Added OPA equivalent of Inspec

opa-exec.sh

@@ -0,0 +1,6 @@
+
+
+/opt/terraform plan -out tf.binary
+/opt/terraform show -json tf.binary > tfplan.json
+./opa eval --format pretty --data terraform.rego --input tfplan.json "data.terraform.assurance.gke.authz"
+

terraform.rego

@@ -0,0 +1,78 @@
+package terraform.assurance.gke
+
+import input as tfplan
+
+default authz = false
+
+authz {
+  control_pl_gke_c_31
+  control_pl_gke_c_53
+  control_pl_gke_c_54
+}
+
+CIDR_REGEX = `^([0-9]{1,3}\.){3}[0-9]{1,3}(\/([0-9]|[1-2][0-9]|3[0-2]))?$`
+AU_REGION = "australia-southeast1" 
+
+base_path = tfplan.planned_values.outputs
+
+#  @control 'PL.GKE.C-31'
+#  @impact 1.0
+#  @tag "CIS GKE 6.6.7"
+#  @title 'Network policy must be enabled'
+#  @desc 'Network policy must be enabled to control pod to pod communication.'
+control_pl_gke_c_31 {
+  network_policy_enabled
+  not network_policy_config_disabled  
+}
+
+network_policy_enabled {
+  base_path.gke_network_policy.value
+}
+
+network_policy_config_disabled {
+  base_path.gke_network_policy_config.value
+}
+
+# @control 'PL.GKE.C-53' do
+# @impact 1.0
+# @tag "CIS GKE 6.6.4"
+# @title 'Ensure private nodes and private control plane access only'
+# @desc 'Cluster must be have private endpoints, nodes and a specified master cidr.'
+control_pl_gke_c_53 {
+  private_endpoint_enabled
+  private_nodes_enabled
+  master_cidr_block_defined
+}
+
+private_endpoint_enabled {
+  base_path.gke_private_endpoint.value
+} 
+
+private_nodes_enabled {
+  base_path.gke_private_nodes.value
+}
+
+master_cidr_block_defined {
+  re_match(CIDR_REGEX, 
+    base_path.gke_master_cidr_block.value)
+}
+
+# @control 'PL.GKE.C-54' do
+# @impact 1.0
+# @title 'Region containment to AU'
+# @desc 'Region for the cluster and all associated node pools must be AU based.'
+control_pl_gke_c_54 {
+  au_cluster_location
+  au_nodepool_locations
+}
+
+au_cluster_location {
+  base_path.gke_location.value == AU_REGION
+}
+
+au_nodepool_locations = all {
+  all := [ loc | 
+    loc:= base_path.nps_locations[_]
+    loc == AU_REGION
+  ]
+}