From the introduction of the openpolicyagent.org site:
First, make sure you have already installed Docker and have it running:
Inside your choosen directory, create two files. One called input.json file for your system representation and one file called example.rego for your rego policy rules.
Add the following content to your json file:
Add the following content for the example.rego:
Each violation block represents the rule that you want to validate your system against. The first violation block checks if any of the system servers have the http protocol in it. If that is the case, the server id is added to the array. In the same way, the second violation block checks for the servers that have the telnet protocol in it and if it finds a match the server id is also added to the violation array.
The final result bring all server ids that have violated any policy rule. In this way, allow is only going to be true if the number of violations are equal to zero.
Looking to our json file we can see that we have two servers violating our policy with the http and telnet protocols, the ci and busybox servers. So, lets run OPA in docker to find out if that is the case.
As we know we can use the opa eval command to evaluate Rego policies. So lets find out how we can run it from docker. To get docker run the eval command we must supply the input and policy files as arguments to docker using the -i and -d flags:
Run the following command, from the same directory where you saved your json and rego files, to download the opa image from docker and run it at the same time:
By mapping the files of your currently directory to the example directory inside docker we can then pass those files as arguments from the comamnd line using docker.
You should get the following result from running the opa eval command:
OPA generates policy decisions by evaluating the query input against policies and data.In this post i am going to show you an easy and fast way to test your policies by running OPA in Docker.
First, make sure you have already installed Docker and have it running:
docker ps
Inside your choosen directory, create two files. One called input.json file for your system representation and one file called example.rego for your rego policy rules.
Add the following content to your json file:
Add the following content for the example.rego:
Each violation block represents the rule that you want to validate your system against. The first violation block checks if any of the system servers have the http protocol in it. If that is the case, the server id is added to the array. In the same way, the second violation block checks for the servers that have the telnet protocol in it and if it finds a match the server id is also added to the violation array.
The final result bring all server ids that have violated any policy rule. In this way, allow is only going to be true if the number of violations are equal to zero.
count(violation) == 0
Looking to our json file we can see that we have two servers violating our policy with the http and telnet protocols, the ci and busybox servers. So, lets run OPA in docker to find out if that is the case.
As we know we can use the opa eval command to evaluate Rego policies. So lets find out how we can run it from docker. To get docker run the eval command we must supply the input and policy files as arguments to docker using the -i and -d flags:
Run the following command, from the same directory where you saved your json and rego files, to download the opa image from docker and run it at the same time:
docker run -v $PWD:/example openpolicyagent/opa eval -i example/input.json -d example/example.rego "data.example.violation[x]"
By mapping the files of your currently directory to the example directory inside docker we can then pass those files as arguments from the comamnd line using docker.
You should get the following result from running the opa eval command:
Comments
Post a Comment