https://github.com/ameydev/ci-cd-standards-using-opa/actions)

A github-action to validate your infrastructure configuration manifests (eg. kubernetes resource yaml manifests) against the ci-cd standards using OpenPolicyAgent(OPA).

This action uses [`opa eval`](https://www.openpolicyagent.org/docs/latest/#2-try-opa-eval) command, to make sure that the specifications committed in any of the yaml manifests are not violating the standard policies.

## Usage

## Example workflow.

```yaml

name: Pre-deploy validation of k8s resources.

on: [push]

jobs:

  build:

    runs-on: ubuntu-latest

    steps:

    - uses: actions/checkout@master

    - name: OPA-Test ci-cd manifests standards.

      uses: ameydev/ci-cd-standards-using-opa@master

      env:

        MANIFESTS_PATH_PATTERN: k8s/subpath/ #eg. directoy path or file path k8s/subpath/deploy.yaml

        LIBRARY_PATH: opa-policies/ci-standards #path to your ci-cd policies.

        DATA: data.kubernetes.admission.deny # the policy data 

```

## Use opa command to execute opa unit tests

```yaml

    - name: OPA-Test ci-cd manifests standards.

      uses: ameydev/ci-cd-standards-using-opa@master

      env:

        MANIFESTS_PATH_PATTERN: k8s/subpath/ #eg. directoy path or file path k8s/subpath/deploy.yaml

        LIBRARY_PATH: opa-policies/ci-standards #path to your ci-cd policies.

        DATA: data.kubernetes.admission.deny # the policy data 

      with:

        args: opa test test-data/policies 

```

## Write a CI-CD standard policy using Rego.

You can write any number of standard policies using [Rego language](https://www.openpolicyagent.org/docs/latest/policy-language/)

Example of rego policy which will deny the containers in a pod, running as a root user.

Check more exampples of policies in [`test-data/`](https://github.com/ameydev/ci-cd-standards-using-opa/tree/master/test-data/policies).

```

  package kubernetes.admission

  

  deny[msg] {

    input.kind = "Deployment"

    not input.spec.template.spec.securityContext.runAsNonRoot = true

    msg = "Deployment Standards: Containers must not run as root"

  }

  

  deny[msg] {

    input.kind = "Deployment"

    not input.spec.securityContext.runAsNonRoot = true

    msg = "Pod Standards: Containers must not run as root"

  }

```

TODO:

- Terraform, Chef and Puppet support