Unit testing Kubernetes configs using Open Policy Agent and Conftest

Quick introduction to Conftest for the Kubernetes community weekly meeting.

Transcript

1. Unit testing Kubernetes configs
   Using Open Policy Agent and Conftest
   

   View Slide

2. Open Policy Agent is
   normally used here
   Development cycle
   Cluster
   Local
   development
   Continuous
   integration
   

   View Slide

3. For example...
   

   View Slide

4. What if we could use Open
   Policy Agent here as well?
   Development cycle
   Cluster
   Local
   development
   Continuous
   integration
   

   View Slide

5. Introducing Conftest
   snyk.io
   

   View Slide

6. apiVersion: apps/v1
   kind: Deployment
   metadata:
   name: hello-kubernetes
   spec:
   replicas: 3
   selector:
   matchLabels:
   app: hello-kubernetes
   template:
   metadata:
   labels:
   app: hello-kubernetes
   spec:
   containers:
   - name: hello-kubernetes
   image: paulbouwer/hello-kubernetes:1.5
   ports:
   Given a Kubernetes config file
   

   View Slide

7. package main
   deny[msg] {
   input.kind = "Deployment"
   not input.spec.template.spec.securityContext.runAsNonRoot = true
   msg = "Containers must not run as root"
   }
   deny[msg] {
   input.kind = "Deployment"
   not input.spec.selector.matchLabels.app
   msg = "Containers must provide app label for pod selectors"
   }
   Write your policies
   

   View Slide

8. deny[msg] {
   input.kind = "Deployment"
   not input.spec.template.spec.securityContext.runAsNonRoot = true
   msg = "Containers must not run as root"
   }
   Rego? A DSL for policy
   We should deny any input for which
   Deployment is the value for kind
   and
   When runAsNonRoot is set to false
   

   View Slide

9. $ conftest test deployment.yaml
   deployment.yaml
   Containers must not run as root
   $ echo $status
   1
   Run tests with conftest
   

   View Slide

10. // Where should we eat at
    // KubeCon in San Diego?
    {
    "restaurants": [
    "Campfire",
    "Galaxy Taco",
    "Olive Garden",
    "Dija Mara",
    "Mikkeller",
    "Wrench and Rodent"
    ]
    }
    Not just K8s
    package main
    deny["Nice try Lachlan"] {
    input.restaurants[_] = "Olive Garden"
    }
    Currently supports HCL, TOML,
    YAML, JSON, CUE and INI
    

    View Slide

11. Demo
    

    View Slide

12. Join in
    snyk.io
    - Join the #conftest channel on the Open Policy
    Agent Slack at slack.openpolicyagent.org
    - Download or hack on Conftest at
    github.com/instrumenta/conftest
    

    View Slide