Skip to main content

Creating a Policy

Policies are authored in a declarative language called Rego. You can get started quickly by using a template.

Templates

To list the available templates, use the policy templates list command:

policy templates list

Fetching templates .

NAME KIND DESCRIPTION
github cicd GitHub policy CI/CD template.
gitlab cicd GitLab policy CI/CD template.
policy-template policy Minimal policy template.

Applying a policy template

To create a new policy, use the policy templates apply command:

policy templates apply policy-template

Processing template 'policy-template' .

Generating files

The template 'policy-template' was created successfully.

This will generate a minimal "hello world" policy.

tree -a .
.
├── README.md
└── src
├── .manifest
└── policies
└── hello-rego.rego

2 directories, 3 files

You can create a git repository for these files by using git init.

Adding a CI template

To add GitHub or GitLab CI to the repository, apply a CI template. Note that the defaults are supplied if you've already done a policy login to log in to a registry, and made it your default policy registry.

policy templates apply github

Processing template 'github' .

# SERVER
1 ghcr.io

> Select server#: 1

> server (ghcr.io):

> user (ogazitt):

> secret name (TOKEN):

> org/repo: ogazitt/policy-template

Generating files .

The template 'github' was created successfully.

This command generates a GitHub workflow to build, tag, and push a policy image based on a new tag event that is pushed to GitHub.

tree .github
.github
├── config.yaml
└── workflows
└── build-release-policy.yaml

1 directory, 2 files

The .github/config.yaml file contains the parameters to the workflow:

server: ghcr.io
username: ogazitt
repo: ogazitt/policy-template

The secret name that was provided (by default, TOKEN) refers to a GitHub secret that contains a key (e.g. a PAT with the correct scopes) to push the built, tagged image to the policy registry.

For example, for ghcr.io, the PAT needs to have the repo and write:packages scopes.

For the Aserto Policy Registry, this should be the API key that can be found in the Console under the Aserto Policy Registry connection.

Automated policy-as-code workflow

You now have a policy-as-code workflow - simply make changes in the policy, commit and tag a release, push the tags, and your policy image will be built, tagged, and pushed to the registry you configured.

Manual workflow

You can also use the policy CLI to manually build, tag and push the policy to a policy registry.