Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

tools: Allow setting policy rego file via environment variable #123

Merged
merged 4 commits into from
Dec 20, 2023
Merged

tools: Allow setting policy rego file via environment variable #123

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
3754c20
Set policy file via env var
ms-mahuber Dec 12, 2023
7b60085
Add restrictive policy file to kata-opa folder
ms-mahuber Dec 13, 2023
0ef769e
Change restrictive policy file name
ms-mahuber Dec 13, 2023
1a5105d
Change relative default path location
ms-mahuber Dec 14, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/kata-opa/allow-set-policy.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
package agent_policy

default SetPolicyRequest := true
1 change: 1 addition & 0 deletions tests/integration/kubernetes/setup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,7 @@ else
K8S_TEST_POLICY_FILES=( \
"allow-all.rego" \
"allow-all-except-exec-process.rego" \
"allow-set-policy.rego" \
)
fi

Expand Down
20 changes: 16 additions & 4 deletions tools/osbuilder/rootfs-builder/rootfs.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,10 +28,13 @@ LIBC=${LIBC:-musl}
SECCOMP=${SECCOMP:-"yes"}
SELINUX=${SELINUX:-"no"}
AGENT_POLICY=${AGENT_POLICY:-no}
AGENT_POLICY_FILE=${AGENT_POLICY_FILE:-"allow-all.rego"}

lib_file="${script_dir}/../scripts/lib.sh"
source "$lib_file"

agent_policy_file="$(readlink -f "${script_dir}/../../../src/kata-opa/${AGENT_POLICY_FILE}")"

#For cross build
CROSS_BUILD=${CROSS_BUILD:-false}
BUILDX=""
Expand Down Expand Up @@ -113,6 +116,12 @@ AGENT_INIT When set to "yes", use ${AGENT_BIN} as init process in place
of systemd.
Default value: no

AGENT_POLICY_FILE Path to the agent policy rego file to be set in the rootfs.
If defined, this overwrites the default setting of the
permissive policy file. The path is relative to the policy
rego file directory 'src/kata-opa'.
Default value: allow-all.rego

AGENT_SOURCE_BIN Path to the directory of agent binary.
If set, use the binary as agent but not build agent package.
Default value: <not set>
Expand Down Expand Up @@ -321,6 +330,8 @@ check_env_variables()

[ -n "${KERNEL_MODULES_DIR}" ] && [ ! -d "${KERNEL_MODULES_DIR}" ] && die "KERNEL_MODULES_DIR defined but is not an existing directory"

[ ! -f "${agent_policy_file}" ] && die "agent policy file not found in '${agent_policy_file}'"

[ -n "${OSBUILDER_VERSION}" ] || die "need osbuilder version"
}

Expand Down Expand Up @@ -447,6 +458,7 @@ build_rootfs_distro()
--env ROOTFS_DIR="/rootfs" \
--env AGENT_BIN="${AGENT_BIN}" \
--env AGENT_INIT="${AGENT_INIT}" \
--env AGENT_POLICY_FILE="${AGENT_POLICY_FILE}" \
--env ARCH="${ARCH}" \
--env CI="${CI}" \
--env MEASURED_ROOTFS="${MEASURED_ROOTFS}" \
Expand Down Expand Up @@ -672,18 +684,18 @@ EOF
fi

# Install default settings for the kata-opa service.
local kata_opa_in_dir="${script_dir}/../../../src/kata-opa"
local opa_settings_dir="/etc/kata-opa"
local policy_file="allow-all.rego"
local policy_file_name="$(basename ${agent_policy_file})"
local policy_dir="${ROOTFS_DIR}/${opa_settings_dir}"
mkdir -p "${policy_dir}"
install -D -o root -g root -m 0644 "${kata_opa_in_dir}/${policy_file}" -T "${policy_dir}/${policy_file}"
ln -sf "${policy_file}" "${policy_dir}/default-policy.rego"
install -D -o root -g root -m 0644 "${agent_policy_file}" -T "${policy_dir}/${policy_file_name}"
ln -sf "${policy_file_name}" "${policy_dir}/default-policy.rego"

if [ "${AGENT_INIT}" == "yes" ]; then
info "OPA will be started by the kata agent"
else
# Install the unit file for the kata-opa service.
local kata_opa_in_dir="${script_dir}/../../../src/kata-opa"
local kata_opa_unit="kata-opa.service"
local kata_opa_unit_path="${ROOTFS_DIR}/usr/lib/systemd/system/${kata_opa_unit}"
local kata_containers_wants="${ROOTFS_DIR}/etc/systemd/system/kata-containers.target.wants"
Expand Down
Loading