CASMPET-6798: Update Spire OPA Policy for SBPS Marshal Agent (#105)

- enable/ update OPA policy for SBPS Marshal Agent - update unit test in OPA for SBPS Marshal Agent
Cray-HPE · Mar 21, 2024 · a67e980 · a67e980
1 parent 99e098f
commit a67e980
Show file tree

Hide file tree

Showing 4 changed files with 23 additions and 2 deletions.
diff --git a/kubernetes/cray-opa/Chart.yaml b/kubernetes/cray-opa/Chart.yaml
@@ -1,7 +1,7 @@
 #
 # MIT License
 #
-# (C) Copyright 2022-2023 Hewlett Packard Enterprise Development LP
+# (C) Copyright 2022-2024 Hewlett Packard Enterprise Development LP
 #
 # Permission is hereby granted, free of charge, to any person obtaining a
 # copy of this software and associated documentation files (the "Software"),
@@ -23,7 +23,7 @@
 #
 apiVersion: v2
 name: cray-opa
-version: 1.33.3
+version: 1.33.4
 description: Cray Open Policy Agent
 keywords:
   - opa

diff --git a/kubernetes/cray-opa/templates/policies/spire.yaml b/kubernetes/cray-opa/templates/policies/spire.yaml
@@ -135,6 +135,9 @@ data:
           {"method": "POST", "path": `^/apis/hbtd/hmi/v1/heartbeat/.*$`},
           {{- end }}
           {"method": "GET", "path": `^/apis/hbtd/hmi/v1/params$`},
+        ],
+        "sbps-marshal": [
+          {"method": "GET", "path": `^/apis/ims/v3/images$`},
         ]
       }
 
@@ -203,6 +206,7 @@ data:
           "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/ncn/XNAME/workload/heartbeat": spire_methods["heartbeat"],
           "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/ncn/XNAME/workload/orca": spire_methods["dvs"],
           "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/ncn/XNAME/workload/tpm-provisioner": spire_methods["tpm-provisioner"],
+          "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/ncn/XNAME/workload/sbps-marshal": spire_methods["sbps-marshal"],  
           "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/storage/XNAME/workload/cfs-state-reporter": spire_methods["cfs"],
           "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/storage/XNAME/workload/heartbeat": spire_methods["heartbeat"],
           "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/storage/XNAME/workload/tpm-provisioner": spire_methods["tpm-provisioner"],
@@ -272,6 +276,7 @@ data:
         "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/ncn/workload/heartbeat": spire_methods["heartbeat"],
         "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/ncn/workload/orca": spire_methods["dvs"],
         "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/ncn/workload/tpm-provisioner": spire_methods["tpm-provisioner"],
+        "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/ncn/workload/sbps-marshal": spire_methods["sbps-marshal"],
         "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/storage/workload/cfs-state-reporter": spire_methods["cfs"],
         "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/storage/workload/heartbeat": spire_methods["heartbeat"],
         "spiffe://{{ $.Values.jwtValidation.spire.trustDomain }}/storage/workload/tpm-provisioner": spire_methods["tpm-provisioner"],

diff --git a/kubernetes/cray-opa/tests/opa/run_tests/run_tests.go b/kubernetes/cray-opa/tests/opa/run_tests/run_tests.go
@@ -351,6 +351,16 @@ func main() {
 	}
 	fmt.Println(spireSub, ":", spireNcnTPMProvisioner)
 
+	spireSub = spireSubNCNPrefix + "sbps-marshal"
+        args = createTokenArgs{
+                issuer: spireIssuer, aud: systemComputeAud, sub: spireSub,
+        }
+        spireNcnSBPSMarshal, err := tc.create(args)
+        if err != nil {
+                log.Fatal(err)
+        }
+        fmt.Println(spireSub, ":", spireNcnSBPSMarshal)
+
 	spireSub = spireSubComputePrefix + "cfs-state-reporter"
 	args = createTokenArgs{
 		issuer: spireIssuer, aud: systemComputeAud, sub: spireSub,
@@ -625,6 +635,7 @@ func main() {
 				"heartbeat":          spireNcnHeartbeat,
 				"orca":               spireNcnOrca,
 				"tpm_provisioner":    spireNcnTPMProvisioner,
+				"sbps_marshal":       spireNcnSBPSMarshal,
 			},
 			"compute": map[string]interface{}{
 				"cfs_state_reporter":   spireComputeCfsStateReporter,

diff --git a/kubernetes/cray-opa/tests/opa/spire_test.rego.tpl b/kubernetes/cray-opa/tests/opa/spire_test.rego.tpl
@@ -21,6 +21,7 @@ sls_networks_path = "/apis/sls/v1/networks"
 hmnfd_subscribe_path = "/apis/hmnfd/hmi/v1/subscribe"
 hmnfd_subscriptions_path = "/apis/hmnfd/hmi/v1/subscriptions"
 pals_mock_path = "/apis/pals/v1/mock"
+sbps_marshal_ims_path = "/apis/ims/v3/images"
 
 # Tests for denying access to pals mock path for ckdump sub
 
@@ -347,3 +348,7 @@ test_tpm_provisioner_cray_spire {
 
   allow.http_status == 403 with input as {"attributes": {"request": {"http": {"method": "POST", "path": "/apis/tpm-provisioner/whitelist/remove", "headers": {"authorization": "Bearer {{ .spire.compute.cray_tpm_provisioner }}" }}}}}
 }
+
+test_spire_sbps_marshal {
+  not allow.http_status with input as {"attributes": {"request": {"http": {"method": "GET", "path": sbps_marshal_ims_path, "headers": {"authorization": "Bearer {{ .spire.ncn.sbps_marshal }}"}}}}}
+}