New OPA website (Hugo + Netlify)

Signed-off-by: lucperkins <lucperkins@gmail.com>

docs/code/deployments-docker/example/data.json

@@ -0,0 +1,3 @@
+{
+    "hostOS": "$(uname)"
+}

docs/code/deployments-docker/example/policy.rego

@@ -0,0 +1,6 @@
+package example
+
+greeting = msg {
+    concat("", ["Hello ", data.example.hostOS, "!"], msg)
+}
+

docs/code/deployments-kubernetes/deployment-opa.yaml

@@ -0,0 +1,33 @@
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  name: opa
+  labels:
+    app: opa
+spec:
+  replicas: 1
+  template:
+    metadata:
+      labels:
+        app: opa
+      name: opa
+    spec:
+      containers:
+      - name: opa
+        image: openpolicyagent/opa:0.10.5
+        ports:
+        - name: http
+          containerPort: 8181
+        args:
+        - "run"
+        - "--ignore=.*"  # exclude hidden dirs created by Kubernetes
+        - "--server"
+        - "/policies"
+        volumeMounts:
+        - readOnly: true
+          mountPath: /policies
+          name: example-policy
+      volumes:
+      - name: example-policy
+        configMap:
+          name: example-policy

docs/code/deployments-kubernetes/example-pod.json

@@ -0,0 +1,20 @@
+{
+    "input": {
+        "kind": "Pod",
+        "apiVersion": "v1",
+        "metadata": {
+            "name": "opa",
+            "labels": {
+                "customer": "example.org"
+            }
+        },
+        "spec": {
+            "containers": [
+                {
+                    "name": "opa",
+                    "image": "openpolicyagent/opa"
+                }
+            ]
+        }
+    }
+}

docs/code/deployments-kubernetes/example.rego

@@ -0,0 +1,15 @@
+package example
+
+default deny = false
+
+# Reject objects without a customer label.
+deny {
+    not input.metadata.labels.customer
+}
+
+# Reject pods referring to images outside the corporate registry.
+deny {
+    input.kind == "Pod"
+    container := input.spec.containers[_]
+    not re_match("^registry.acmecorp.com/.+$", container.image)
+}

docs/code/deployments-kubernetes/service-opa.yaml

@@ -0,0 +1,15 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: opa
+  labels:
+    app: opa
+spec:
+  type: NodePort
+  selector:
+    app: opa
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8181
+      targetPort: 8181

docs/code/kubernetes-admission-control-validation/admission-controller.yaml

@@ -0,0 +1,130 @@
+# Grant OPA/kube-mgmt read-only access to resources. This lets kube-mgmt
+# replicate resources into OPA so they can be used in policies.
+kind: ClusterRoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  name: opa-viewer
+roleRef:
+  kind: ClusterRole
+  name: view
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+- kind: Group
+  name: system:serviceaccounts:opa
+  apiGroup: rbac.authorization.k8s.io
+---
+# Define role for OPA/kube-mgmt to update configmaps with policy status.
+kind: Role
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  namespace: opa
+  name: configmap-modifier
+rules:
+- apiGroups: [""]
+  resources: ["configmaps"]
+  verbs: ["update", "patch"]
+---
+# Grant OPA/kube-mgmt role defined above.
+kind: RoleBinding
+apiVersion: rbac.authorization.k8s.io/v1
+metadata:
+  namespace: opa
+  name: opa-configmap-modifier
+roleRef:
+  kind: Role
+  name: configmap-modifier
+  apiGroup: rbac.authorization.k8s.io
+subjects:
+- kind: Group
+  name: system:serviceaccounts:opa
+  apiGroup: rbac.authorization.k8s.io
+---
+kind: Service
+apiVersion: v1
+metadata:
+  name: opa
+  namespace: opa
+spec:
+  selector:
+    app: opa
+  ports:
+  - name: https
+    protocol: TCP
+    port: 443
+    targetPort: 443
+---
+apiVersion: extensions/v1beta1
+kind: Deployment
+metadata:
+  labels:
+    app: opa
+  namespace: opa
+  name: opa
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: opa
+  template:
+    metadata:
+      labels:
+        app: opa
+      name: opa
+    spec:
+      containers:
+        # WARNING: OPA is NOT running with an authorization policy configured. This
+        # means that clients can read and write policies in OPA. If you are
+        # deploying OPA in an insecure environment, be sure to configure
+        # authentication and authorization on the daemon. See the Security page for
+        # details: https://www.openpolicyagent.org/docs/security.html.
+        - name: opa
+          image: openpolicyagent/opa:0.10.5
+          args:
+            - "run"
+            - "--server"
+            - "--tls-cert-file=/certs/tls.crt"
+            - "--tls-private-key-file=/certs/tls.key"
+            - "--addr=0.0.0.0:443"
+            - "--addr=http://127.0.0.1:8181"
+          volumeMounts:
+            - readOnly: true
+              mountPath: /certs
+              name: opa-server
+        - name: kube-mgmt
+          image: openpolicyagent/kube-mgmt:0.6
+          args:
+            - "--replicate-cluster=v1/namespaces"
+            - "--replicate=extensions/v1beta1/ingresses"
+      volumes:
+        - name: opa-server
+          secret:
+            secretName: opa-server
+---
+kind: ConfigMap
+apiVersion: v1
+metadata:
+  name: opa-default-system-main
+  namespace: opa
+data:
+  main: |
+    package system
+
+    import data.kubernetes.admission
+
+    main = {
+      "apiVersion": "admission.k8s.io/v1beta1",
+      "kind": "AdmissionReview",
+      "response": response,
+    }
+
+    default response = {"allowed": true}
+
+    response = {
+        "allowed": false,
+        "status": {
+            "reason": reason,
+        },
+    } {
+        reason = concat(", ", admission.deny)
+        reason != ""
+    }

docs/code/kubernetes-admission-control-validation/ingress-conflicts.rego

@@ -0,0 +1,13 @@
+package kubernetes.admission
+
+import data.kubernetes.ingresses
+
+deny[msg] {
+    input.request.kind.kind == "Ingress"
+    input.request.operation == "CREATE"
+    host := input.request.object.spec.rules[_].host
+    ingress := ingresses[other_ns][other_ingress]
+    other_ns != input.request.namespace
+    ingress.spec.rules[_].host == host
+    msg := sprintf("invalid ingress host %q (conflicts with %v/%v)", [host, other_ns, other_ingress])
+}

docs/code/kubernetes-admission-control-validation/ingress-whitelist.rego

@@ -0,0 +1,36 @@
+package kubernetes.admission
+
+import data.kubernetes.namespaces
+
+deny[msg] {
+    input.request.kind.kind == "Ingress"
+    input.request.operation == "CREATE"
+    host := input.request.object.spec.rules[_].host
+    not fqdn_matches_any(host, valid_ingress_hosts)
+    msg := sprintf("invalid ingress host %q", [host])
+}
+
+valid_ingress_hosts = {host |
+    whitelist := namespaces[input.request.namespace].metadata.annotations["ingress-whitelist"]
+    hosts := split(whitelist, ",")
+    host := hosts[_]
+}
+
+fqdn_matches_any(str, patterns) {
+    fqdn_matches(str, patterns[_])
+}
+
+fqdn_matches(str, pattern) {
+    pattern_parts := split(pattern, ".")
+    pattern_parts[0] == "*"
+    str_parts := split(str, ".")
+    n_pattern_parts := count(pattern_parts)
+    n_str_parts := count(str_parts)
+    suffix := trim(pattern, "*.")
+    endswith(str, suffix)
+}
+
+fqdn_matches(str, pattern) {
+    not contains(pattern, "*")
+    str := pattern
+}