opa.yml

---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-all-policy
  namespace: default
data:
  stopall.rego: |
    package aap_policy_examples

    import rego.v1

    allowed_false := {
      "allowed": false,
      "violations": ["No job execution is allowed"],
    }
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-extravarskeys-policy
  namespace: default
data:
  extravarskeys.rego: |

    package aap_policy_examples

    import rego.v1

    # Define allowed values for specific keys in extra_vars
    valid_extra_var_values := {"extra_var_key": ["allowed_value1", "allowed_value2"]}

    # Default policy response indicating allowed status with no violations
    default extra_vars_validation := {
      "allowed": true,
      "violations": [],
    }

    # Evaluate extra_vars_validation to check if extra_vars values are allowed
    extra_vars_validation := result if {
      # Extract extra_vars from input, defaulting to empty object if missing
      input_extra_vars := object.get(input, ["extra_vars"], {})

      # Identify keys with disallowed values
      violating_keys := [key |
        valid_extra_var_values[key]
        not allowed_value(key, input_extra_vars[key])
      ]

      # Check if there are any violations
      count(violating_keys) > 0

      result := {
        "allowed": false,
        "violations": [sprintf("extra_vars contain disallowed values for keys: %v. Allowed values: %v", [violating_keys, valid_extra_var_values])],
      }
    }

    # Check if a given value for a key is allowed
    allowed_value(key, value) if {
      valid_extra_var_values[key][_] == value
    }
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-extravars-policy
  namespace: default
data:
  extravars.rego: |

    package aap_policy_examples

    import rego.v1

    # Define the allowed keys for extra_vars
    allowed_extra_var_keys := ["allowed"]

    # Default policy result: allowed (no violations)
    default extra_vars_allowlist := {
      "allowed": true,
      "violations": [],
    }

    # Evaluate extra_vars_allowlist, checking if provided extra_vars contain any keys not allowed
    extra_vars_allowlist := result if {
      # Extract extra_vars from input, defaulting to empty object if missing
      input_extra_var_keys := object.get(input, ["extra_vars"], {})

      # Identify keys in extra_vars that are not in the allowed list
      violating_keys := [key | input_extra_var_keys[key]; not allowed_key(key)]

      # If violating keys are found, construct result indicating disallowed status and violations
      count(violating_keys) > 0

      result := {
        "allowed": false,
        "violations": [sprintf("Following extra_vars are not allowed: %v. Allowed keys: %v", [violating_keys, allowed_extra_var_keys])],
      }
    }

    # Helper function: Checks if a given key is in the allowed_extra_var_keys list
    allowed_key(key) if {
      allowed_extra_var_keys[_] == key
    }
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-githubbranch-policy
  namespace: default
data:
  githubbranch.rego: |

    package aap_policy_examples

    import rego.v1

    # Define allowed values for project.scm_branch
    valid_project_scm_branch_values := ["dev", "test"]

    # Default policy response indicating allowed status with no violations
    default project_scm_branch_validation := {
      "allowed": true,
      "violations": [],
    }

    # Evaluate branch_validation to check if project.scm_branch value is allowed
    project_scm_branch_validation := result if {
      # Extract project.scm_branch from input
      branch := object.get(input, ["project", "scm_branch"], "")

      # Check if branch value is not in the allowed list
      not allowed_branch(branch)

      result := {
        "allowed": false,
        "violations": [sprintf("Invalid branch: %v. Only named 'dev' or 'test' branches are allowed.", [branch])],
      }
    }

    # Check if a given branch value is allowed
    allowed_branch(branch) if {
      some allowed_value in valid_project_scm_branch_values
      branch == allowed_value
    }
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-github-policy
  namespace: default
data:
  github.rego: |

    package aap_policy_examples

    import rego.v1

    # Define list of allowed GitHub repositories
    allowed_github_repos := [
        "organization/repo1",
        "organization/repo2"
    ]

    # Default policy response indicating allowed status with no violations
    default github_repo_validation := {
        "allowed": true,
        "violations": [],
    }

    # Validate that the GitHub repository is in the whitelist
    github_repo_validation := result if {
        # Extract SCM URL from input
        scm_url := object.get(input, ["project", "scm_url"], "")

        # Extract repository path from URL
        parts := split(scm_url, "/")
        count_parts := count(parts)
        org := parts[count_parts-2]
        repo_name := trim_suffix(parts[count_parts-1], ".git")
        repo_path := concat("/", [org, repo_name])

        # Check if repo path is not in the whitelist
        not repo_path in allowed_github_repos

        result := {
            "allowed": false,
            "violations": [sprintf("Repository '%v' is not in the allowed list", [repo_path])],
        }
    }
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-globalcredential-policy
  namespace: default
data:
  globalcredential.rego: |

    package aap_policy_examples

    # Find credentials with no organization
    violating_credentials := {cred.name | cred := input.credentials[_]; cred.organization == null}

    default global_credential_allowed_false := {
      "allowed": true,
      "violations": [],
    }

    # If any credential is violating, deny access and return violations
    global_credential_allowed_false := {
      "allowed": false,
      "violations": [sprintf("Credential used in job execution does not belong to any org. Violating credentials: [%s]", [concat(", ", violating_credentials)])],
    } if {
      count(violating_credentials) > 0
    }
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-inventoryorg-policy
  namespace: default
data:
  inventoryorg.rego: |

    package aap_policy_examples

    import rego.v1

    # Default policy response indicating allowed status with no violations
    default organization_inventory_validation := {
        "allowed": true,
        "violations": [],
    }

    # Validate that only "Infrastructure" can use "Shadowman Production"
    organization_inventory_validation := result if {
        # Extract values from input
        inventory_name := object.get(input, ["inventory", "name"], "")
        org_name := object.get(input, ["organization", "name"], "")

        # Check if inventory is "Shadowman Production"
        inventory_name == "Shadowman Production"

        # Check if organization is not "Infrastructure"
        org_name != "Infrastructure"

        result := {
            "allowed": false,
            "violations": ["Only the 'Infrastructure' organization should use the 'Shadowman Production' inventory"],
        }
    }
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-maintenancewindow-policy
  namespace: default
data:
  maintenancewindow.rego: |

    package aap_policy_examples

    # Define maintenance window in UTC
    maintenance_start_hour := 21 # 21:00 UTC (5 PM EDT)

    maintenance_end_hour := 12 # 12:00 UTC (8 AM EDT)

    # Extract the job creation timestamp (which is in UTC)
    created_clock := time.clock(time.parse_rfc3339_ns(input.created)) # returns [hour, minute, second]

    created_hour_utc := created_clock[0]

    # Check if job was created within the maintenance window (UTC)
    is_maintenance_time if {
      created_hour_utc >= maintenance_start_hour # After 21:00 UTC
    }

    is_maintenance_time if {
      created_hour_utc < maintenance_end_hour # Before 12:00 UTC
    }

    default maintenance_window := {
      "allowed": true,
      "violations": [],
    }

    maintenance_window := {
      "allowed": false,
      "violations": [sprintf("No job execution allowed during maintenance window from start hour: %v, to end hour: %v, current time: %v", [maintenance_start_hour, maintenance_end_hour, created_clock])],
    } if {
        is_maintenance_time
    }
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-mismatch-policy
  namespace: default
data:
  mismatch.rego: |

    package aap_policy_examples

    prefix_delimiter := "_"

    # job_template_prefix extracts the substring before the first prefix_delimiter in `input.job_template.name`.
    job_template_prefix := jtp if {
      parts := split(input.job_template.name, prefix_delimiter)
      jtp := parts[0]
    }

    # inventory_prefix extracts the substring before the first prefix_delimiter in `input.inventory.name`.
    inventory_prefix := inv_pref if {
      parts := split(input.inventory.name, prefix_delimiter)
      inv_pref := parts[0]
    }

    # project_prefix extracts the substring before the first prefix_delimiter in `input.project.name`.
    project_prefix := proj_pref if {
      parts := split(input.project.name, prefix_delimiter)
      proj_pref := parts[0]
    }

    # credentials_prefixes is a list of prefix values from each credential's name.
    credentials_prefixes := [cprefix |
      cred := input.credentials[_] # iterate over credentials
      parts := split(cred.name, prefix_delimiter) # split name
      cprefix := parts[0] # grab the first part
    ]

    # mismatch is true if either:
    # 1. The project prefix != job template prefix, OR
    # 2. The inventory prefix != job template prefix OR
    # 3. Any credential's prefix != job template prefix.
    mismatch if {
      project_prefix != job_template_prefix
    }

    mismatch if {
      inventory_prefix != job_template_prefix
    }

    mismatch if {
      some cp in credentials_prefixes
      cp != job_template_prefix
    }

    default mismatch_prefix_allowed_false := {
      "allowed": true,
      "violations": [],
    }

    mismatch_prefix_allowed_false := {
      "allowed": false,
      "violations": ["Mismatch prefix between Inventory, Credentials and Project detected."],
    } if {
      mismatch
    }
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-namingstandards-policy
  namespace: default
data:
  namingstandards.rego: |

    package aap_policy_examples

    import rego.v1

    # Default policy response indicating allowed status with no violations
    default jt_naming_validation := {
        "allowed": true,
        "violations": [],
    }

    # Validate that job template name has correct organization and project name prefixes
    jt_naming_validation := result if {
        # Extract values from input
        org_name := object.get(input, ["organization", "name"], "")
        project_name := object.get(input, ["project", "name"], "")
        jt_name := object.get(input, ["job_template", "name"], "")

        # Construct the expected prefix
        expected_prefix := concat("_", [org_name, project_name])

        # Check if job template name starts with expected prefix
        not startswith(jt_name, expected_prefix)

        result := {
            "allowed": false,
            "violations": [sprintf("Job template naming for '%v' does not comply with standards", [jt_name])]
        }
    }
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-restrictednetwork-policy
  namespace: default
data:
  restrictednetwork.rego: |

    package aap_policy_examples

    import rego.v1

    # Define the allowed playbooks for restricted networks
    allowed_playbooks_for_restricted_networks := ["linuxpatching.yml", "windows_patching.yml"]

    # Define the restricted instance groups
    restricted_instance_groups := ["OCP", "mesh"]

    # Default policy response indicating allowed status with no violations
    default restricted_networks_checks := {
      "allowed": true,
      "violations": [],
    }

    # Evaluate restricted_networks_checks to check if playbook is allowed on restricted instance groups
    restricted_networks_checks := result if {
      # Extract instance group name from input
      instance_group_name := object.get(input, ["instance_group", "name"], "")

      # Extract playbook name from input
      playbook_name := object.get(input, ["playbook"], "")

      # Check if instance group is restricted and playbook is not allowed
      is_restricted_instance_group(instance_group_name)
      not allowed_playbook_for_restricted_network(playbook_name)

      result := {
        "allowed": false,
        "violations": [sprintf("Playbook '%v' is not allowed on restricted instance group '%v'. Allowed playbooks: %v", [playbook_name, instance_group_name, allowed_playbooks_for_restricted_networks])],
      }
    }

    # Check if a given instance group is restricted
    is_restricted_instance_group(instance_group_name) if {
      some restricted_group in restricted_instance_groups
      instance_group_name == restricted_group
    }

    # Check if a given playbook is allowed on restricted networks
    allowed_playbook_for_restricted_network(playbook_name) if {
      some allowed_playbook in allowed_playbooks_for_restricted_networks
      playbook_name == allowed_playbook
    }
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-superuser-policy
  namespace: default
data:
  stopsuperuser.rego: |
    package aap_policy_examples

    import rego.v1

    default superuser_allowed_false := {
      "allowed": true,
      "violations": [],
    }

    superuser_allowed_false := {
      "allowed": false,
      "violations": ["SuperUser is not allow to launch jobs"],
    } if {
      input.created_by.is_superuser
    }
---
kind: ConfigMap
apiVersion: v1
metadata:
  name: stop-teambasedvars-policy
  namespace: default
data:
  teambasedvars.rego: |

    package aap_policy_examples

    import rego.v1

    # Define allowed values for specific keys in extra_vars based on teams
    valid_extra_var_values_by_team := {
      "dev_team": {"environment": ["dev", "staging"]},
      "prod_team": {"environment": ["prod", "staging"]},
    }

    # Default response allowing extra_vars unless violations occur
    default team_based_extra_vars_restriction := {
      "allowed": true,
      "violations": [],
    }

    # Evaluate extra_vars against allowed values considering team memberships
    team_based_extra_vars_restriction := result if {
      # Extract extra_vars from input
      input_extra_vars := object.get(input, ["extra_vars"], {})

      # Extract user's team names
      user_teams := {team | team := input.created_by.teams[_].name}

      violating_keys := [key |
        allowed_vals := allowed_values_for_key_and_teams(key, user_teams)
        input_value := input_extra_vars[key]
        allowed_values_for_key_and_teams(key, user_teams)
        not allowed_value(input_value, allowed_vals)
      ]

      count(violating_keys) > 0

      result := {
        "allowed": false,
        "violations": [sprintf("extra_vars contain disallowed values for keys: %v. Allowed extra_vars for your teams (%v): %v", [violating_keys, user_teams, allowed_values_for_user_teams(user_teams)])],
      }
    }

    # Retrieve allowed values for a specific key based on user's teams
    allowed_values_for_key_and_teams(key, teams) := values if {
      values := {val | team := teams[_]; val := valid_extra_var_values_by_team[team][key][_]; valid_extra_var_values_by_team[team][key]}
    }

    # Retrieve all allowed values based on user's teams
    allowed_values_for_user_teams(teams) := team_values if {
      team_values := {team: valid_extra_var_values_by_team[team] | team := teams[_]; valid_extra_var_values_by_team[team]}
    }

    # Check if given value is in allowed values set
    allowed_value(value, allowed_values) if {
      allowed_values[_] == value
    }
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: opa
  labels:
    app: opa
spec:
  replicas: 1
  selector:
    matchLabels:
      app: opa
  template:
    metadata:
      labels:
        app: opa
      name: opa
    spec:
      containers:
      - name: opa
        image: openpolicyagent/opa:latest
        args:
        - "run"
        - "--ignore=.*"
        - "--server"
        - '--addr=0.0.0.0:8181'
        - "/policies"
        volumeMounts:
        - readOnly: true
          mountPath: /policies
          name: ansible-policy
      volumes:
      - name: ansible-policy
        projected:
          sources:
          - configMap:
              name: stop-all-policy
          - configMap:
              name: stop-extravarskeys-policy
          - configMap:
              name: stop-extravars-policy
          - configMap:
              name: stop-githubbranch-policy
          - configMap:
              name: stop-github-policy
          - configMap:
              name: stop-globalcredential-policy
          - configMap:
              name: stop-inventoryorg-policy
          - configMap:
              name: stop-maintenancewindow-policy
          - configMap:
              name: stop-mismatch-policy
          - configMap:
              name: stop-namingstandards-policy
          - configMap:
              name: stop-superuser-policy
          - configMap:
              name: stop-teambasedvars-policy
          - configMap:
              name: stop-restrictednetwork-policy
---
kind: Service
apiVersion: v1
metadata:
  labels:
    app: opa
  name: opa
spec:
  selector:
    app: opa
  ports:
  - name: http
    protocol: TCP
    port: 80
    targetPort: 8181
---
apiVersion: route.openshift.io/v1
kind: Route
metadata:
  name: opa
  namespace: default
spec:
  path: /
  to:
    name: opa
    weight: 100
    kind: Service
  host: ''
  tls:
    insecureEdgeTerminationPolicy: Allow
    termination: edge
  port:
    targetPort: http
  alternateBackends: []