feat: init commit

crates/burrego/examples/gatekeeper/Makefile

@@ -0,0 +1,12 @@
+SOURCES=$(shell find . -name "*.rego")
+OBJECTS=$(SOURCES:%.rego=%.wasm)
+
+all: $(OBJECTS)
+
+%.wasm: %.rego
+	opa build -t wasm -e policy/violation -o $*.tar.gz $<
+	tar -xf $*.tar.gz --transform "s|policy.wasm|$*.wasm|" /policy.wasm
+	rm $*.tar.gz
+
+clean:
+	rm -f *.wasm *.tar.gz

crates/burrego/examples/gatekeeper/accept-in-namespaces.rego

@@ -0,0 +1,8 @@
+package policy
+
+violation[{"msg": msg}] {
+	object_namespace := input.review.object.metadata.namespace
+	satisfied := [allowed_namespace | namespace = input.parameters.allowed_namespaces[_]; allowed_namespace = object_namespace == namespace]
+	not any(satisfied)
+	msg := sprintf("object created under an invalid namespace %s; allowed namespaces are %v", [object_namespace, input.parameters.allowed_namespaces])
+}

crates/burrego/examples/gatekeeper/always-accept.rego

@@ -0,0 +1,6 @@
+package policy
+
+violation[{"msg": msg}] {
+	false
+	msg := ""
+}

crates/burrego/examples/gatekeeper/always-reject.rego

@@ -0,0 +1,5 @@
+package policy
+
+violation[{"msg": msg}] {
+	msg := "this is not allowed"
+}