OPA 通过 Kubernetes 集群请求

Question

I want to use OPA(Open Policy Agent) in kubernetes but have some questions which are not still clear for me:

Let's take a look at a specific case together: for instance, there is a pod creation in a namespace and we can know the namespace from the pod object at OPA. But, can we get the namespace object separately to learn the authority which this namespace belongs to?

More explicitly, I mean can we do requests through the Kubernetes cluster by OPA?

for instance, there is a pod creation with the name of Test. I just want to allow this creation for only an authority called TestAuthority. When the pod is created, we know the namespace data but not the authority. To figure out the authority which this pod belongs to, I need to have the namespace object and look out its labels. Can we do so by OPA?

Additionally, can we say allow pod creation with the names of Test1, Test2, and Test3? So, any pod creation with the name of Test4 should be denied.

Thank you in advance for your help

Answer 1

(1) Yes, see https://github.com/open-policy-agent/kube-mgmt#caching or https://github.com/open-policy-agent/gatekeeper#replicating-data depending on which integration you are wanting to use. Both allow replicating objects from kubernetes into OPA to reference in the policies.

(2) Yes, you can write policies like that.

credit:Patrick East answered from OPA Slack