apiVersion: v1
data:
  system-main.rego: |
    package system

    import data.kubernetes.pods
    import data.kubernetes.keys

    main = response

    default response = {
        "allowed": false,
        "status": {
            "reason": "No matching validations found",
        },
    }

    response = {
        "allowed": true,
        "status": {
            "reason": reason,
        },
    } {
        reason = concat(", ", allow)
        reason != ""
    }

    allow[msg]  {
      jwt_verified.verified = true
      pod_verified = true
      msg = "verified jwt"
    }

    constraints = {
      "iss": "https://kubernetes.default.svc",
      "aud": "athenz-identityd",
      "cert": keys.cert
    }

    jwt_verified = {
       "verified": valid,
       "header": header,
       "claims": claims
    } {
      io.jwt.decode_verify(input.attestationData, constraints, [valid, header, claims])
    }

    subject = split(jwt_verified.claims.sub, ":")
    pod_ns = subject[2]
    k8s_claims = jwt_verified.claims["kubernetes.io"]
    pod_name = k8s_claims.pod.name

    pod_verified = true {
        input.service = input.service
        input.service = k8s_claims.serviceaccount.name
        input.attributes.sanIP = pods[pod_ns][pod_name].status.podIP
        input.attributes.clientIP = pods[pod_ns][pod_name].status.podIP
        input.attributes.instanceId = pods[pod_ns][pod_name].metadata.uid
        pods[pod_ns][pod_name].metadata.namespace = k8s_claims.namespace
        pods[pod_ns][pod_name].metadata.uid = k8s_claims.pod.uid
        pods[pod_ns][pod_name].spec.serviceAccountName = k8s_claims.serviceaccount.name
    }
kind: ConfigMap
metadata:
  labels:
    openpolicyagent.org/policy: rego
  name: identity-validation.rego
