https://openpolicycontainers.com/assets/js/ff240f05.8a9ca186.js

1"use strict";(self.webpackChunkopcr_website=self.webpackChunkopcr_website||[]).push([[5005],{3905:(e,t,o)=>{o.d(t,{Zo:()=>s,kt:()=>m});var n=o(7294);function r(e,t,o){return t in e?Object.defineProperty(e,t,{value:o,enumerable:!0,configurable:!0,writable:!0}):e[t]=o,e}function i(e,t){var o=Object.keys(e);if(Object.getOwnPropertySymbols){var n=Object.getOwnPropertySymbols(e);t&&(n=n.filter((function(t){return Object.getOwnPropertyDescriptor(e,t).enumerable}))),o.push.apply(o,n)}return o}function a(e){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{};t%2?i(Object(o),!0).forEach((function(t){r(e,t,o[t])})):Object.getOwnPropertyDescriptors?Object.defineProperties(e,Object.getOwnPropertyDescriptors(o)):i(Object(o)).forEach((function(t){Object.defineProperty(e,t,Object.getOwnPropertyDescriptor(o,t))}))}return e}function l(e,t){if(null==e)return{};var o,n,r=function(e,t){if(null==e)return{};var o,n,r={},i=Object.keys(e);for(n=0;n<i.length;n++)o=i[n],t.indexOf(o)>=0||(r[o]=e[o]);return r}(e,t);if(Object.getOwnPropertySymbols){var i=Object.getOwnPropertySymbols(e);for(n=0;n<i.length;n++)o=i[n],t.indexOf(o)>=0||Object.prototype.propertyIsEnumerable.call(e,o)&&(r[o]=e[o])}return r}var c=n.createContext({}),p=function(e){var t=n.useContext(c),o=t;return e&&(o="function"==typeof e?e(t):a(a({},t),e)),o},s=function(e){var t=p(e.components);return n.createElement(c.Provider,{value:t},e.children)},y="mdxType",u={inlineCode:"code",wrapper:function(e){var t=e.children;return n.createElement(n.Fragment,{},t)}},g=n.forwardRef((function(e,t){var o=e.components,r=e.mdxType,i=e.originalType,c=e.parentName,s=l(e,["components","mdxType","originalType","parentName"]),y=p(o),g=r,m=y["".concat(c,".").concat(g)]||y[g]||u[g]||i;return o?n.createElement(m,a(a({ref:t},s),{},{components:o})):n.createElement(m,a({ref:t},s))}));function m(e,t){var o=arguments,r=t&&t.mdxType;if("string"==typeof e||r){var i=o.length,a=new Array(i);a[0]=g;var l={};for(var c in t)hasOwnProperty.call(t,c)&&(l[c]=t[c]);l.originalType=e,l[y]="string"==typeof e?e:r,a[1]=l;for(var p=2;p<i;p++)a[p]=o[p];return n.createElement.apply(null,a)}return n.createElement.apply(null,o)}g.displayName="MDXCreateElement"},5534:(e,t,o)=>{o.r(t),o.d(t,{assets:()=>c,contentTitle:()=>a,default:()=>y,frontMatter:()=>i,metadata:()=>l,toc:()=>p});var n=o(3117),r=(o(7294),o(3905));const i={slug:"goodbye-open-policy-registry-hello-open-policy-containers",title:"Goodbye Open Policy Registry, Hello Open Policy Containers!",authors:["omri"],tags:["policy","opcr"]},a=void 0,l={permalink:"/blog/goodbye-open-policy-registry-hello-open-policy-containers",editUrl:"https://github.com/opcr-io/opcr-website/edit/main/blog/2022-12-29-goodbye-open-policy-registry-hello-open-policy-containers.md",source:"@site/blog/2022-12-29-goodbye-open-policy-registry-hello-open-policy-containers.md",title:"Goodbye Open Policy Registry, Hello Open Policy Containers!",description:"tl;dr: Open Policy Containers (OPCR) is now a CNCF Sandbox project, and it\u2019s time to sunset the Open Policy Registry!",date:"2022-12-29T00:00:00.000Z",formattedDate:"December 29, 2022",tags:[{label:"policy",permalink:"/blog/tags/policy"},{label:"opcr",permalink:"/blog/tags/opcr"}],readingTime:1.995,hasTruncateMarker:!1,authors:[{name:"Omri Gazitt",title:"CEO @ Aserto",url:"https://github.com/ogazitt",imageURL:"https://github.com/ogazitt.png",key:"omri"}],frontMatter:{slug:"goodbye-open-policy-registry-hello-open-policy-containers",title:"Goodbye Open Policy Registry, Hello Open Policy Containers!",authors:["omri"],tags:["policy","opcr"]},nextItem:{title:"OPA natively consumes OCI images",permalink:"/blog/opa-consumes-oci-images"}},c={authorsImageUrls:[void 0]},p=[{value:"Context",id:"context",level:2},{value:"Progress",id:"progress",level:2},{value:"Migration plan",id:"migration-plan",level:2},{value:"Conclusion",id:"conclusion",level:2}],s={toc:p};function y(e){let{components:t,...o}=e;return(0,r.kt)("wrapper",(0,n.Z)({},s,o,{components:t,mdxType:"MDXLayout"}),(0,r.kt)("p",null,(0,r.kt)("strong",{parentName:"p"},"tl;dr"),": ",(0,r.kt)("a",{parentName:"p",href:"https://www.openpolicycontainers.com"},"Open Policy Containers")," (OPCR) is now a ",(0,r.kt)("a",{parentName:"p",href:"https://landscape.cncf.io/?selected=open-policy-containers"},"CNCF Sandbox project"),", and it\u2019s time to sunset the Open Policy Registry!"),(0,r.kt)("h2",{id:"context"},"Context"),(0,r.kt)("p",null,"A little over a year ago, we created the OPCR project to bridge the gap between ",(0,r.kt)("a",{parentName:"p",href:"https://www.openpolicyagent.org"},"Open Policy Agent")," and the ",(0,r.kt)("a",{parentName:"p",href:"https://opencontainers.org"},"Open Container Initiative"),". We wanted to be able to build OPA policies into immutable images, which can be tagged, versioned, and signed just like any OCI image."),(0,r.kt)("p",null,"OPCR consisted of three initiatives:"),(0,r.kt)("ul",null,(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://github.com/opcr-io/policy"},"policy"),", an open source CLI modeled after docker, that can build, tag, push, and pull policy images"),(0,r.kt)("li",{parentName:"ul"},(0,r.kt)("a",{parentName:"li",href:"https://www.openpolicyregistry.io"},"Open Policy Registry"),", a container registry which could function as the \u201creference implementation\u201d of a policy registry"),(0,r.kt)("li",{parentName:"ul"},"Upstream work in the OPA project which allows OPA to consume policy images from any OCI-compliant registry (including the Open Policy Registry)")),(0,r.kt)("h2",{id:"progress"},"Progress"),(0,r.kt)("p",null,"We\u2019re excited to report that in December 2022, the CNCF has accepted OPCR, and specifically the policy CLI, as a ",(0,r.kt)("a",{parentName:"p",href:"https://landscape.cncf.io/?selected=open-policy-containers"},"Sandbox project"),"! \u2705"),(0,r.kt)("p",null,"Back in May 2022, the OPA project accepted our ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/open-policy-agent/opa/pull/4558"},"contribution")," of (3), and now OPA can natively consume images built with the policy CLI! \u2705 \u2705"),(0,r.kt)("p",null,"Finally, as more registries have added supp

1ort for OCI v2 artifacts, including AWS ECR, Docker Hub, GitHub Container Registry, and Google Container Registry, we decided that maintaining a purpose-built registry for policy images is no longer necessary."),(0,r.kt)("p",null,"Therefore, we\u2019re planning on retiring the Open Policy Registry (currently hosted at opcr.io) on January 31, 2023."),(0,r.kt)("h2",{id:"migration-plan"},"Migration plan"),(0,r.kt)("p",null,"The ",(0,r.kt)("a",{parentName:"p",href:"https://opcr.io"},"opcr.io")," domain, as well as the github opcr-io organization, will transfer to the CNCF, and will host the Open Policy Containers project (now focused entirely on the policy CLI)."),(0,r.kt)("p",null,"Moving from opcr.io to gcr.io, ghcr.io, or any other OCI v2-compliant container registry is straightforward - please reach out to us in the community slack if you need any help!"),(0,r.kt)("p",null,"For example, to move your content from opcr.io to ghcr.io:\xa0"),(0,r.kt)("pre",null,(0,r.kt)("code",{parentName:"pre",className:"language-bash"},"echo $PAT | policy login -s ghcr.io -u <username> -\u2013password-stdin\npolicy pull opcr.io/<account>/<policy-name>:<tag>\npolicy tag opcr.io/<account>/<policy-name>:<tag> ghcr.io/<account>/<policy-name>:<tag>\npolicy push ghcr.io/<account>/<policy-name>:<tag>\n")),(0,r.kt)("p",null,"For Aserto users, we will continue to maintain the Aserto Policy Registry (registry.prod.aserto.com), and you can continue to use the policy CLI with that registry."),(0,r.kt)("h2",{id:"conclusion"},"Conclusion"),(0,r.kt)("p",null,"We're excited how far we've come over the last year in getting OPA to natively consume policies packaged as OCI images. If you have any feedback or requests, don't hesitate to open an ",(0,r.kt)("a",{parentName:"p",href:"https://github.com/opcr-io/policy/issues/new"},"issue"),"!"),(0,r.kt)("img",{src:"/img/opcr.svg",alt:"opcr",width:"200"}))}y.isMDXComponent=!0}}]);