66 lines
1.8 KiB
Rego
66 lines
1.8 KiB
Rego
# AAP policy-as-code baseline.
|
|
# Set opa_query_path to aap/policy/decision on an organization, inventory, or
|
|
# job template. Input is the serialized Job (awx/main/tasks/policy.py).
|
|
# Tunables come from data.aap_policy_config (opa_server_policy_config).
|
|
package aap.policy
|
|
|
|
import rego.v1
|
|
|
|
decision := {
|
|
"allowed": count(violations) == 0,
|
|
"violations": sort([msg | some msg in violations]),
|
|
}
|
|
|
|
default_config := {
|
|
"allowed_ee_registries": [],
|
|
"forbidden_extra_vars": [],
|
|
"change_freeze": false,
|
|
"change_freeze_exempt_teams": [],
|
|
}
|
|
|
|
default user_config := {}
|
|
|
|
user_config := data.aap_policy_config
|
|
|
|
config := object.union(default_config, user_config)
|
|
|
|
# Execution environment must come from an approved registry
|
|
violations contains msg if {
|
|
count(config.allowed_ee_registries) > 0
|
|
image := input.execution_environment.image
|
|
not approved_registry(image)
|
|
msg := sprintf(
|
|
"Execution environment image %q is not from an approved registry (%s)",
|
|
[image, concat(", ", config.allowed_ee_registries)],
|
|
)
|
|
}
|
|
|
|
approved_registry(image) if {
|
|
some prefix in config.allowed_ee_registries
|
|
startswith(image, prefix)
|
|
}
|
|
|
|
# Credentials belong in AAP credentials, not launch-time extra vars
|
|
violations contains msg if {
|
|
extra_vars := object.get(input, "extra_vars", {})
|
|
is_object(extra_vars)
|
|
some key, _ in extra_vars
|
|
lower(key) in {lower(k) | some k in config.forbidden_extra_vars}
|
|
msg := sprintf("Extra variable %q may not be passed at launch; use a credential", [key])
|
|
}
|
|
|
|
# Change freeze: only check-mode jobs unless the launcher is exempt
|
|
violations contains msg if {
|
|
config.change_freeze
|
|
input.job_type == "run"
|
|
not freeze_exempt
|
|
msg := "A change freeze is in effect: only check-mode jobs are allowed"
|
|
}
|
|
|
|
freeze_exempt if input.created_by.is_superuser
|
|
|
|
freeze_exempt if {
|
|
some team in input.created_by.teams
|
|
team.name in config.change_freeze_exempt_teams
|
|
}
|