Skip to content

Instantly share code, notes, and snippets.

@matburt
Created June 5, 2023 20:00
Show Gist options
  • Save matburt/7fbeeee5649978bfefdd83ee7b32277d to your computer and use it in GitHub Desktop.
Save matburt/7fbeeee5649978bfefdd83ee7b32277d to your computer and use it in GitHub Desktop.
An opa policy and Containerfile sidecar definition for use with ansible-runner runtime policy evaluation experiements
# This file is in ./policy/basic.opa
package ansible.basic
import future.keywords
default allow := false
allow if {
input.event == "runner_on_start"
input.task == "ansible.builtin.file"
input.hidden.state != "directory"
}
allow if {
input.event == "runner_on_start"
input.task != "ansible.builtin.file"
}
allow if {
input.event != "runner_on_start"
}
version: '3.7'
volumes:
opa_data:
driver: local
networks:
opa:
driver: bridge
services:
opa:
image: openpolicyagent/opa:latest
command: run --server --log-level debug --addr :8181 --set decision_logs.console=true /policy/basic.rego
ports:
- 8181:8181
volumes:
- ./policy:/policy
- opa_data:/data
networks:
- opa
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment