<p>We want to disable <code>oc get/describe</code> for <code>secrets</code> to prevent token login</p>

<p>The current policy prevent create, update, delete but not the viewing of secrets</p>

<pre><code>package admission

import data.k8s.matches

# Deny all user for doing secret ops except policyadmin

deny[query] {
    matches[[resource]]

    not "policyadmin" == resource.userInfo.username
    "Secret" == resource.kind.kind

    msg := sprintf("Custom Unauthorized user: %v", [resource.userInfo.username])

    query = {
        "id": "policy-admin-for-secret-only",
        "resource": {
            "kind": kind,
            "namespace": namespace,
            "name": name
        },
        "resolution": {
            "message": msg
        },
    }
}
</code></pre>

<p>The data in the resource object is just: </p>

<blockquote>
  <p>{\"kind\": {\"group\": \"\", \"kind\": \"Secret\", \"version\":
  \"v1\"}, \"name\": \"s5-token-n6v6q\", \"namespace\": \"demo\",
  \"operation\": \"DELETE\", \"resource\": {\"group\": \"\",
  \"resource\": \"secrets\", \"version\": \"v1\"}, \"uid\":
  \"748cdab2-1c1d-11ea-8b11-080027f8814d\", \"userInfo\": {\"groups\":
  [\"system:cluster-admins\", \"system:masters\",
  \"system:authenticated\"], \"username\": \"system:admin\"}</p>
</blockquote>

<p>The example in <a href="https://github.com/raffaelespazzoli/openshift-opa/blob/master/examples/authorization-webhooks/unreadable_secrets.rego" rel="nofollow noreferrer">https://github.com/raffaelespazzoli/openshift-opa/blob/master/examples/authorization-webhooks/unreadable_secrets.rego</a> uses the <strong>resource.spec</strong> object, but I don't think it's available in my <code>input/AdmissionReview</code> object?</p>

<p>I am using </p>

<ul>
<li>minishift 1.24 </li>
<li>openshift v3.9.0+2e78773-56 </li>
<li>kubernetes v1.9.1+a0ce1bc657 </li>
<li>etcd 3.2.16</li>
</ul>

<p>Admission control in Kubernetes does NOT let you control a <code>get</code>.  It only lets you control <code>create</code>, <code>update</code>, <code>delete</code>, and <code>connect</code>.  The API docs for the <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.17/#validatingwebhookconfiguration-v1-admissionregistration-k8s-io" rel="nofollow noreferrer">validating webhook</a> and its descendent RuleWithOperations (no handy link) don't make this clear, but the <a href="https://kubernetes.io/docs/reference/access-authn-authz/controlling-access/#admission-control" rel="nofollow noreferrer">docs introducing API access</a> state it explicitly. </p>

<p>To control <code>get</code>, you need to use <a href="https://kubernetes.io/docs/reference/access-authn-authz/controlling-access/#authorization" rel="nofollow noreferrer">authorization</a>.  You could use <a href="https://kubernetes.io/docs/reference/access-authn-authz/rbac/" rel="nofollow noreferrer">RBAC</a> to restrict who can <code>get</code> any of the <code>Secret</code>s.  To use OPA for authorization you would need the <a href="https://kubernetes.io/docs/reference/access-authn-authz/authorization/#authorization-modules" rel="nofollow noreferrer">authorization webhook mode</a>.</p>

<p>In Andrew's code that you link to, he is using an authorization webhook--not an admission control webhook.  That's why some of the data he is using from <code>input</code> isn't the same as what you see from an admission control webhook.  Taking a quick look at his writeup, it seems you need to follow his instructions to <a href="https://github.com/raffaelespazzoli/openshift-opa#enable-authorization" rel="nofollow noreferrer">Enable Authorization</a>. </p>
