Add initial OPA

opa/check-container-user.rego

@@ -0,0 +1,15 @@
+package kubernetes.validating.privileged
+
+deny[msg] {
+    some http-api
+    input_container[http-api]
+    http-api.securityContext.privileged
+    msg := sprintf("Container '%v' should not run in privileged mode.", [http-api.name])
+}
+
+input_container[container] {
+    container := input.request.object.spec.containers[_]
+}
+
+input_container[container] {
+    container := input.request.object.spec.initContainers[_]

opa/check-serviceaccount.rego

@@ -0,0 +1 @@
+# TODO

opa/deployment.yaml

@@ -0,0 +1,51 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: opa
+  labels:
+    app: opa
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: opa
+  template:
+    metadata:
+      labels:
+        app: opa
+      name: opa
+    spec:
+      containers:
+      - name: opa
+        image: openpolicyagent/opa:0.36.0
+        imagePullPolicy: IfNotPresent
+        ports:
+        - name: http
+          containerPort: 8181
+        args:
+        - "run"
+        - "--ignore=.*"  # exclude hidden dirs created by Kubernetes
+        - "--server"
+        - "/policies"
+        volumeMounts:
+        - readOnly: true
+          mountPath: /policies/check-container-user
+          name: check-container-user
+        livenessProbe:
+          httpGet:
+            scheme: HTTP              # assumes OPA listens on localhost:8181
+            port: 8181
+          initialDelaySeconds: 5      # tune these periods for your environemnt
+          periodSeconds: 5
+        readinessProbe:
+          httpGet:
+            path: /health?bundle=true  # Include bundle activation in readiness
+            scheme: HTTP
+            port: 8181
+          initialDelaySeconds: 5
+          periodSeconds: 5
+        resources: # TODO: add CPU and Memory Requirements
+      volumes:
+      - name: check-container-user
+        configMap:
+          name: check-container-user

opa/ingress.yaml

@@ -0,0 +1,28 @@
+---
+# Source: http-api/templates/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: opa
+  labels:
+    app.kubernetes.io/name: opa
+    app.kubernetes.io/instance: opa
+  annotations:
+    kubernetes.io/ingress.class: nginx
+spec:
+  defaultBackend:
+    service:
+      name: opa
+      port:
+        number: 8181
+  rules:
+    - host: "minikube.local"
+      http:
+        paths:
+          - path: /opa/
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: opa
+                port:
+                  number: 8181

opa/service.yaml

@@ -0,0 +1,15 @@
+kind: Service
+apiVersion: v1
+metadata:
+  name: opa
+  labels:
+    app: opa
+spec:
+  type: ClusterIP
+  selector:
+    app: opa
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8181
+      targetPort: 8181