Examples
-Custom Policy
-Kubernetes
-See here.
-The custom policy is defined in user.kubernetes.ID001 package.
-You need to pass the package prefix you want to evaluate through --namespaces option.
-In this case, the package prefix should be user, user.kubernetes, or user.kubernetes.ID001.
Dockerfile
-See here.
-The input will be a dictionary of stages.
-Single Stage
-
-
-
-
-Example
-Dockerfile -
FROM foo
-COPY . /
-RUN echo hello
-Rego Input -
{
- "stages": {
- "foo": [
- {
- "Cmd": "from",
- "EndLine": 1,
- "Flags": [],
- "JSON": false,
- "Original": "FROM foo",
- "Stage": 0,
- "StartLine": 1,
- "SubCmd": "",
- "Value": [
- "foo"
- ]
- },
- {
- "Cmd": "copy",
- "EndLine": 2,
- "Flags": [],
- "JSON": false,
- "Original": "COPY . /",
- "Stage": 0,
- "StartLine": 2,
- "SubCmd": "",
- "Value": [
- ".",
- "/"
- ]
- },
- {
- "Cmd": "run",
- "EndLine": 3,
- "Flags": [],
- "JSON": false,
- "Original": "RUN echo hello",
- "Stage": 0,
- "StartLine": 3,
- "SubCmd": "",
- "Value": [
- "echo hello"
- ]
- }
- ]
- }
-}
-Multi Stage
-
-
-
-
-Example
-Dockerfile -
FROM golang:1.16 AS builder
-WORKDIR /go/src/github.com/alexellis/href-counter/
-RUN go get -d -v golang.org/x/net/html
-COPY app.go .
-RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app .
-
-FROM alpine:latest
-RUN apk --no-cache add ca-certificates \
-&& apk add --no-cache bash
-WORKDIR /root/
-COPY --from=builder /go/src/github.com/alexellis/href-counter/app .
-CMD ["./app"]
-Rego Input -
{
- "stages": {
- "alpine:latest": [
- {
- "Cmd": "from",
- "EndLine": 7,
- "Flags": [],
- "JSON": false,
- "Original": "FROM alpine:latest",
- "Stage": 1,
- "StartLine": 7,
- "SubCmd": "",
- "Value": [
- "alpine:latest"
- ]
- },
- {
- "Cmd": "run",
- "EndLine": 9,
- "Flags": [],
- "JSON": false,
- "Original": "RUN apk --no-cache add ca-certificates \u0026\u0026 apk add --no-cache bash",
- "Stage": 1,
- "StartLine": 8,
- "SubCmd": "",
- "Value": [
- "apk --no-cache add ca-certificates \u0026\u0026 apk add --no-cache bash"
- ]
- },
- {
- "Cmd": "workdir",
- "EndLine": 10,
- "Flags": [],
- "JSON": false,
- "Original": "WORKDIR /root/",
- "Stage": 1,
- "StartLine": 10,
- "SubCmd": "",
- "Value": [
- "/root/"
- ]
- },
- {
- "Cmd": "copy",
- "EndLine": 11,
- "Flags": [
- "--from=builder"
- ],
- "JSON": false,
- "Original": "COPY --from=builder /go/src/github.com/alexellis/href-counter/app .",
- "Stage": 1,
- "StartLine": 11,
- "SubCmd": "",
- "Value": [
- "/go/src/github.com/alexellis/href-counter/app",
- "."
- ]
- },
- {
- "Cmd": "cmd",
- "EndLine": 12,
- "Flags": [],
- "JSON": true,
- "Original": "CMD [\"./app\"]",
- "Stage": 1,
- "StartLine": 12,
- "SubCmd": "",
- "Value": [
- "./app"
- ]
- }
- ],
- "golang:1.16 AS builder": [
- {
- "Cmd": "from",
- "EndLine": 1,
- "Flags": [],
- "JSON": false,
- "Original": "FROM golang:1.16 AS builder",
- "Stage": 0,
- "StartLine": 1,
- "SubCmd": "",
- "Value": [
- "golang:1.16",
- "AS",
- "builder"
- ]
- },
- {
- "Cmd": "workdir",
- "EndLine": 2,
- "Flags": [],
- "JSON": false,
- "Original": "WORKDIR /go/src/github.com/alexellis/href-counter/",
- "Stage": 0,
- "StartLine": 2,
- "SubCmd": "",
- "Value": [
- "/go/src/github.com/alexellis/href-counter/"
- ]
- },
- {
- "Cmd": "run",
- "EndLine": 3,
- "Flags": [],
- "JSON": false,
- "Original": "RUN go get -d -v golang.org/x/net/html",
- "Stage": 0,
- "StartLine": 3,
- "SubCmd": "",
- "Value": [
- "go get -d -v golang.org/x/net/html"
- ]
- },
- {
- "Cmd": "copy",
- "EndLine": 4,
- "Flags": [],
- "JSON": false,
- "Original": "COPY app.go .",
- "Stage": 0,
- "StartLine": 4,
- "SubCmd": "",
- "Value": [
- "app.go",
- "."
- ]
- },
- {
- "Cmd": "run",
- "EndLine": 5,
- "Flags": [],
- "JSON": false,
- "Original": "RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app .",
- "Stage": 0,
- "StartLine": 5,
- "SubCmd": "",
- "Value": [
- "CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o app ."
- ]
- }
- ]
- }
-}
-Docker Compose
-See here.
-Docker Compose uses YAML format for configurations. You can apply your Rego policies to docker-compose.yml.
HCL
-See here.
-Trivy parses HCL files and converts into structured data.
-
-
-Warning
-Terraform HCL files are not supported yet.
-Terraform Plan
-See here.
-Use the command terraform show to convert the Terraform plan into JSON so that OPA can read the plan.
-$ terraform init
-$ terraform plan --out tfplan.binary
-$ terraform show -json tfplan.binary > tfplan.json
-For more details, see also OPA document.
-Serverless Framework
-See here.
-Server Framework uses YAML format for configurations. You can apply your Rego policies to serverless.yaml.
Custom Data
-See here.
-Combined Input
-See here.
-Go Testing
-See here.
- - -