feat(pe): add policy-engine component

armory/patch-policy-engine-plugin.yml → armory/features/policy-engine/feature.yml

@@ -24,17 +24,18 @@ spec:
  spinnaker:
  armory:
  policyEngine:
+ failOpen: true
  opa:
  # Replace with the actual URL to your Open Policy Agent deployment
  baseUrl: http://opa:8181/v1/data
  # Optional. The number of seconds that the Policy Engine will wait for a response from the OPA server. Default is 10 seconds if omitted.
- # timeoutSeconds: <integer> 
+ # timeoutSeconds: <integer>
  spinnaker:
  extensibility:
  repositories:
  policyEngine:
  enabled: true
- url: https://raw.githubusercontent.com/armory-plugins/policy-engine-releases/master/repositories.json
+ url: https://raw.githubusercontent.com/armory-plugins/pluginRepository/master/repositories.json
  gate:
  spinnaker:
  extensibility:
@@ -46,7 +47,7 @@ spec:
  plugins:
  Armory.PolicyEngine:
  enabled: true
- version: &version 0.2.0
+ version: &version 0.3.0-snapshot.master.b1bdd2d
 
  orca:
  spinnaker:

armory/features/policy-engine/kustomization.yml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1alpha1
+kind: Component
+
+resources:
+ - opa.yml
+
+patchesStrategicMerge:
+ - feature.yml
+
+configMapGenerator:
+ # ConfigMap holding OPA policy definitions for use by Armory's Policy Engine.
+ # Required by patch-policy-engine-plugin.yml
+ - name: spin-policies
+ files:
+ - policies/manual-judgement.rego
+ - policies/save-pipeline.rego

armory/policies/manual-judgement.rego → armory/features/policy-engine/policies/manual-judgement.rego

@@ -5,5 +5,4 @@ deny["Every pipeline must have a Manual Judgment stage"] {
  manual_judgment_stages = [d | d = input.pipeline.stages[_].type; d == "manualJudgment"]
  count(input.pipeline.stages[_]) > 0
  count(manual_judgment_stages) == 0
- 1 := 0
 }

armory/features/policy-engine/policies/save-pipeline.rego

@@ -0,0 +1,7 @@
+# manual-judgment.rego. Notice the package. The opa.pipelines package is used for policies that get checked when a pipeline is saved.
+package spinnaker.persistence.pipelines.before
+
+deny["Every pipeline must have a Manual Judgment stage"] {
+
+ 1 == 0
+}