As discussed briefly with @tsandall. Posting for visibility and to widen the discussion.
I've been hacking on https://github.com/instrumenta/conftest, which uses OPA/rego but presents an interface for local unit testing of configuration. I'll be talking at KubeCon in a few weeks about this and why I think it's useful.
One thing I've added recently is the ability to share rego files on OCI registries. Basically you can do the following and download existing rules or other bits.
conftest pull instrumenta.azurecr.io/kubernetes-helpers
That spun off work I was doing with @SteveLasker (product manager for Azure Container Registry at Microsoft) before I left Docker. Basically better support in registries for other types of content than just Docker images. Steve has a proposal up at:
https://github.com/SteveLasker/RegistryArtifactTypes/blob/master/mediaTypes.md
The rationale for sharing things via OCI images is described in this blog post https://stevelasker.blog/2019/01/25/cloud-native-artifact-stores-evolve-from-container-registries/. But in short, everyone already has one (whether cloud provider, public/private, self-hosted, geo-replicated, etc.)
As part of the proposal content can have a mimetype. This allows for more intelligent clients and interesting possibilities on the registries. As a very simple example, the registry could show the OPA icon when you view an OCI image which contains a rego bundle.
I'm proposing the following mimetypes for OPA content:
| Usage |
mediaType |
| OPA Bundle |
application/vnd.cncf.openpolicyagent.config.v1 |
| Bundle .manifest |
application/vnd.cncf.openpolicyagent.manifest.v1 |
| Rego files |
application/vnd.cncf.openpolicyagent.rego.v1 |
| Data files |
application/vnd.cncf.openpolicyagent.data.v1 |
This broadly follows the current bundle format, just packaged as an OCI image rather than a flat tar file. https://www.openpolicyagent.org/docs/latest/bundles/
It should be possible to unpack an OCI bundle and get back the folder structure. The different mediaTypes simply mean the content is separated into individual layers in to the OCI image.
Sharing OPA bundles as OCI images may be useful outside conftest, at which point I'm happy to rip out that code to somewhere else.
Do the above media types look sensible to folks?
As discussed briefly with @tsandall. Posting for visibility and to widen the discussion.
I've been hacking on https://github.com/instrumenta/conftest, which uses OPA/rego but presents an interface for local unit testing of configuration. I'll be talking at KubeCon in a few weeks about this and why I think it's useful.
One thing I've added recently is the ability to share rego files on OCI registries. Basically you can do the following and download existing rules or other bits.
conftest pull instrumenta.azurecr.io/kubernetes-helpersThat spun off work I was doing with @SteveLasker (product manager for Azure Container Registry at Microsoft) before I left Docker. Basically better support in registries for other types of content than just Docker images. Steve has a proposal up at:
https://github.com/SteveLasker/RegistryArtifactTypes/blob/master/mediaTypes.md
The rationale for sharing things via OCI images is described in this blog post https://stevelasker.blog/2019/01/25/cloud-native-artifact-stores-evolve-from-container-registries/. But in short, everyone already has one (whether cloud provider, public/private, self-hosted, geo-replicated, etc.)
As part of the proposal content can have a mimetype. This allows for more intelligent clients and interesting possibilities on the registries. As a very simple example, the registry could show the OPA icon when you view an OCI image which contains a rego bundle.
I'm proposing the following mimetypes for OPA content:
application/vnd.cncf.openpolicyagent.config.v1application/vnd.cncf.openpolicyagent.manifest.v1application/vnd.cncf.openpolicyagent.rego.v1application/vnd.cncf.openpolicyagent.data.v1This broadly follows the current bundle format, just packaged as an OCI image rather than a flat tar file. https://www.openpolicyagent.org/docs/latest/bundles/
It should be possible to unpack an OCI bundle and get back the folder structure. The different mediaTypes simply mean the content is separated into individual layers in to the OCI image.
Sharing OPA bundles as OCI images may be useful outside conftest, at which point I'm happy to rip out that code to somewhere else.
Do the above media types look sensible to folks?