OPA (Open Policy Agent) Upload

id: upload_policy
namespace: company.team

tasks:
  - id: upload_policy
    type: io.kestra.plugin.ee.opa.policy.Upload
    url: "{{ secret('OPA_URL') }}"
    token: "{{ secret('OPA_TOKEN') }}"
    policyId: "kubernetes-admission"
    policy: |
      package kubernetes.admission

      deny contains msg if {
        input.request.kind == "Deployment"
        not input.request.object.spec.template.spec.securityContext.runAsNonRoot
        msg := "Containers must not run as root"
      }

      deny contains msg if {
        input.request.kind == "Deployment"
        input.request.object.spec.replicas > 10
        input.request.namespace != "production"
        msg := "Non-production deployments cannot exceed 10 replicas"
      }