simple-ac.yaml

# Copyright 2024 Google LLC.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

listener:
  path:
    socketPath: /tmp/acjs.sock
    permission: 0660
    user: "-"
    group: "-"

policies:
- name: some name of the policy
  code: |
    console.log("hello!", ac.User.Username, "x", req.UID, "x", object)

    /*
    // a dummy example
    if (object.spec.containers[0].name.includes("apple"))
      return "please choose a different fruit"
    */

    /*
    // example to mutate the pod (when default k8s conversion is active - this is discouraged)
    object.spec.containers[0].command = ["/bin/echo", "hello :) sorry, this is probably not what you expected."]
    object.spec.containers[0].args = []
    return true
    */

    /*
    // example to mutate the runc spec (when k8s conversion is disabled)
    console.log("hello!", ac.User.Username, "x", req.UID, "x", object)
    runcSpec = JSON.parse(atob(object.container.spec.value))
    // patch
    runcSpec.process.env.push("SOMETHING=debug")
    // repackaging
    object.container.spec.value = btoa(JSON.stringify(runcSpec))
    */

    /*
    // defering to a different admission controller to make the decision
    return forwardToAdmissionController('https://bcidcloudenforcer-pa.googleapis.com/v1/projects/imre-test/policy/locations/europe-west4-b/clusters/cluster-1:admissionReview?timeout=10s')
    */

    /*
    // example how to verify SLSA provenance (high-level):
    var trustedSourceRepos = ["github.com/irsl/gcb-tests"]
    if (!slsaEnsureComingFrom(trustedSourceRepos))
       return "SLSA verification of the image failed. Trusted repos are: "+(trustedSourceRepos.join(", "))
    */

    /*
    // verifying slsa provenance, fine tuning each parameter
    if (!slsaVerify({"SourceUri": "github.com/irsl/gcb-tests", "BuilderId": "https://cloudbuild.googleapis.com/GoogleHostedWorker", "ProvenancePath": "/home/imrer/provenance-github.json"})) 
       return "SLSA verification of the image failed."
    */

    /*
    // simply test a cosign signature
    var cosignResponse = verifyCosign("/home/imrer/cosign.pub")
    if(!cosignResponse) return "Cosign based signature verification of the image failed."
    console.log("cosign verification has succeeded", cosignResponse)
    */


defaultAction: Allow