viktor90/opa-docker-authz-v2 repository overview

⁠Original plugin, https://github.com/open-policy-agent/opa-docker-authz⁠

The original plugin has one big limitation/drawback, it can read only one policy file by default. This one is extended just a little bit, so it is able to read multiple OPA policy files and concatenate them into one single policy file (All files that end on .rego).

Example installation:

1. mkdir -pv /etc/docker/policies

2. docker plugin install viktor90/opa-docker-authz-v2:1.0 opa-args="-policy-file /opa/policies"

3. edit /etc/docker/daemon.json and include { "authorization-plugins": ["viktor90/opa-docker-authz-v2:1.0"] }

4. Create policy files under /etc/docker/policies Note: package directive must be included in only one of the files, the others act as extension.

Example

• /etc/docker/policies/authz.rego

    package docker.authz
    default allow = false
  

  Copy

• /etc/docker/policies/list.rego

    allow {
        list_containers
    }
  
    allow {
        list_all_containers
    }
  
    list_all_containers {
        input.Method == "GET"
        input.Path == "/v1.41/containers/json?all=1"
    }
  
    list_containers {
        input.Method == "GET"
        input.Path == "/v1.41/containers/json"
    }
  

  Copy

• /etc/docker/policies/create.rego

  allow { valid_label }

  valid_label { input.Path == "/v1.41/containers/create" input.Body.Labels.security = "test" }

⁠Code changes

https://github.com/open-policy-agent/opa-docker-authz/blob/master/main.go#L71⁠

⁠Newly Added

    // Some custom changes to combine all *.rego files under policyFile directory
    var combined_file bytes.Buffer
    files, err := ioutil.ReadDir(p.policyFile)
    if err != nil {
            log.Fatal(err)
    }

    for _, file := range files {
            match, _ := regexp.MatchString(".*.rego", file.Name())
            if match == true {
                    full_path := p.policyFile + "/" + file.Name()
                    content, err := ioutil.ReadFile(full_path)
                    if err == nil {
                            _, err := combined_file.Write(content)
                            if err != nil {
                                    fmt.Println("Error reading file: ", full_path)
                            }
                    }
            }
    }
    bs := combined_file.Bytes()


    /////////////////////////

    //bs, err := ioutil.ReadFile(p.policyFile)
    //if err != nil {
    //      return false, err
    //}