OPA.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "74451274-1caa-4ac1-9b06-aa971ece2edb",
   "metadata": {},
   "source": [
    "**This notebook covered by the following [license](License.ipynb)  This note must not be removed**"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "09d485ca-2d4f-49cb-8b16-b6bfdbc32b86",
   "metadata": {},
   "source": [
    "# ⚠️ __work in progress__ not ready ⚠️"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 1,
   "id": "77f4eb0c-da83-481e-95fc-b614f512857b",
   "metadata": {
    "tags": []
   },
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "/minikube-host/notebooks/training-kubernetes-security\n"
     ]
    }
   ],
   "source": [
    "pwd"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 5,
   "id": "63fde904-dc29-4e96-8189-d951f34e8b4a",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "Unable to find image 'openpolicyagent/opa:latest' locally\n",
      "latest: Pulling from openpolicyagent/opa\n",
      "\n",
      "\u001b[1B4d09b7be: Pulling fs layer \n",
      "\u001b[1Bd1a13b69: Pulling fs layer \n",
      "\u001b[1B879bb7de: Pulling fs layer \n",
      "\u001b[1BDigest: sha256:785532b5ffa4073e24322c5d2d2067ba01ceed6a31934bb1c7f7af9d257dd415\n",
      "Status: Downloaded newer image for openpolicyagent/opa:latest\n",
      "Version: 0.35.0\n",
      "Build Commit: a54537a\n",
      "Build Timestamp: 2021-12-01T02:11:19Z\n",
      "Build Hostname: 7e15c2339707\n",
      "Go Version: go1.17.3\n",
      "WebAssembly: available\n"
     ]
    }
   ],
   "source": [
    "docker run openpolicyagent/opa version"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 3,
   "id": "20863fb1-2036-449b-a6f5-549c0406d7b3",
   "metadata": {},
   "outputs": [],
   "source": [
    "mkdir opa\n",
    "cd opa"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 4,
   "id": "cb3eb1e5-d6ea-4530-9654-e4e39635efbe",
   "metadata": {},
   "outputs": [],
   "source": [
    "cat > example.rego <<EOF\n",
    "package example\n",
    "\n",
    "greeting = msg {\n",
    "    info := opa.runtime()\n",
    "    hostname := info.env[\"HOSTNAME\"] # Kubernetes sets the HOSTNAME environment variable.\n",
    "    msg := sprintf(\"hello from pod %q!\", [hostname])\n",
    "}\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 21,
   "id": "8bc73493-32c3-452e-8e2b-b3b53f6f049d",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "configmap/example-policy created\n"
     ]
    }
   ],
   "source": [
    "kubectl create configmap example-policy --from-file example.rego"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 24,
   "id": "29ad9298-d0e4-44a3-8c52-182ed49fa6b1",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "deployment.apps/opa created\n"
     ]
    }
   ],
   "source": [
    "kubectl create -f - <<EOF\n",
    "apiVersion: apps/v1\n",
    "kind: Deployment\n",
    "metadata:\n",
    "  name: opa\n",
    "  labels:\n",
    "    app: opa\n",
    "spec:\n",
    "  replicas: 1\n",
    "  selector:\n",
    "    matchLabels:\n",
    "      app: opa\n",
    "  template:\n",
    "    metadata:\n",
    "      labels:\n",
    "        app: opa\n",
    "      name: opa\n",
    "    spec:\n",
    "      containers:\n",
    "      - name: opa\n",
    "        image: openpolicyagent/opa:0.35.0\n",
    "        ports:\n",
    "        - name: http\n",
    "          containerPort: 8181\n",
    "        args:\n",
    "        - \"run\"\n",
    "        - \"--ignore=.*\"  # exclude hidden dirs created by Kubernetes\n",
    "        - \"--server\"\n",
    "        - \"/policies\"\n",
    "        volumeMounts:\n",
    "        - readOnly: true\n",
    "          mountPath: /policies\n",
    "          name: example-policy\n",
    "      volumes:\n",
    "      - name: example-policy\n",
    "        configMap:\n",
    "          name: example-policy\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 8,
   "id": "389a19f1-8326-43df-96b2-91375100438d",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "service/opa created\n"
     ]
    }
   ],
   "source": [
    "kubectl create -f - <<EOF\n",
    "kind: Service\n",
    "apiVersion: v1\n",
    "metadata:\n",
    "  name: opa\n",
    "  labels:\n",
    "    app: opa\n",
    "spec:\n",
    "  type: NodePort\n",
    "  selector:\n",
    "    app: opa\n",
    "  ports:\n",
    "    - name: http\n",
    "      protocol: TCP\n",
    "      port: 8181\n",
    "      targetPort: 8181\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 11,
   "id": "9079eeb1-da54-4598-b75b-cbaecd7a79a0",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "apiVersion: v1\n",
      "kind: Service\n",
      "metadata:\n",
      "  creationTimestamp: \"2021-12-03T09:27:52Z\"\n",
      "  labels:\n",
      "    app: opa\n",
      "  name: opa\n",
      "  namespace: default\n",
      "  resourceVersion: \"1063\"\n",
      "  uid: 04b7e10c-9b8c-4641-a2e0-1027a898f430\n",
      "spec:\n",
      "  clusterIP: 10.96.83.229\n",
      "  clusterIPs:\n",
      "  - 10.96.83.229\n",
      "  externalTrafficPolicy: Cluster\n",
      "  internalTrafficPolicy: Cluster\n",
      "  ipFamilies:\n",
      "  - IPv4\n",
      "  ipFamilyPolicy: SingleStack\n",
      "  ports:\n",
      "  - name: http\n",
      "    nodePort: 32505\n",
      "    port: 8181\n",
      "    protocol: TCP\n",
      "    targetPort: 8181\n",
      "  selector:\n",
      "    app: opa\n",
      "  sessionAffinity: None\n",
      "  type: NodePort\n",
      "status:\n",
      "  loadBalancer: {}\n"
     ]
    }
   ],
   "source": [
    "kubectl get svc opa -o yaml"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 39,
   "id": "6942ad27-259c-45ee-b3b4-e072bdd02346",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "192.168.49.2:32505\n"
     ]
    }
   ],
   "source": [
    "OPA_IP_PORT=$(hostname -i):$(kubectl get service opa -o jsonpath='{.spec.ports[0].nodePort}')\n",
    "echo $OPA_IP_PORT"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 40,
   "id": "2ab0a90c-93c8-4d65-80b1-78b208296f00",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "{\"result\":{\"example\":{\"greeting\":\"hello from pod \\\"opa-69c9967959-gf4wh\\\"!\"}}}"
     ]
    }
   ],
   "source": [
    "curl $OPA_IP_PORT/v1/data"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 41,
   "id": "05a0b3fa-f2cb-4a3d-be9a-1b4e14cb63ba",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "NAME                       READY   STATUS    RESTARTS   AGE\n",
      "pod/opa-69c9967959-gf4wh   1/1     Running   0          7m43s\n",
      "\n",
      "NAME                 TYPE        CLUSTER-IP     EXTERNAL-IP   PORT(S)          AGE\n",
      "service/kubernetes   ClusterIP   10.96.0.1      <none>        443/TCP          24m\n",
      "service/opa          NodePort    10.96.83.229   <none>        8181:32505/TCP   14m\n",
      "\n",
      "NAME                  READY   UP-TO-DATE   AVAILABLE   AGE\n",
      "deployment.apps/opa   1/1     1            1           7m43s\n",
      "\n",
      "NAME                             DESIRED   CURRENT   READY   AGE\n",
      "replicaset.apps/opa-69c9967959   1         1         1       7m43s\n"
     ]
    }
   ],
   "source": [
    "kubectl get all"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 42,
   "id": "b4ba8c4d-4b73-46ed-9a21-3bef1cc6bf52",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "LAST SEEN   TYPE      REASON                    OBJECT                      MESSAGE\n",
      "24m         Normal    Starting                  node/minikube               Starting kubelet.\n",
      "24m         Normal    NodeHasSufficientMemory   node/minikube               Node minikube status is now: NodeHasSufficientMemory\n",
      "24m         Normal    NodeHasNoDiskPressure     node/minikube               Node minikube status is now: NodeHasNoDiskPressure\n",
      "24m         Normal    NodeHasSufficientPID      node/minikube               Node minikube status is now: NodeHasSufficientPID\n",
      "24m         Normal    NodeAllocatableEnforced   node/minikube               Updated Node Allocatable limit across pods\n",
      "24m         Normal    NodeReady                 node/minikube               Node minikube status is now: NodeReady\n",
      "24m         Normal    RegisteredNode            node/minikube               Node minikube event: Registered Node minikube in Controller\n",
      "7m51s       Normal    Scheduled                 pod/opa-69c9967959-gf4wh    Successfully assigned default/opa-69c9967959-gf4wh to minikube\n",
      "7m51s       Normal    Pulling                   pod/opa-69c9967959-gf4wh    Pulling image \"openpolicyagent/opa:0.35.0\"\n",
      "7m37s       Normal    Pulled                    pod/opa-69c9967959-gf4wh    Successfully pulled image \"openpolicyagent/opa:0.35.0\" in 13.31870391s\n",
      "7m37s       Normal    Created                   pod/opa-69c9967959-gf4wh    Created container opa\n",
      "7m37s       Normal    Started                   pod/opa-69c9967959-gf4wh    Started container opa\n",
      "15m         Normal    Scheduled                 pod/opa-69c9967959-vn9s8    Successfully assigned default/opa-69c9967959-vn9s8 to minikube\n",
      "8m54s       Warning   FailedMount               pod/opa-69c9967959-vn9s8    MountVolume.SetUp failed for volume \"example-policy\" : configmap \"example-policy\" not found\n",
      "10m         Warning   FailedMount               pod/opa-69c9967959-vn9s8    Unable to attach or mount volumes: unmounted volumes=[example-policy], unattached volumes=[example-policy kube-api-access-cgz9g]: timed out waiting for the condition\n",
      "8m31s       Warning   FailedMount               pod/opa-69c9967959-vn9s8    Unable to attach or mount volumes: unmounted volumes=[example-policy], unattached volumes=[kube-api-access-cgz9g example-policy]: timed out waiting for the condition\n",
      "6m51s       Normal    Pulled                    pod/opa-69c9967959-vn9s8    Container image \"openpolicyagent/opa:0.35.0\" already present on machine\n",
      "6m51s       Normal    Created                   pod/opa-69c9967959-vn9s8    Created container opa\n",
      "6m51s       Normal    Started                   pod/opa-69c9967959-vn9s8    Started container opa\n",
      "6m49s       Normal    Killing                   pod/opa-69c9967959-vn9s8    Stopping container opa\n",
      "6m49s       Warning   FailedKillPod             pod/opa-69c9967959-vn9s8    error killing pod: failed to \"KillContainer\" for \"opa\" with KillContainerError: \"rpc error: code = Unknown desc = Error response from daemon: No such container: 718006324e40591fb659743a15aa86295298f37fa327646fa1ed2d84f4e0c50a\"\n",
      "15m         Normal    SuccessfulCreate          replicaset/opa-69c9967959   Created pod: opa-69c9967959-vn9s8\n",
      "7m51s       Normal    SuccessfulCreate          replicaset/opa-69c9967959   Created pod: opa-69c9967959-gf4wh\n",
      "15m         Normal    ScalingReplicaSet         deployment/opa              Scaled up replica set opa-69c9967959 to 1\n",
      "7m51s       Normal    ScalingReplicaSet         deployment/opa              Scaled up replica set opa-69c9967959 to 1\n"
     ]
    }
   ],
   "source": [
    "kubectl get events"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": 28,
   "id": "a92abbe9-49ec-4f4c-b04b-866d7dcf80e6",
   "metadata": {},
   "outputs": [
    {
     "name": "stdout",
     "output_type": "stream",
     "text": [
      "bash: minikube: command not found\n"
     ]
    },
    {
     "ename": "",
     "evalue": "127",
     "output_type": "error",
     "traceback": []
    }
   ],
   "source": [
    "minikube service list"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "47410e51-59c3-47de-8b38-9a30bd7e34ed",
   "metadata": {},
   "outputs": [],
   "source": []
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Bash",
   "language": "bash",
   "name": "bash"
  },
  "language_info": {
   "codemirror_mode": "shell",
   "file_extension": ".sh",
   "mimetype": "text/x-sh",
   "name": "bash"
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}