Add OPA and Openshift AI

roles/opa_server/files/tests/aap_policy_test.rego

@@ -0,0 +1,87 @@
+# Unit tests (not deployed). Run with:
+#   podman run --rm -v ./roles/opa_server/files:/files:Z docker.io/openpolicyagent/opa:1.21.1-static \
+#     test /files/policies /files/tests -v
+package aap.policy_test
+
+import rego.v1
+
+import data.aap.policy
+
+cfg := {
+	"allowed_ee_registries": ["aap.toal.ca/", "registry.redhat.io/"],
+	"forbidden_extra_vars": ["ansible_password"],
+	"change_freeze": false,
+	"change_freeze_exempt_teams": ["Platform"],
+}
+
+job := {
+	"job_type": "run",
+	"execution_environment": {"image": "aap.toal.ca/toallab/ee-demo:latest"},
+	"extra_vars": {"target": "web"},
+	"created_by": {"username": "dev", "is_superuser": false, "teams": [{"id": 1, "name": "Dev"}]},
+}
+
+test_compliant_job_allowed if {
+	d := policy.decision with input as job with data.aap_policy_config as cfg
+	d.allowed
+	d.violations == []
+}
+
+test_unapproved_registry_denied if {
+	j := object.union(job, {"execution_environment": {"image": "quay.io/scottharwell/cloud-ee:latest"}})
+	d := policy.decision with input as j with data.aap_policy_config as cfg
+	not d.allowed
+	count(d.violations) == 1
+}
+
+test_forbidden_extra_var_denied_case_insensitive if {
+	j := object.union(job, {"extra_vars": {"Ansible_Password": "x"}})
+	d := policy.decision with input as j with data.aap_policy_config as cfg
+	not d.allowed
+}
+
+test_null_extra_vars_and_ee_allowed if {
+	j := object.union(job, {"extra_vars": null, "execution_environment": null})
+	d := policy.decision with input as j with data.aap_policy_config as cfg
+	d.allowed
+}
+
+test_freeze_blocks_run if {
+	d := policy.decision with input as job with data.aap_policy_config as object.union(cfg, {"change_freeze": true})
+	not d.allowed
+}
+
+test_freeze_allows_check if {
+	j := object.union(job, {"job_type": "check"})
+	d := policy.decision with input as j with data.aap_policy_config as object.union(cfg, {"change_freeze": true})
+	d.allowed
+}
+
+test_freeze_exempt_team if {
+	j := object.union(job, {"created_by": {"is_superuser": false, "teams": [{"name": "Platform"}]}})
+	d := policy.decision with input as j with data.aap_policy_config as object.union(cfg, {"change_freeze": true})
+	d.allowed
+}
+
+test_freeze_scheduled_job_without_creator if {
+	j := object.union(job, {"created_by": null})
+	d := policy.decision with input as j with data.aap_policy_config as object.union(cfg, {"change_freeze": true})
+	not d.allowed
+}
+
+test_no_config_allows_everything if {
+	j := object.union(job, {"execution_environment": {"image": "quay.io/anything:latest"}})
+	d := policy.decision with input as j
+	d.allowed
+}
+
+test_authz_health_open if {
+	data.system.authz.allow with input as {"path": ["health"]}
+}
+
+test_authz_requires_token if {
+	not data.system.authz.allow with input as {"path": ["v1", "data"], "identity": "bad"}
+		with data.opa_authz.token as "good"
+	data.system.authz.allow with input as {"path": ["v1", "data"], "identity": "good"}
+		with data.opa_authz.token as "good"
+}