Allow to run Kubewarden, OPA and Gatekeeper policies - Githubissues

kubewarden / policy-evaluator

Crate used by Kubewarden that is able to evaluate policies with a given input, request to evaluate and settings.

Apache License 2.0

15 stars 9 forks source link

Allow to run Kubewarden, OPA and Gatekeeper policies #21

Closed ereslibre closed 3 years ago

ereslibre commented 3 years ago

Policies can have three execution modes at the current time:

Kubewarden + waPC: this is the default behavior if you use one of our SDK languages and build your policy as a WASI target.
OPA: runtime mode of OPA. Inputs and outputs are compatible with regular OPA policies.
OPA Gatekeeper: runtime mode of OPA Gatekeeper. Inputs and outputs are compatible with regualr OPA Gatekeeper policies.

The policy-evaluator should contain logic and constants to both interpret and let kwctl annotate specify the execution mode of a policy.

If no execution mode of a policy is defined, the policy-evaluator can run some heuristics in order to decide what runtime it should use:

If the Wasm artifact contains opa_wasm_abi_version and opa_wasm_abi_minor_version globals, it can be identified as an OPA policy.
Otherwise, fail to execute the policy, since we don't know what execution runtime should be used.

flavio commented 3 years ago

Closing in favor of a dedicated issue on policy-server