OpenPolicyAgent with kubernetes 入门

Open Policy Agent是一种策略控制软件。
本篇参看官网：deploy opa with kubernetes，此列不适用Admission Controller。如果对使用Admission Controller有兴趣可以参考Admission Control Tutorial 和Kubernetes Admission Control Guide 。

Kubernetes

1. 编辑REGO 文件：
   example.rego :

package example

greeting = msg {
    info := opa.runtime()
    hostname := info.env["HOSTNAME"] # Kubernetes sets the HOSTNAME environment variable.
    msg := sprintf("hello from pod %q!", [hostname])
}

kubectl create configmap example-policy --from-file example.rego

2. 部署OPA 服务
   deployment-opa.yaml :

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: opa
  labels:
    app: opa
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: opa
      name: opa
    spec:
      containers:
      - name: opa
        image: openpolicyagent/opa:0.13.5
        ports:
        - name: http
          containerPort: 8181
        args:
        - "run"
        - "--ignore=.*"  # exclude hidden dirs created by Kubernetes
        - "--server"
        - "/policies"
        volumeMounts:
        - readOnly: true
          mountPath: /policies
          name: example-policy
      volumes:
      - name: example-policy
        configMap:
          name: example-policy

kubectl create -f deployment-opa.yaml

service-opa.yaml :

kind: Service
apiVersion: v1
metadata:
  name: opa
  labels:
    app: opa
spec:
  type: NodePort
  selector:
    app: opa
  ports:
    - name: http
      protocol: TCP
      port: 8181
      targetPort: 8181

kubectl create -f service-opa.yaml

3. 测试服务

kubectl get service

获取serviceIP:servicePort

curl serviceIP:servicePort/v1/data
{
  "result": {
    "example": {
      "greeting": "hello from pod \"opa-78ccdfddd-xplxr\"!"
    }
  }
}

Readiness and Liveness Probes

通过Readiness and Liveness ProbesOPA 暴露 /health API。
比如：

containers:
- name: opa
  image: openpolicyagent/opa:0.13.5
  ports:
  - name: http
    containerPort: 8181
  args:
  - "run"
  - "--ignore=.*"               # exclude hidden dirs created by Kubernetes
  - "--server"
  - "/policies"
  volumeMounts:
  - readOnly: true
    mountPath: /policies
    name: example-policy
  livenessProbe:
    httpGet:
      scheme: HTTP              # assumes OPA listens on localhost:8181
      port: 8181
    initialDelaySeconds: 5      # tune these periods for your environemnt
    periodSeconds: 5
  readinessProbe:
    httpGet:
      path: /health?bundle=true  # Include bundle activation in readiness
      scheme: HTTP
      port: 8181
    initialDelaySeconds: 5
    periodSeconds: 5

可以查看Health API中关于 /health说明。