Skip to content

Commit 3ad49e7

Browse files
ssherarssherar
authored
Initial commit
0 parents  commit 3ad49e7

9 files changed

Lines changed: 253 additions & 0 deletions

File tree

‎.github/workflows/build-and-upload.yml‎

Lines changed: 34 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
name: Build and Upload Artifacts
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
release:
8+
runs-on: ubuntu-latest
9+
steps:
10+
- name: Check out repository code
11+
uses: actions/checkout@v4
12+
- uses: actions/setup-go@v5
13+
- name: Setup OPA
14+
uses: open-policy-agent/setup-opa@v2
15+
with:
16+
version: latest
17+
- name: Run OPA Build
18+
run: |
19+
mkdir -p dist/
20+
opa build -b policies -o dist/bundle.tar.gz
21+
- name: Bundle
22+
uses: softprops/action-gh-release@v2
23+
with:
24+
files: dist/bundle.tar.gz
25+
- name: Install gooci cli
26+
run: go install github.com/compliance-framework/gooci@latest
27+
- name: Authenticate gooci cli
28+
run: gooci login ghcr.io --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }}
29+
- name: gooci Upload Version
30+
run: gooci upload-single dist/bundle.tar.gz ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:${{github.ref_name}}
31+
- name: gooci Upload Latest
32+
if: "!github.event.release.prerelease"
33+
run: gooci upload-single dist/bundle.tar.gz ghcr.io/${{ github.repository_owner }}/${{ github.event.repository.name }}:latest
34+

‎.github/workflows/push.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: Push
2+
3+
on:
4+
pull_request:
5+
push:
6+
branches:
7+
- '*'
8+
9+
jobs:
10+
test:
11+
permissions:
12+
contents: read
13+
uses: ./.github/workflows/test.yml

‎.github/workflows/release.yml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
name: New Release
2+
3+
on:
4+
push:
5+
tags:
6+
- '*'
7+
8+
jobs:
9+
release:
10+
permissions:
11+
packages: write
12+
contents: write
13+
uses: ./.github/workflows/build-and-upload.yml

‎.github/workflows/test.yml‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
name: OPA Test
2+
3+
on:
4+
workflow_call:
5+
6+
jobs:
7+
test:
8+
runs-on: ubuntu-latest
9+
10+
steps:
11+
- name: Check out repository code
12+
uses: actions/checkout@v4
13+
14+
- name: Setup OPA
15+
uses: open-policy-agent/setup-opa@v2
16+
with:
17+
version: latest
18+
19+
- name: Run OPA Tests
20+
run: opa test policies
21+
22+
- name: Run OPA Check
23+
run: opa check policies

‎.gitignore‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
.idea/
2+
data/
3+
dist/

‎Makefile‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
# Makefile for building and pushing OPA policies to a registry
2+
3+
# Variables
4+
REGISTRY_URL := ghcr.io
5+
NAMESPACE := chris-cmsoft
6+
POLICY_NAME := local-ssh-policies
7+
VERSION := latest
8+
POLICY_DIR := ./ssh # Directory containing your .rego files
9+
10+
# Build and Push Commands
11+
.PHONY: all build bundle push clean
12+
13+
# Default action
14+
all: test check build push clean
15+
16+
# Check if OPA CLI is installed
17+
OPA := $(shell command -v opa 2> /dev/null)
18+
ifeq ($(OPA),)
19+
$(error "opa CLI not found. Please install it: https://www.openpolicyagent.org/docs/latest/cli/")
20+
endif
21+
22+
# Check if Docker CLI is installed
23+
24+
CONTAINER_CLI := ""
25+
DOCKER := $(shell command -v docker 2> /dev/null)
26+
PODMAN := $(shell command -v podman 2> /dev/null)
27+
ifeq ($(DOCKER),)
28+
PODMAN := := $(shell command -v podman 2> /dev/null)
29+
ifeq ($(PODMAN),)
30+
$(error "either docker or podman CLI is required.")
31+
else
32+
CONTAINER_CLI = PODMAN
33+
endif
34+
else
35+
CONTAINER_CLI = DOCKER
36+
endif
37+
38+
test:
39+
@echo "Testing policies..."
40+
@OPA test policies
41+
42+
# Build the policies
43+
check:
44+
@echo "Checking policies..."
45+
@opa check policies
46+
47+
# Bundle the policies into a tarball for OCI registry
48+
build: clean
49+
@echo "Bundling policies..."
50+
@mkdir -p dist/
51+
@opa build -b policies -o dist/bundle.tar.gz
52+
53+
# Push the bundled policies to an OCI-compliant registry
54+
push: build
55+
@echo "Pushing bundle to registry..."
56+
@# Log in to the registry if necessary
57+
@$(CONTAINER_CLI) login $(REGISTRY_URL)
58+
@# Push the bundle as an OCI artifact
59+
@$(CONTAINER_CLI) cp dist/bundle.tar.gz $(REGISTRY_URL)/$(NAMESPACE)/$(POLICY_NAME):$(VERSION)
60+
@echo "Bundle pushed successfully to $(REGISTRY_URL)/$(NAMESPACE)/$(POLICY_NAME):$(VERSION)"
61+
62+
# Clean up build artifacts
63+
clean:
64+
@echo "Cleaning up..."
65+
@rm -f dist/bundle.tar.gz

‎README.md‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
# Template for policies for use in Compliance Framework plugins
2+
3+
## Testing
4+
5+
6+
```shell
7+
opa test policies
8+
```
9+
10+
## Bundling
11+
12+
Policies are built into bundle to make distribution easier.
13+
14+
You can easily build the policies by running
15+
```shell
16+
make build
17+
```
18+
19+
## Running policies locally
20+
21+
```shell
22+
opa eval -I -b policies -f pretty data.compliance_framework.local_ssh <<EOF
23+
{
24+
"passwordauthentication": [
25+
"yes"
26+
],
27+
"permitrootlogin": [
28+
"with-password"
29+
],
30+
"pubkeyauthentication": [
31+
"no"
32+
]
33+
}
34+
EOF
35+
```
36+
37+
## Writing policies.
38+
39+
Policies are written in the [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/) language.
40+
41+
```rego
42+
package ssh.deny_password_auth
43+
44+
import future.keywords.in
45+
46+
violation[{
47+
"title": "Host SSH is using password authentication.",
48+
"description": "Host SSH should not use password, as this is insecure to brute force attacks from external sources.",
49+
"remarks": "Migrate to using SSH Public Keys, and switch off password authentication."
50+
}] {
51+
"yes" in input.passwordauthentication
52+
}
53+
```
54+
55+
## Metadata
56+
57+
Plugins expect policies to contain a metadata section as comments, with a `# METADATA` line to indicate it. This metadata should be in a YAML format, and contain a title and description of the policy. Other configuration can be set also, like the schedule that a policy should run on, or the control that it is linked to.
58+
59+
Any other comments can be added as normal (before and after) with a line separator between them and the metadata.
60+
61+
Here is an example metadata:
62+
```opa
63+
# your custom comment
64+
65+
# METADATA
66+
# title: <your-title>
67+
# description: <your-description>
68+
# custom:
69+
# controls:
70+
# - <control-id>
71+
# schedule: "<cron-string>"
72+
73+
# your custom comment
74+
```

‎policies/example.rego‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# METADATA
2+
# title: <your-title>
3+
# description: <your-description>
4+
# custom:
5+
# controls:
6+
# - <control-id>
7+
# schedule: "<cron-string>"
8+
9+
package example
10+
11+
import rego.v1
12+
13+
# Your policy code here
14+
# e.g.
15+
allow if {
16+
input.example
17+
}

‎policies/example_test.rego‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
package example
2+
3+
import rego.v1
4+
5+
import data.example
6+
7+
# Your code here
8+
# e.g.
9+
test_something if {
10+
example.allow with input as {"example": true}
11+
}

0 commit comments

Comments
 (0)