All Projects → Turall → OPA-python-client

Turall / OPA-python-client

Licence: MIT License
Python client for Open Policy Agent

Programming Languages

python
139335 projects - #7 most used programming language

Projects that are alternatives of or similar to OPA-python-client

opal
Policy and data administration, distribution, and real-time updates on top of Open Policy Agent
Stars: ✭ 459 (+1812.5%)
Mutual labels:  policy, opa, open-policy-agent
Opa
An open source, general-purpose policy engine.
Stars: ✭ 5,939 (+24645.83%)
Mutual labels:  policy, opa, open-policy-agent
opa-kafka-plugin
Open Policy Agent (OPA) plug-in for Kafka authorization
Stars: ✭ 46 (+91.67%)
Mutual labels:  opa, open-policy-agent
container-image-sign-and-verify-with-cosign-and-opa
This is just a proof-of-concept project that aims to sign and verify container images using cosign and OPA (Open Policy Agent)
Stars: ✭ 54 (+125%)
Mutual labels:  opa, open-policy-agent
prancer-compliance-test
This repository includes cloud security policies for IaC and live resources.
Stars: ✭ 32 (+33.33%)
Mutual labels:  policy, opa
awesome-opa
A curated list of OPA related tools, frameworks and articles
Stars: ✭ 316 (+1216.67%)
Mutual labels:  opa, open-policy-agent
dotnet-opa-wasm
Call Open Policy Agent (OPA) policies in WASM (Web Assembly) from .NET Core
Stars: ✭ 36 (+50%)
Mutual labels:  opa, open-policy-agent
k8s-opa-boilerplate
Boilerplate example of managing OPA with kustomize
Stars: ✭ 14 (-41.67%)
Mutual labels:  opa, open-policy-agent
gamechanger
GAMECHANGER aspires to be the Department’s trusted solution for evidence-based, data-driven decision-making across the universe of DoD requirements
Stars: ✭ 27 (+12.5%)
Mutual labels:  policy
speedle-plus
Speedle+ is an open source project for access management. It is based on Speedle open source project and maintained by previous Speedle maintainers.
Stars: ✭ 45 (+87.5%)
Mutual labels:  policy
intercept
INTERCEPT / Policy as Code Static Analysis Auditing / SAST
Stars: ✭ 54 (+125%)
Mutual labels:  policy
CKS-Exercises-Certified-Kubernetes-Security-Specialist
A set of curated exercises to help you prepare for the CKS exam
Stars: ✭ 124 (+416.67%)
Mutual labels:  opa
open-source-logiciel-libre
Open Source Software Requirements and Guidance (Draft) - Exigences et guides liés aux logiciels libres (Ébauche)
Stars: ✭ 31 (+29.17%)
Mutual labels:  policy
PolicyLib
权限申请和隐私政策弹窗提示库
Stars: ✭ 43 (+79.17%)
Mutual labels:  policy
policies
A set of shared policies for use with Conftest and other Open Policy Agent tools
Stars: ✭ 61 (+154.17%)
Mutual labels:  open-policy-agent
riskybird
Regular expression authors best friend
Stars: ✭ 48 (+100%)
Mutual labels:  opa
falcon-policy
Policy Middleware for Falcon APIs
Stars: ✭ 30 (+25%)
Mutual labels:  policy
regolibrary
The rego library package contains the controls Kubescape uses for detecting miss-configurations in Kubernetes manifests
Stars: ✭ 45 (+87.5%)
Mutual labels:  opa
s3-proxy
S3 Reverse Proxy with GET, PUT and DELETE methods and authentication (OpenID Connect and Basic Auth)
Stars: ✭ 106 (+341.67%)
Mutual labels:  opa
HeimGuard
🛡 A simple library that allows you to easily manage permissions in your .NET projects.
Stars: ✭ 77 (+220.83%)
Mutual labels:  policy

Python Open Policy Agent (OPA) Client

Downloads

See offical documentation page Open Policy Agent

Installation

 $ pip install OPA-python-client

Usage Examples

>>> from opa_client.opa import OpaClient
>>> client = OpaClient() # default host='localhost', port=8181, version='v1'
>>> client.check_connection()
'Yes I"m here :)'
>>>  test_policy = """
...     package play
... 
...     import data.testapi.testdata
... 
...     default hello = false
... 
...     hello {
...         m := input.message
...         testdata[i] == m
...     }
... """

>>> client.update_opa_policy_fromstring(test_policy, "testpolicy")
True
>>> client.get_policies_list()
['testpolicy']
>>> data = ["world", "hello"]
>>> client.update_or_create_opa_data(data, "testapi/testdata")
True
>>> check_data = {"input": {"message": "hello"}}
>>> client.check_permission(input_data=check_data, policy_name="testpolicy", rule_name="hello")
{'result': True}

Connection to OPA service

from opa_client.opa import OpaClient

client = OpaClient() # default host='localhost', port=8181, version='v1'

client.check_connection() # response is  Yes I'm here :)

# Ensure the connection is closed correctly by deleting the client
del client

Connection to OPA service with SSL

from opa_client.opa import OpaClient


client = OpaClient(
    host="https://192.168.99.100",
    port=8181,
    version="v1",
    ssl=True,
    cert="/your/certificate/file/path/mycert.crt",
)

client.check_connection() # response is  Yes I'm here :)

del client

Update policy from rego file

from opa_client.opa import OpaClient

client = OpaClient() 

client.update_opa_policy_fromfile("/your/path/filename.rego", endpoint="fromfile") # response is True

client.get_policies_list() # response is ["fromfile"]

del client

Update policy from URL

from opa_client.opa import OpaClient

client = OpaClient() 


client.update_opa_policy_fromurl("http://opapolicyurlexample.test/example.rego", endpoint="fromurl") # response is True

client.get_policies_list() # response is ["fromfile","fromurl"]

del client

Delete policy

from opa_client.opa import OpaClient

client = OpaClient() 

client.delete_opa_policy("fromfile") # response is True

client.get_policies_list() # response is [] 

del client

Get raw data from OPA service

from opa_client.opa import OpaClient

client = OpaClient() 

print(client.get_opa_raw_data("testapi/testdata"))  # response is {'result': ['world', 'hello']}

# You can use query params for additional info
# provenance - If parameter is true, response will include build/version info in addition to the result.
# metrics - Return query performance metrics in addition to result 

print(client.get_opa_raw_data("userinfo",query_params={"provenance": True})) 
# response is {'provenance': {'version': '0.25.2', 'build_commit': '4c6e524', 'build_timestamp': '2020-12-08T16:56:55Z', 'build_hostname': '3bb58334a5a9'}, 'result': {'user_roles': {'alice': ['admin'], 'bob': ['employee', 'billing'], 'eve': ['customer']}}}

print(client.get_opa_raw_data("userinfo",query_params={"metrics": True})) 

# response is {'metrics': {'counter_server_query_cache_hit': 0, 'timer_rego_external_resolve_ns': 231, 'timer_rego_input_parse_ns': 381, 'timer_rego_query_compile_ns': 40173, 'timer_rego_query_eval_ns': 12674, 'timer_rego_query_parse_ns': 5692, 'timer_server_handler_ns': 83490}, 'result': {'user_roles': {'alice': ['admin'], 'bob': ['employee', 'billing'], 'eve': ['customer']}}}

del client

Save policy to file from OPA service

from opa_client.opa import OpaClient

client = OpaClient() 

client.opa_policy_to_file(policy_name="fromurl",path="/your/path",filename="example.rego")  # response is True

del client

Delete data from OPA service

from opa_client.opa import OpaClient

client = OpaClient() 

client.delete_opa_data("testapi")  # response is True

del client

Information about policy path and rules

from opa_client.opa import OpaClient

client = OpaClient() 

client.get_policies_info()

# response is {'testpolicy': {'path': ['http://your-opa-service/v1/data/play'], 'rules': ['http://your-opa-service/v1/data/play/hello']}

del client

Check permissions

from opa_client.opa import OpaClient

client = OpaClient() 

permission_you_want_check = {"input": {"message": "hello"}}
client.check_permission(input_data=permission_you_want_check, policy_name="testpolicy", rule_name="hello")

# response is {'result': True}

# You can use query params for additional info
# provenance - If parameter is true, response will include build/version info in addition to the result.
# metrics - Return query performance metrics in addition to result 

del client

Queries a package rule with the given input data

from opa_client.opa import OpaClient

client = OpaClient()

rego = """
package play

default hello = false

hello {
    m := input.message
    m == "world"
}
"""

check_data = {"message": "world"}
client.check_policy_rule(input_data=check_data, package_path="play", rule_name="hello") # response {'result': True}

Execute an Ad-hoc Query

from opa_client.opa import OpaClient

client = OpaClient()

print(client.ad_hoc_query(query_params={"q": "data.userinfo.user_roles[name]"})) # response is {}

data = {
    "user_roles": {
        "alice": [
            "admin"
        ],
        "bob": [
            "employee",
            "billing"
        ],
        "eve": [
            "customer"
        ]
    }
}

print(client.update_or_create_opa_data(data, "userinfo")) # response is True

# execute query 
print(client.ad_hoc_query(query_params={"q": "data.userinfo.user_roles[name]"})) 
# response is {'result': [{'name': 'eve'}, {'name': 'alice'}, {'name': 'bob'}]}

#you can send body request
print(client.ad_hoc_query(body={"query": "data.userinfo.user_roles[name] "})) 
# response is {'result': [{'name': 'eve'}, {'name': 'alice'}, {'name': 'bob'}]}

Check OPA healthy. If you want check bundels or plugins, add query params for this.

from opa_client.opa import OpaClient

client = OpaClient()

print(client.check_health()) # response is  True or False
print(client.check_health({"bundle": True})) # response is  True or False
# If your diagnostic url different than default url, you can provide it.
print(client.check_health(diagnostic_url="http://localhost:8282/health"))  # response is  True or False
print(client.check_health(query={"bundle": True}, diagnostic_url="http://localhost:8282/health"))  # response is  True or False

Contributing

Free to open issue and send PR

OPA-python-client supports Python >= 3.5

Note that the project description data, including the texts, logos, images, and/or trademarks, for each open source project belongs to its rightful owner. If you wish to add or remove any projects, please contact us at [email protected].