topic Re: When running a REGO script with the open policy agent OPA how do i only specify the kubernetes cluster to run against in Cortex Cloud Discussions

When running a REGO script with the open policy agent OPA how do i only specify the kubernetes cluster to run against

SCullum — Wed, 03 Feb 2021 11:59:18 GMT

I have multiple kubernetes clusters ; however when running a REGO script with the open policy agent how do i only run the policy against the cluster i want..

https://docs.paloaltonetworks.com/prisma/prisma-cloud/prisma-cloud-admin-compute/access_control/open_policy_agent.html

q1) Is this done in the REGO script itself (see below) ..eg "if cluster == XXX" etc
q2) Would this be done in the Prisma cloud UI ( i cannot see any where to mark a OPA policy as run on particular cluster etc )

# pseudo code.. How do i only run this policy on the cluster i care about if CLUSTER == "XXXX" { repo := "foobar" deny[msg] { some i input.request.kind.kind == "Pod" image := input.request.object.spec.containers[i].image not startswith(image, repo) msg := sprintf("Image '%s' comes from untrusted registry use '%s'",[image,repo]) }

The UI - shows no setting to only run this policy against a particular cluster ..

Re: When running a REGO script with the open policy agent OPA how do i only specify the kubernetes cluster to run against

AKing9 — Fri, 12 Aug 2022 14:30:36 GMT

Greetings SCullum,

I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.

Kind Regards,

J. Avery King

Re: When running a REGO script with the open policy agent OPA how do i only specify the kubernetes cluster to run against

NRojas1 — Fri, 16 Jun 2023 21:46:53 GMT

Hello, I am not OP but I do have the same question. I want to apply the folowing policy only to one cluster:

match[{"msg": msg}] { input.request.operation == "CREATE" input.request.object.metadata.namespace == "default" msg := "It's not allowed to create resources in the Default Namespace" }

How could I be able to do this?

Thank you for your help