https://github.com/jferrater/opa-kubernetes
Deploying Open Policy Agent in Kubernetes
https://github.com/jferrater/opa-kubernetes
kubernetes opa openpolicyagent
Last synced: 11 months ago
JSON representation
Deploying Open Policy Agent in Kubernetes
- Host: GitHub
- URL: https://github.com/jferrater/opa-kubernetes
- Owner: jferrater
- Created: 2019-01-18T23:42:28.000Z (over 7 years ago)
- Default Branch: master
- Last Pushed: 2019-01-18T23:44:43.000Z (over 7 years ago)
- Last Synced: 2025-02-22T00:26:21.358Z (over 1 year ago)
- Topics: kubernetes, opa, openpolicyagent
- Homepage:
- Size: 1000 Bytes
- Stars: 0
- Watchers: 3
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
Awesome Lists containing this project
README
### Open Policy Agent - Kubernetes
#### Create configmap for policy, example.rego
First, create a ConfigMap containing a test policy. The test policy will define a blacklist that rejects:
- Objects missing a 'customer' label.
- Pods referring to images outside the corporate registry.
In this case, the policy file does not contain sensitive information so it's fine to store as a ConfigMap. If the file contained sensitive information, then we recommend you store it as a Secret.
`kubectl create configmap example-policy --from-file example.rego`
#### Create Deployment and Service objects
Next, create a Deployment to run OPA. The ConfigMap containing the policy is volume mounted into the container. This allows OPA to load the policy from the file system.
`kubectl create -f deployment-opa.yaml`
At this point OPA is up and running. Create a Service to expose OPA API so that you can query it.
`kubectl create -f service-opa.yaml`
Now you can query OPA's API. If you use the Pod example-pod.json, deny will be true because the Pod refers to image outside the corporate registry.
`curl $OPA_URL/v1/data -d @example-pod.json`
If you update the image to refer to the corporate registry, deny will be false.