RickCraig

package pipeline

deny[msg] {
	# Find all deployment stages
	stage = input.pipeline.stages[_].stage
	stage.type == "Deployment"

	# Get my namespace from the environment infra definition
	namespace := stage.spec.infrastructure.infrastructureDefinition.spec.namespace

RickCraig

package connector

# Block saves on any connector but Artifactory
deny[msg] {
	# Check that the type is artifactory
	input.entity.type != "Artifactory"

	# Show a human-friendly error message
	msg := sprintf("Artifactory is the only connector allowed, you have tried to create %s", [input.entity.type])
}

RickCraig

package pipeline

# Deny when the current date is after a start date and before an end date
# Could be used for deployment freezes
deny[msg] {
    freezeStart := time.parse_rfc3339_ns("2022-11-18T00:00:00+00:00")
    freezeEnd := time.parse_rfc3339_ns("2022-11-20T00:00:00+00:00")
    now := time.now_ns()

    now > freezeStart

RickCraig

package secrets

import future.keywords.in

# Choose one or more allowed providers based on there identifier
allowedProviders := ["harnessSecretManager"]

deny[msg] {
    # Check that the secret manager identifier exists in the white list
    not input.secret.spec.secretManagerIdentifier in allowedProviders

RickCraig

package secrets

# Deny secrets whose names do not follow the correct naming convention
# e.g. "Lion - MongoDB Password" is allowed but "Cool secret" is not
# NOTE: Try setting the name to "Test" to see the policy fail
deny[msg] {
	not regex.match("[Cheetah|Tiger|Lion]\\s[-]\\s[a-zA-Z0-9\\s]+", input.secret.name)
	msg := sprintf("Secret name '%s' must follow the correct naming convention 'Team - Purpose'", [input.secret.name])
}

RickCraig

package secret

import future.keywords.in

# The identifiers for one or more principals allowed to save secrets
allowedPrincipals = ["1234abcd"]

deny["Principal is not allowed to save secrets"] {
    # If the principal is not in the allowed principals list, deny.
    not input.metadata.principalIdentifier in allowedPrincipals

RickCraig

package connectors

# Deny connectors whose names do not follow the correct naming convention
# e.g. "Lion - Data Store" is allowed but "Cool connector" is not
# NOTE: Try setting the name to "Test" to see the policy fail
deny[msg] {
	not regex.match("[Cheetah|Tiger|Lion]\\s[-]\\s[a-zA-Z0-9\\s]+", input.entity.name)
	msg := sprintf("Connector name '%s' must follow the correct naming convention 'Team - Account'", [input.entity.name])
}

RickCraig

package connector

# Choose a connector type to check
connectorType := "K8sCluster"
# Choose one or more user groups, identified by the "indentifier" property
AllowedUserGroups := ["_project_all_users"]

deny[msg] {
    cType := input.entity.type

RickCraig

package connector

import future.keywords.in

# Choose a connector type to check
connectorType := "K8sCluster"
# Choose one or more allowed auth types for the above connector type
allowedAuthTypes := ["UsernamePassword"]

deny[msg] {

RickCraig

package feature_flags

# Deny flags that have the permanent label set to true
deny[msg] {
	input.flag.permanent == true
	msg := "Permanent flags are not allowed"
}