https://github.com/tsandall/validating-and-mutating-example

A small example project containing a validating and mutating policy.
https://github.com/tsandall/validating-and-mutating-example

Last synced: 20 days ago
JSON representation

A small example project containing a validating and mutating policy.

• Host: GitHub
• URL: https://github.com/tsandall/validating-and-mutating-example
• Owner: tsandall
• Created: 2020-01-10T14:48:03.000Z (about 5 years ago)
• Default Branch: master
• Last Pushed: 2020-01-10T17:21:56.000Z (about 5 years ago)
• Last Synced: 2024-11-25T07:33:48.326Z (3 months ago)
• Language: Open Policy Agent
• Size: 4.88 KB
• Stars: 4
• Watchers: 3
• Forks: 4
• Open Issues: 0
• Metadata Files:
  • Readme: README.md

Awesome Lists containing this project

• awesome-opa - Validating and Mutating Admission Control Example - Example validating and mutation admission controller (Kubernetes / Built with Wasm)

README

        
# 🛠 Validating and Mutating Admission Control Example 🛠

This repository contains a small example of how to combine validating and mutating admission control policies in OPA using the [entry point contributed to the open-policy-agent/library repository](https://github.com/open-policy-agent/library/blob/master/kubernetes/mutating-admission/main.rego).

## Examples

* 🔪 The mutating policy sets an annotation on objects that indicate a requirement.

* 🛡️ The validating policy example checks for a specific label.

There are four files:

* [main.rego](./main.rego) is the entry point from the library repository

  copied with minor changes.

* [main_test.rego](main_test.rego) shows an end-to-end test of the

  validating and mutating policies.

* [validate-deny-missing-label.rego](validate-deny-missing-label.rego) shows a trivial validation policy with unit testing.

* [patch-add-dummy-annotation.rego](patch-add-dummy-annotation.rego)

  shows a trivial mutating policy with unit testing.

## Running

You can run the tests on the command-line:

```

opa test -b . -v

```

You can evaluate the entire policy with an example input on the command-line:

```

opa eval -b . -i input.json 'data.system.main'

```

> Hint: check out the ['Open Policy Agent' extension for VS Code](https://github.com/open-policy-agent/vscode-opa). Try the `OPA: Test Workspace`, `OPA: Evaluate Selection`, and `OPA: Toggle Evaluation Coverage` commands on this project.