A template repository that streamlines converting Open Policy Agent Rego policies into Kubewarden policies with automated build and test workflows.
A template repository to quickly port a Open Policy Agent policy to Kubewarden
This tool is designed for developers and security engineers who want to port existing Open Policy Agent (OPA) Rego policies to Kubewarden without rewriting the policy logic. It simplifies the process by providing a ready-made template, automation for compiling policies into WebAssembly modules, annotating them, and running tests, enabling seamless integration into Kubernetes admission controls.
Ensure the Rego policy returns an AdmissionReview response object as required by Kubernetes admission controllers. The policy must be compiled into a WebAssembly module using the opa CLI and annotated with kwctl before deployment. Leveraging the included GitHub Actions workflows automates testing and publishing, promoting CI/CD best practices.
Clone the repository
Install the opa CLI tool to compile Rego policies
Install kwctl CLI tool for annotating and running Kubewarden policies
Run `make test` to execute Rego unit tests
Run `make e2e-tests` to execute end-to-end tests against the WebAssembly modulemake test
Runs the Rego unit tests defined in policy_test.rego
make e2e-tests
Executes end-to-end tests against the compiled WebAssembly module using the kwctl runtime