Skip to content

Instantly share code, notes, and snippets.

@sbueringer

sbueringer/blog-opa-perf-authorization-query.reg.rb

Created February 23, 2019 13:57
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save sbueringer/2ee9efc46040dfeb7401ae31a3b66c41 to your computer and use it in GitHub Desktop.
Save sbueringer/2ee9efc46040dfeb7401ae31a3b66c41 to your computer and use it in GitHub Desktop.
Download ZIP
blog-opa-perf-authorization-query.rego.rb
Raw
blog-opa-perf-authorization-query.reg.rb
deny[{"id": id, "resource": {"kind": "services", "namespace": "dev", "name": "grafana-svc"}, "resolution": resolution}]
with data["kubernetes"]["services"]["dev"]["grafana-svc"] as {
"kind":"SubjectAccessReview",
"apiVersion":"authorization.k8s.io/v1beta1",
"metadata":{
"creationTimestamp":null
},
"spec":{
"resourceAttributes":{
"namespace":"dev",
"verb":"update",
"version":"v1",
"resource":"services",
"name":"grafana-svc"
},
"user":"system:serviceaccount:default:controller",
"group":[
"system:serviceaccounts",
"system:serviceaccounts:default",
"system:authenticated"
],
"uid":"1471011f-f954-11e8-8752-fa163e203532"
},
"status":{
"allowed":false
}
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment