jmassardo

curl -H "Authorization: token ${GH_PAT}" -X POST \
-d '{"query": "mutation {create_org: createEnterpriseOrganization(input: {adminLogins: [\"<ADMIN_HANDLE>\", \"<ADMIN_HANDLE>\", \"<ADMIN_HANDLE>\"] billingEmail: \"<ADMIN_EMAIL>\" enterpriseId: \"<ENTPRISE_ID>\" login: \"<ORG_SLUG>\" profileName: \"<ORG_FULL_NAME>\" }){organization {id}}}"}' https://api.github.com/graphql

jmassardo

#!/usr/bin/env ruby

require 'octokit'
require 'json'

client = Octokit::Client.new(access_token: ENV['GITHUB_TOKEN'])

query = <<-GRAPHQL
query { 
  enterprise(slug: "<MY-ENT-NAME>"){ 

jmassardo

package policy["com.styra.kubernetes.validating"].test.test

import data.policy["com.styra.kubernetes.validating"].rules.rules

test_block_priv_mode {
    in := {
  "kind": "AdmissionReview",
  "request": {
    "kind": {
      "kind": "Pod",

jmassardo

block_priv_mode[decision] {
  not excludedNamespaces[input.request.namespace]
  data.library.v1.kubernetes.admission.workload.v1.block_privileged_mode[message]

  decision := {
    "allowed": false,
    "message": message
  }
}

jmassardo

enforce[decision] {
  not excludedNamespaces[input.request.namespace]
  data.library.v1.kubernetes.admission.workload.v1.block_privileged_mode[message]

  decision := {
    "allowed": false,
    "message": message
  }
}

jmassardo

test_post_allowed {
    in := {"path": ["users"], "method": "POST"}
    allow with input as in
}

jmassardo

#example_test.rego

test_post_allowed {
    allow with input as {"path": ["users"], "method": "POST"}
}

jmassardo

#example.rego

package authz

allow {
    input.path == ["users"]
    input.method == "POST"
}

jmassardo

# List of insecure ports
disallowedPorts = {"22", "80", "3389"}

deny[msg] {
  # loop through the resources and find all the network security groups.
  # Get all their security rules and destination ports
  resourcePorts := {p | c = input.resource_changes[_]; 
                        p = c.change.after.security_rule[_].destination_port_range}
  
  # Find any resource ports that match a port on the disallowed list

jmassardo

deny[msg] {
  input.resources[_].properties.storageProfile.imageReference.version == "latest"
  msg := "Resources should not use the `latest` image version"
}