tsandall

- $KUBE_SRC below refers to the path of the kubernetes source code
  - commit 1cce15659750d90064882738425115ec547c1634

- build using $KUBE_SRC/hack/build-go
  - output is stored in $KUBE_SRC/_output/...

- kubemark:latest image is built by running "docker build -t kubemark:latest ." inside $KUBE_SRC/cluster/images/kubemark
  - need to copy kubemark binary into $KUBE_SRC/cluster/images/kubemark

- hollow-node.json is taken from template in $KUBE_SRC/test/kubemark/resources/

tsandall

package httpapi.authz

default allow = false

# Allow users to get their own salaries.
allow {
    input.method = "GET"
    input.path = ["finance", "salary", user]
    user = input.user
}

tsandall

package httpapi.authz

manager_of[employee] = manager {
    data.employees[employee].team = team_id
    data.teams[team_id].lead = manager 
}

tsandall

package ssh.authz

default allow = false

# Allow access to any user that has the "admin" role.
allow {
    data.roles["admin"][_] = input.user
}

# Allow access to any user who contributed to the code running on the host.

tsandall

package sudo.authz

default allow = false

# Allow sudo access to any user that has the "admin" role.
allow {
    data.roles["admin"][_] = input.user
}

tsandall

package puppet.authz

default allow = false

allow { not deny }

deny {
    resource = catalog.resources[resource_index]
    resource.type = "File"
    startswith(resource.title, "/etc/infra")

tsandall

# Example authorization policy for kubernetes.
#
# Configure kube-apiserver with the following command line arguments:
#
# --authorization-mode=Webhook
# --authorization-webhook-config-file=<path-to-kubeconfig-file>
#
# The kubeconfig file must locate OPA. For example:
#
#	clusters:

tsandall

package acmecorp.api
 
import data.acmecorp.roles

default allow = false
 
allow {
  input.method = “GET”
  input.path = [“accounts”, user]
  input.user = user

tsandall

allow {
	risk_score = (input.num_deletes * 10) + input.num_adds
	risk_score < risk_limit[input.user.title]
}

tsandall

package smart_home.authz

default allow = false

allow = true {
	op = allowed_operations[_]
	input.method = op.method
	input.resource = op.resource
}