jmassardo

# List of namespaces to exclude
excludedNamespaces = {"good", "ok"}

imageSafety[decision] {
  # This rule compares the namespace from the admission controller
  # to the list of namespaces above
  not excludedNamespaces[input.request.namespace]
  data.library.v1.kubernetes.admission.workload.v1.block_latest_image_tag[message]

  decision := {

jmassardo

# List of namespaces to exclude
excludedNamespaces = {"good", "ok"}

imageSafety[decision] {
  # This rule compares the namespace from the admission controller
  # to the list of namespaces above
  not excludedNamespaces[input.request.namespace]
  data.library.v1.kubernetes.admission.workload.v1.block_latest_image_tag[message]

  decision := {

jmassardo

package policy["com.styra.kubernetes.validating"].test.test

# import the rules from this system
import data.policy["com.styra.kubernetes.validating"].rules.rules

# Name the test something specifc
test_excludedNamespaceGood {
    # `in` represents the JSON input that comes from the k8s admission controller
    # it doesn't have to be a full deployment, it only needs to represent the data point(s) being tested
    in := {

jmassardo

package terraform

import input as tfplan

# define mandatory tags as a set rather than array (then we can use set arithmetic below)
mandatory_tags := {
  "ApplicationName",
  "Environment",
  "Owner",
}

jmassardo

deny[msg] {
  input.resources[_].properties.storageProfile.imageReference.version == "latest"
  msg := "Resources should not use the `latest` image version"
}

jmassardo

# List of insecure ports
disallowedPorts = {"22", "80", "3389"}

deny[msg] {
  # loop through the resources and find all the network security groups.
  # Get all their security rules and destination ports
  resourcePorts := {p | c = input.resource_changes[_]; 
                        p = c.change.after.security_rule[_].destination_port_range}
  
  # Find any resource ports that match a port on the disallowed list

jmassardo

#example.rego

package authz

allow {
    input.path == ["users"]
    input.method == "POST"
}

jmassardo

#example_test.rego

test_post_allowed {
    allow with input as {"path": ["users"], "method": "POST"}
}

jmassardo

test_post_allowed {
    in := {"path": ["users"], "method": "POST"}
    allow with input as in
}

jmassardo

enforce[decision] {
  not excludedNamespaces[input.request.namespace]
  data.library.v1.kubernetes.admission.workload.v1.block_privileged_mode[message]

  decision := {
    "allowed": false,
    "message": message
  }
}