39b21dcda5
Deploys openpolicyagent/opa:0.68.0 as a single-replica ClusterIP
service in the scobleclaw namespace, with a ConfigMap-mounted
policy bundle under /policies.
Policies (package scobleclaw):
_lib.rego shared deny rules (external email, forgejo
write outside marcus/engineering, payment
kamelets) + helpers (is_external_email,
is_payment_kamelet, is_forgejo_write_outside_allowed)
main-agent.rego 10-kamelet allowlist for main-agent
demo-concierge.rego read-only 4-kamelet allowlist
demo-watchdog.rego 4-kamelet allowlist (ob1 + discord)
L0 contract:
POST /v1/data/scobleclaw/allow -> {allow: bool}
POST /v1/data/scobleclaw/needs_l1 -> {needs_l1: bool}
POST /v1/data/scobleclaw/deny -> [reason, ...]
Verified end-to-end against the running OPA pod:
allow=true for main-agent + kamelet:source/forgejo-search
deny=[reason] for external email, forgejo write to stranger/not-mine,
payment kamelet (stripe-charge), demo-concierge forgejo-create
needs_l1=true for unknown kamelet (e.g. some-new-kamelet) on main-agent
needs_l1=false for payment kamelet (L1 cannot override L0 deny)
Out of scope (separate tickets): judge-integration Camel-K binding,
llm-classifier-integration (L1), discord-escalation-integration (L2),
audit-sink OPA log tailing.
21 lines
453 B
YAML
21 lines
453 B
YAML
---
|
|
# ClusterIP service exposing OPA at :8181. Cluster-internal only — the
|
|
# judge-integration (Camel-K) pods in the scobleclaw namespace will resolve
|
|
# `opa.scobleclaw.svc.cluster.local:8181`.
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
name: opa
|
|
namespace: scobleclaw
|
|
labels:
|
|
app: opa
|
|
component: l0-judge
|
|
spec:
|
|
type: ClusterIP
|
|
selector:
|
|
app: opa
|
|
ports:
|
|
- name: http
|
|
port: 8181
|
|
targetPort: http
|
|
protocol: TCP
|