Skip to content

Commit

Permalink
Rename to opa-docker-authz and bump version
Browse files Browse the repository at this point in the history
Also, set TLS configuration to nil when starting the Docker SDK. The API was
updated since the last release.
  • Loading branch information
tsandall committed Dec 6, 2016
1 parent bd1cca8 commit aa801ba
Show file tree
Hide file tree
Showing 3 changed files with 13 additions and 12 deletions.
2 changes: 1 addition & 1 deletion .gitignore
Original file line number Diff line number Diff line change
Expand Up @@ -2,4 +2,4 @@
/.vscode

# Build output
/docker-authz-plugin
/opa-docker-authz
16 changes: 8 additions & 8 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# Docker Authorization Plugin
# opa-docker-authz

This project is used to show how OPA can help policy-enable an existing service.

Expand All @@ -13,37 +13,37 @@ See the [detailed example](http://www.openpolicyagent.org/examples/docker-author
To build the plugin, just run:

$ go get ./...
$ go build -o docker-authz-plugin
$ go build -o opa-docker-authz

This assumes you are running on Linux and have Go 1.6 or later on your machine. You must have $GOPATH set.

If you are running on OS X and want to cross compile for Linux, you can do so as follows:

$ docker run -it --rm -v $PWD:/go/src/github.com/open-policy-agent/docker-authz-plugin golang:1.6 bash
$ cd /go/src/github.com/open-policy-agent/docker-authz-plugin/
$ docker run -it --rm -v $PWD:/go/src/github.com/open-policy-agent/opa-docker-authz golang:1.6 bash
$ cd /go/src/github.com/open-policy-agent/opa-docker-authz/
$ go get ./...
$ go build -o docker-authz-plugin
$ go build -o opa-docker-authz
$ exit

### Install

The plugin can be started with no options. It may require sudo depending on your machine's Docker configuration permissions:

$ docker-authz-plugin
$ opa-docker-authz

- By default, the plugin will listen for requests (from Docker) on :8080 and contacts OPA on :8181.

The following command line argument enables the authorization plugin within Docker:

--authorization-plugin=docker-authz-plugin
--authorization-plugin=opa-docker-authz

On Ubuntu 16.04 this is done by overriding systemd configuration (requires root):

$ sudo mkdir -p /etc/systemd/system/docker.service.d
$ sudo tee -a /etc/systemd/system/docker.service.d/override.conf > /dev/null <<EOF
[Service]
ExecStart=
ExecStart=/usr/bin/docker daemon -H fd:// --authorization-plugin=docker-authz-plugin
ExecStart=/usr/bin/docker daemon -H fd:// --authorization-plugin=opa-docker-authz
EOF
$ sudo systemctl daemon-reload
$ sudo service docker restart
Expand Down
7 changes: 4 additions & 3 deletions main.go
Original file line number Diff line number Diff line change
Expand Up @@ -181,13 +181,13 @@ func QueryDataAPI(opaURL string, doc string, r authorization.Request) (*http.Res
}

const (
version = "0.1.1"
version = "0.1.2"
)

func main() {

bindAddr := flag.String("bind-addr", ":8080", "sets the address the plugin will bind to")
pluginName := flag.String("plugin-name", "docker-authz-plugin", "sets the plugin name that will be registered with Docker")
pluginName := flag.String("plugin-name", "opa-docker-authz", "sets the plugin name that will be registered with Docker")
opaURL := flag.String("opa-url", "http://localhost:8181/v1", "sets the base URL of OPA's HTTP API")
policyFile := flag.String("policy-file", "", "sets the path of the policy file to load")
vers := flag.Bool("version", false, "print the version of the plugin")
Expand Down Expand Up @@ -216,7 +216,8 @@ func main() {

fmt.Println("Starting server.")

if err := h.ServeTCP(*pluginName, *bindAddr); err != nil {
// No TLS configuration given for now.
if err := h.ServeTCP(*pluginName, *bindAddr, nil); err != nil {
fmt.Println("Error while serving HTTP:", err)
os.Exit(1)
}
Expand Down

0 comments on commit aa801ba

Please sign in to comment.