open-policy-agent.yaml

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# kubectl create configmap inventory-policy -n apps --from-file policy.rego
kind: Service
apiVersion: v1
metadata:
  name: opa
  namespace: apps
  labels:
    app: opa
spec:
  type: ClusterIP
  selector:
    app: opa
  ports:
    - name: http
      protocol: TCP
      port: 8181
      targetPort: 8181
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: opa
  namespace: apps
  labels:
    app: opa
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: opa
      name: opa
    spec:
      containers:
      - name: opa
        image: openpolicyagent/opa:0.16.0
        ports:
        - name: http
          containerPort: 8181
        resources:
          requests:
            cpu: 250m          
        args:
        - "run"
        - "--ignore=.*"  # exclude hidden dirs created by Kubernetes
        - "--server"
        - "/policies"
        volumeMounts:
        - readOnly: true
          mountPath: /policies
          name: api-authz-policy
        livenessProbe:
          httpGet:
            scheme: HTTP              # assumes OPA listens on localhost:8181
            port: 8181
          initialDelaySeconds: 5      # tune these periods for your environemnt
          periodSeconds: 5
        readinessProbe:
          httpGet:
            path: /health?bundle=true  # Include bundle activation in readiness
            scheme: HTTP
            port: 8181
          initialDelaySeconds: 5
          periodSeconds: 5
      volumes:
      - name: api-authz-policy
        configMap:
          name: api-authz-policy
      nodeSelector:
        cloud.google.com/gke-nodepool: "apps"
---
apiVersion: v1
data:
  policy.rego: |
    package httpapi.authz

    # HTTP API request
    import input

    # Define admin permissions
    admin_roles = ["admin", ]
    admin_methods = ["GET", "POST", ]

    # Define user permissions
    user_roles = ["admin","user", ]
    user_methods = ["GET", ]

    # Define masking permissions
    unmasked_roles = ["admin"]

    default allow = false

    # Allow any app to get inventory
    allow {
      input.method == user_methods[_]
      input.path = ["/opa/items"]
      token.payload.role == user_roles[_]
    }

    # Allow only admin apps to create inventory
    allow {
      input.method == admin_methods[_]
      input.path = ["/opa/items"]
      token.payload.role == admin_roles[_]
    }

    # Allow unmasked customer data
    allow {
      input.path = ["/customers"]
      token.payload.role == unmasked_roles[_]
    }

    # Helper to get the token payload.
    token = {"payload": payload} {
      [header, payload, signature] := io.jwt.decode(input.token)
    }

kind: ConfigMap
metadata:
  name: api-authz-policy
  namespace: apps