دليل عام

Gate Deploys with Hosted Rego Guardrails

Add a lightweight CI step that sends deploy context to your tenant and gets an allow, warn, or deny decision back without self-hosting OPA. الجمهور: Platform engineers, release managers, and security engineers. وقت الإعداد المعتاد: 10 minutes.

quickstart

استخدم هذا إذا

Add a lightweight CI step that sends deploy context to your tenant and gets an allow, warn, or deny decision back without self-hosting OPA.

الجمهور المستهدف: Platform engineers, release managers, and security engineersالوقت النموذجي: 10 minutes

قبل البدء

  • Install the managed starter pack in Policies and keep it in advisory mode for the first rollout.
  • Choose an enforcement point in Policies → Settings; the wizard creates the scoped credential.
  • Identify the service ID, target environment, artifact name, and branch values your deploy pipeline already exposes.

المسار السريع

انسخ إعداد البداية وقم بتشغيله في بيئتك، ثم عد إلى هنا للحصول على تفاصيل التوزيع الأكثر عمقًا.

Demonstration only

This configuration is designed for ease of use. To deploy scanner clients at scale, please plan your deployment architecture accordingly or contact us for enterprise best practices.

Get the source bundle

Download the exact source files referenced on this page, or run the one-command installer to write them locally before following the deployment steps.

GitHub Actions deploy gate

Writes `.github/workflows/deploy-guardrails.yml` with a hosted policy decision step that runs before production deploys.

.github/workflows/deploy-guardrails.yml
bash
BLACKSHIELD_POLICY_IMAGE=public.ecr.aws/blackshield-security/policy-client:1.0.12 \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/github-policy-guardrails.sh)
Download source

GitLab deploy gate job

Writes `.gitlab/deploy-guardrails.yml` with a reusable hosted policy decision job and the current platform API URL prefilled for production deployments.

.gitlab/deploy-guardrails.yml
bash
BLACKSHIELD_POLICY_IMAGE=public.ecr.aws/blackshield-security/policy-client:1.0.12 \
BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/gitlab-policy-guardrails.sh)
Download source

Kubernetes admission proxy

Installs the authenticated policy-client admission proxy, TLS service, and validating webhook using the immutable 1.0.9 image.

blackshield-policy namespace
bash
BLACKSHIELD_POLICY_IMAGE=public.ecr.aws/blackshield-security/policy-client:1.0.12 \
bash <(curl -fsSL https://blackshield.chaplau.com/source-bundles/kubernetes-policy-admission.sh)
Download source

نفّذ هذا

One-shot policy decision from any shell

bash
docker run --rm \
  -e BLACKSHIELD_API_URL=https://api.blackshield.chaplau.com \
  -e BLACKSHIELD_API_KEY=sp_xxxx \
  -e POLICY_SERVICE_ID=payment-gateway \
  -e POLICY_TARGET_ENVIRONMENT=prod \
  -e POLICY_REPOSITORY=acme/payment-gateway \
  -e POLICY_ARTIFACT=ghcr.io/acme/payment-gateway:${GIT_SHA:-latest} \
  -e POLICY_BRANCH=main \
  -e POLICY_CONTEXT_JSON='{"reviewer":"release-manager","change_ticket":"CAB-2026-0321"}' \
  public.ecr.aws/blackshield-security/policy-client:1.0.12

GitHub Actions deploy gate

yaml
- name: Evaluate hosted deploy guardrails
  run: |
    docker run --rm \
      -e BLACKSHIELD_API_URL="${{ vars.BLACKSHIELD_API_URL }}" \
      -e BLACKSHIELD_API_KEY="${{ secrets.BLACKSHIELD_API_KEY }}" \
      -e POLICY_SERVICE_ID="payment-gateway" \
      -e POLICY_TARGET_ENVIRONMENT="prod" \
      -e POLICY_REPOSITORY="${{ github.repository }}" \
      -e POLICY_ARTIFACT="ghcr.io/acme/payment-gateway:${{ github.sha }}" \
      -e POLICY_COMMIT_SHA="${{ github.sha }}" \
      -e POLICY_BRANCH="${{ github.ref_name }}" \
      -e POLICY_ACTOR="${{ github.actor }}" \
      -e POLICY_CONTEXT_JSON='{"reviewer":"${{ github.actor }}","pipeline":"deploy-production"}' \
      public.ecr.aws/blackshield-security/policy-client:1.0.12

GitLab CI deploy gate

yaml
deploy-guardrails:
  stage: deploy
  image: public.ecr.aws/blackshield-security/policy-client:1.0.12
  script:
    - python -m policy.entrypoint
  variables:
    BLACKSHIELD_API_URL: "https://api.blackshield.chaplau.com"
    # BLACKSHIELD_API_KEY: set in CI/CD -> Variables (masked)
    POLICY_SERVICE_ID: "payment-gateway"
    POLICY_TARGET_ENVIRONMENT: "prod"
    POLICY_REPOSITORY: "$CI_PROJECT_PATH"
    POLICY_ARTIFACT: "$CI_REGISTRY_IMAGE:$CI_COMMIT_SHA"
    POLICY_COMMIT_SHA: "$CI_COMMIT_SHA"
    POLICY_BRANCH: "$CI_COMMIT_REF_NAME"
    POLICY_ACTOR: "$GITLAB_USER_LOGIN"
    POLICY_CONTEXT_JSON: '{"reviewer":"$GITLAB_USER_LOGIN","pipeline":"deploy-production"}'

الفهم والتخصيص

استخدم الخطوات الإرشادية أدناه عندما ترغب في تخصيص التوزيع أو التحقق من الملكية أو توسيع النشر بأمان.

1

الخطوة 1

Install the managed starter pack in the tenant

Open the Policies console, keep the starter pack in advisory mode first, and tune thresholds before enforcing production blocks.

  • Open Policies in the dashboard and review Starter Deploy Guardrails.
  • Confirm environments, severity thresholds, freshness window, and fail-open or fail-closed behavior.
  • Run a simulation with a representative production payload before wiring CI.
  • Save at least one assertion and run all tests against the exact draft before publication.
  • Tenant Rego runs in disposable workers with source/test-size, timeout, memory, and concurrency limits.

معايير النجاح

Tenant Rego runs in disposable workers with source/test-size, timeout, memory, and concurrency limits.

Open Policies · تسجيل الدخول مطلوب
2

الخطوة 2

Connect an enforcement point

Use the managed integration wizard to create a ten-minute single-use bootstrap token. Its command creates and stores a policies:read key without exposing it in browser state or shell history.

  • Choose GitHub Actions, GitLab CI, Kubernetes admission, or generic REST in Policies → Settings.
  • Run the generated command on a machine where gh, glab, or kubectl is already authenticated.
  • Map service, environment, branch, artifact, and actor metadata from your pipeline variables.
  • Start with advisory rollout mode so warn outcomes surface without blocking releases.

معايير النجاح

Start with advisory rollout mode so warn outcomes surface without blocking releases.

Connect enforcement point · تسجيل الدخول مطلوب
3

الخطوة 3

Add the policy client job to your deploy pipeline

Run the policy client before the real deployment step. It posts the deploy request, prints reasons, and exits non-zero only when the final decision is deny.

  • Bootstrap the GitHub Actions or GitLab source bundle from this guide, then commit it to your repo.
  • Set `POLICY_SERVICE_ID`, `POLICY_TARGET_ENVIRONMENT`, and any optional repository or artifact fields.
  • Pass reviewer, ticket, or promotion metadata through `POLICY_CONTEXT_JSON` when your tenant policies expect it.
  • Place the job immediately before the production deploy so the decision reflects the current release candidate.

معايير النجاح

Place the job immediately before the production deploy so the decision reflects the current release candidate.

Deploy the Pipeline Scanner

معايير النجاح

  • The policy client returns `allow` or `warn` for a healthy sample deploy and exits with code 0.
  • A seeded or simulated high-risk release returns `deny` and blocks the deploy stage with clear reasons.
  • Decision history in Policies records the request summary, matched policies, and final outcome.

المتابعة

Keep your rollout moving with the next recommended step.

مراجعة النتائج وتحديد الأولويات
Gate Deploys with Hosted Rego Guardrails | BlackShield Docs