Description

Create Rego rules for OPA which facilitate the definition of policies

Closes stackabletech/issues#500

The Rego rules are contained in an integration test in the directory tests/templates/kuttl/opa-authorization/trino_rules/.

Currently, these rules must be deployed manually:

kubectl create configmap trino-opa-rules \
    --from-file=trino_rules/actual_permissions.rego \
    --from-file=trino_rules/requested_permissions.rego \
    --from-file=trino_rules/util.rego \
    --from-file=trino_rules/verification.rego

kubectl label configmaps trino-opa-rules \
    opa.stackable.tech/bundle=true

The custom policies can be defined in a separate file:

package trino_policies

import rego.v1

policies := {
    "catalogs": [
        {
            "user": "testuser",
            "catalog": "system",
            "allow": "read-only",
        },
    ],
}

This file must also be deployed via a ConfigMap:

kubectl create configmap trino-opa-policies \
    --from-file=trino_policies.rego

kubectl label configmaps trino-opa-policies \
    opa.stackable.tech/bundle=true

There is no documentation for the rules yet. But the rules replicate the File-based access control and its documentation can be used instead. All rules are implemented but roles are not matched.

The rules are formatted with opa fmt:

opa fmt --write *.rego

The rules can be linted with Regal:

regal lint *.rego

The unit tests can be run with opa test in the directory tests/templates/kuttl/opa-authorization/trino_rules/:

opa test --schema schema/ --bundle .

The integration test can be run with:

scripts/run-tests --operator trino=0.0.0-pr559 --test opa-authorization

Definition of Done Checklist

Not all of these items are applicable to all PRs, the author should update this template to only leave the boxes in that are relevant
Please make sure all these things are done and tick the boxes

# Author
- [x] Changes are OpenShift compatible
- [x] Helm chart can be installed and deployed operator works
- [x] Integration tests passed (for non trivial changes)
- [x] Changes need to be "offline" compatible

# Reviewer
- [ ] Code contains useful comments
- [ ] Code contains useful logging statements
- [x] (Integration-)Test cases added
- [x] ~~Documentation added or updated. Follows the [style guide](https://docs.stackable.tech/home/nightly/contributor/docs-style-guide).~~
- [ ] Changelog updated
- [x] Cargo.toml only contains references to git tags (not specific commits or branches)

# Acceptance
- [ ] Feature Tracker has been updated
- [ ] Proper release label has been added
- [ ] [Roadmap](https://github.com/orgs/stackabletech/projects/25/views/1) has been updated

stackabletech / trino-operator

Create Rego rules for OPA #559

Description

Definition of Done Checklist