- Notifications
You must be signed in to change notification settings - Fork129
A library of constraint templates and sample constraints for Constraint Framework tools
License
GoogleCloudPlatform/policy-library
Folders and files
| Name | Name | Last commit message | Last commit date | |
|---|---|---|---|---|
Repository files navigation
This repo contains a library of constraint templates and sample constraints.
For information on setting up Config Validator to secure your environment, see theUser Guide.
You can easily set up a new (local) policy library by downloading abundle usingkpt.
Download the full policy library and install theForseti bundle:
export BUNDLE=forseti-securitykpt pkg get https://github.com/GoogleCloudPlatform/policy-library.git ./policy-librarykpt fn source policy-library/samples/ | \ kpt fn eval - --image gcr.io/config-validator/get-policy-bundle:latest -- bundle=$BUNDLE | \ kpt fn sink policy-library/policies/constraints/$BUNDLEOnce you have initialized a library, you might want to save it togit.
If this library doesn't contain a constraint that matches your use case, you can develop a new oneusing theConstraint Template Authoring Guide.
make audit Run audit against real CAI dump datamake build Format and buildmake build_templates Inline Rego rules into constraint templatesmake debug Show debugging output from OPAmake format Format Rego rulesmake help Prints help for targets with commentsmake test Test constraint templates via OPAYou can runmake build to automatically inline Rego rules into your constraint templates.
This is done by finding aINLINE("filename") and#ENDINLINE statements in your yaml,and replacing everything in between with the contents of the file.
For example, runningmake build would replace the raw content with the replaced content below
Raw:
#INLINE("my_rule.rego")# This text will be replaced#ENDINLINEReplaced:
#INLINE("my_rule.rego")#contents of my_rule.rego#ENDINLINEConfig Validator provides a policy linter. You can invoke it as:
go get github.com/GoogleCloudPlatform/config-validator/cmd/policy-toolpolicy-tool --policies ./policies --policies ./samples --libs ./libYou can run the cloudbuild CI locally as follows:
gcloud components install cloud-build-localcloud-build-local --config ./cloudbuild.yaml --dryrun=false .You can update the CI images to add new versions of rego/opa as they are released.
# Rebuild all images.make -j ci-images# Rebuild a single imagemake ci-image-v1.16.0About
A library of constraint templates and sample constraints for Constraint Framework tools
Resources
License
Uh oh!
There was an error while loading.Please reload this page.
Stars
Watchers
Forks
Releases
Packages0
Uh oh!
There was an error while loading.Please reload this page.