<p>I am new to opa and k8s, i dont have much knowledge or experience in this field. i would like to have policy in rego code (opa policy) and execute to see the result.
the following examples are:</p>

<ol>
<li>Always Pull Images - Ensure every container sets its ‘imagePullPolicy’ to ‘Always’</li>
<li>Check for Liveness Probe - Ensure every container sets a livenessProbe</li>
<li>Check for Readiness Probe - Ensure every container sets a readinessProbe</li>
</ol>

<p>for the following, i would like have an opa policy:</p>

<p>1.Always Pull Images:</p>

<pre><code>apiVersion: v1
kind: Pod
metadata:
  name: test-image-pull-policy
spec:
  containers:
    - name: nginx
      image: nginx:1.13
      imagePullPolicy: IfNotPresent
</code></pre>

<p>2.Check for Liveness Probe</p>

<p>3.Check for Readiness Probe </p>

<pre><code>containers:
- name: opa
  image: openpolicyagent/opa:latest
  ports:
  - name: http
    containerPort: 8181
  args:
  - "run"
  - "--ignore=.*"            # exclude hidden dirs created by Kubernetes
  - "--server"
  - "/policies"
  volumeMounts:
  - readOnly: true
    mountPath: /policies
    name: example-policy
  livenessProbe:
    httpGet:
      scheme: HTTP           # assumes OPA listens on localhost:8181
      port: 8181
    initialDelaySeconds: 5   # tune these periods for your environemnt
    periodSeconds: 5
  readinessProbe:
    httpGet:
      path: /health?bundle=true  # Include bundle activation in readiness
      scheme: HTTP
      port: 8181
    initialDelaySeconds: 5
    periodSeconds: 5
</code></pre>

<p>Is there any way to create the opa policy for the above conditions. Could any one help as i am new to opa. Thanks in advance.</p>

Keshav
<p>For the liveness and readiness probe checks, you can simply test if those fields are defined:</p>

<pre><code>package kubernetes.admission

deny["container is missing livenessProbe"] {
  container := input_container[_]
  not container.livenessProbe
}

deny["container is missing readinessProbe"] {
  container := input_container[_]
  not container.readinessProbe
}

input_container[container] {
  container := input.request.object.spec.containers[_]
}
</code></pre>
