Document the set of OPA APIs that kube-mgmt uses about kube-mgmt HOT 3 CLOSED

@tallclair that's a good idea. Updated the README.

@tallclair also, I realized that the original sample policy I posted was granting access to GET /. You'll want to disable/remove that in your version.

from kube-mgmt.

It depends on your case, because kube-mgmt may or may not be used to load policy and data. Here are the endpoints.

Policy loading (e.g., policy synching from configmaps implemented here):

• PUT /v1/policy/<path>
• DELETE /v1/policy/<path>

Data loading (e.g., k8s resource synching implemented here) :

• PUT /v1/data/<path>
• PATCH /v1/data/<path>

The configmap loader also supports data as of recently; someone wanted to be able to load arbitrary data via configmaps 🤷)

Here's a sample based on a common authz policy that many people use. It's not quite least privilege because kube-mgmt could do anything against OPA, but it might be enough for your use case:

package system.authz

# Deny access by default.
default allow = false

# Allow anonymous access to `data.example.response`
# Note: depending on how callers are configured, they may only require this or the default decision below.
allow { input.path = ["v0", "data", "example", "response"]; input.method = "POST" }

# Allow anonymous access to default decision.
allow { input.path = [""]; input.method = "POST" }

# This is only used for health check in liveness and readiness probe
allow { input.path = ["health"]; input.method = "GET" }

# This is only used for prometheus metrics
allow { input.path = ["metrics"]; input.method = "GET" }

# This is used by kube-mgmt to PUT/PATCH against /v1/data and PUT/DELETE against /v1/policies.
# Note: The $TOKEN value is replaced at deploy-time (typically w/ an initContainer) to the actual value
allow { input.identity == "$TOKEN" }

from kube-mgmt.

Thanks. This addresses my immediate need, but might be useful to put in the README?

from kube-mgmt.