Skip to content

Commit

Permalink
Policy enhanced (#97)
Browse files Browse the repository at this point in the history 
* enhanced the policy stage with more parameters

* replace old policy stage with enhanced one
  • Loading branch information
@maheshopsmx
maheshopsmx authored Feb 25, 2021
1 parent acb6a23 commit eebb53b
Show file tree
Hide file tree
Showing 2 changed files with 62 additions and 100 deletions.
81 changes: 31 additions & 50 deletions charts/oes/charts/spinnaker/config/orca-local-pipeline-promotion.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -235,70 +235,49 @@ job:
secretName: local-spin-cli-config
restartPolicy: Never
serviceAccountName: default
- label: Custom Policy Stage
type: custom Policy Stage
description: Stage to do opa policy
- label: Policy Stage
type: Policy Stage
description: Spinnaker Policy Evaluation and Decision Stage
cloudProvider: kubernetes
account: default
waitForCompletion: true
application: spin
parameters:
- defaultValue: "http://oes-sapor:8085"
description: Please enter the POLICY Proxy Hostname and Port
label: Policy Proxy
mapping: 'manifest.spec.template.spec.containers[0].env[0].value'
name: policyurl
- defaultValue: "/v1/data/opa/pipelines/datetimeslot"
description: Please enter Policy path that applies to this stage
label: Policy Path
mapping: 'manifest.spec.template.spec.containers[0].env[1].value'
name: policypath
- defaultValue: ""
description: Please enter the Payload in single line
label: Payload
mapping: 'manifest.spec.template.spec.containers[0].env[2].value'
name: payload
manifest:
apiVersion: batch/v1
kind: Job
metadata:
labels:
spinnakerlabel: deljob
name: opastage
name: policystage
namespace: default
spec:
backoffLimit: 0
template:
spec:
restartPolicy: Never
containers:
- name: custom-opa-stage
args:
- |-
param=$(echo $time | sed 's/[][]//g') > /dev/null 2>&1
apk add jq > /dev/null 2>&1
cat >> opa.json <<EOL
{
"startTime": $param,
"application": "$application",
"name": "$name",
"trigger": {
"user": "$user"
}
}
EOL
cat opa.json
cat >> run.sh <<EOL
#/bin/sh
curl -sovX POST http://oes-sapor.oes:8085/v1/data/opa/pipelines/datetimeslot -d @opa.json --header "Content-Type: application/json" --insecure > out.txt
if [ $? -ne 0 ]
then
echo "========= EXECUTION FAILED ========"
else
cat out.txt | jq '.deny'
if [ $? -ne 0 ]
then
echo "=========== POLICY SUCCEDED! ============="
cat out.txt | jq '.'
exit 0
else
echo "========== POLICY FAILED ========"
cat out.txt | jq '.'
exit 1
fi
fi
EOL
chmod +x run.sh > /dev/null 2>&1
sh run.sh
command:
- /bin/sh
- '-x'
- '-c'
- args:
-
env:
- name: policyurl
value:
- name: policypath
value:
- name: payload
value:
- name: application
value: "${execution.application}"
- name: name
Expand All @@ -307,8 +286,10 @@ job:
value: "${{execution.startTime} .toString()}"
- name: user
value: "${execution.authentication.user}"
image: 'opsmxdev/apline-with-curl'
image: 'opsmxdev/policy:v1'
imagePullPolicy: Always
name: policystage
restartPolicy: Never
- label: VerificationGate
cloudProvider: kubernetes
application: spin
Expand Down
81 changes: 31 additions & 50 deletions charts/oes/charts/spinnaker/config/orca-local.yml
View file
Original file line number Diff line number Diff line change
@@ -1,70 +1,49 @@
job:
preconfigured:
kubernetes:
- label: Custom Policy Stage
type: custom Policy Stage
description: Stage to do opa policy
- label: Policy Stage
type: Policy Stage
description: Spinnaker Policy Evaluation and Decision Stage
cloudProvider: kubernetes
account: default
waitForCompletion: true
application: spin
parameters:
- defaultValue: "http://oes-sapor:8085"
description: Please enter the POLICY Proxy Hostname and Port
label: Policy Proxy
mapping: 'manifest.spec.template.spec.containers[0].env[0].value'
name: policyurl
- defaultValue: "/v1/data/opa/pipelines/datetimeslot"
description: Please enter Policy path that applies to this stage
label: Policy Path
mapping: 'manifest.spec.template.spec.containers[0].env[1].value'
name: policypath
- defaultValue: ""
description: Please enter the Payload in single line
label: Payload
mapping: 'manifest.spec.template.spec.containers[0].env[2].value'
name: payload
manifest:
apiVersion: batch/v1
kind: Job
metadata:
labels:
spinnakerlabel: deljob
name: opastage
name: policystage
namespace: default
spec:
backoffLimit: 0
template:
spec:
restartPolicy: Never
containers:
- name: custom-opa-stage
args:
- |-
param=$(echo $time | sed 's/[][]//g') > /dev/null 2>&1
apk add jq > /dev/null 2>&1
cat >> opa.json <<EOL
{
"startTime": $param,
"application": "$application",
"name": "$name",
"trigger": {
"user": "$user"
}
}
EOL
cat opa.json
cat >> run.sh <<EOL
#/bin/sh
curl -sovX POST http://oes-sapor.oes:8085/v1/data/opa/pipelines/datetimeslot -d @opa.json --header "Content-Type: application/json" --insecure > out.txt
if [ $? -ne 0 ]
then
echo "========= EXECUTION FAILED ========"
else
cat out.txt | jq '.deny'
if [ $? -ne 0 ]
then
echo "=========== POLICY SUCCEDED! ============="
cat out.txt | jq '.'
exit 0
else
echo "========== POLICY FAILED ========"
cat out.txt | jq '.'
exit 1
fi
fi
EOL
chmod +x run.sh > /dev/null 2>&1
sh run.sh
command:
- /bin/sh
- '-x'
- '-c'
- args:
-
env:
- name: policyurl
value:
- name: policypath
value:
- name: payload
value:
- name: application
value: "${execution.application}"
- name: name
Expand All @@ -73,8 +52,10 @@ job:
value: "${{execution.startTime} .toString()}"
- name: user
value: "${execution.authentication.user}"
image: 'opsmxdev/apline-with-curl'
image: 'opsmxdev/policy:v1'
imagePullPolicy: Always
name: policystage
restartPolicy: Never
- label: VerificationGate
cloudProvider: kubernetes
application: spin
Expand Down

0 comments on commit eebb53b

Please sign in to comment.