# Agent Policy generation tool

The Kata Containers Policy generation tool (`genpolicy`):

1. Reads user's Kubernetes (`K8s`) `YAML` file.

1. Infers user's intentions based on the contents of that file.

1. Generates a Kata Containers Agent (`kata-agent`) Policy file corresponding to the input `YAML`, using the [Open Policy Agent format](https://www.openpolicyagent.org/docs/latest/policy-language/).

1. Encodes the auto-generated Policy text in base64 format and appends the encoded string as an annotation to user's `YAML` file.

When the user deploys that `YAML` file through `K8s`, the Kata Agent uses the Policy specified by the `YAML` annotation to reject possible Agent API calls that are not consistent with the policy. For additional information, see [How to use the Kata Agent Policy](../../../docs/how-to/how-to-use-the-kata-agent-policy.md).

The Policy auto-generated by `genpolicy` is typically used for implementing confidential containers, where the Kata Shim and the Kata Agent have different trust properties.

**Warning** Users should review carefully the automatically-generated Policy, and modify the Policy file if needed to match better their use case, before using this Policy.

# Building `genpolicy` from source code

Build in docker container:

```sh
$ git clone https://github.com/kata-containers/kata-containers.git
$ cd kata-containers
$ tools/packaging/kata-deploy/local-build/kata-deploy-binaries.sh --build=genpolicy
```

# Executing `genpolicy`

Example:

```sh
$ genpolicy -y test.yaml
```

For a usage statement, run:

```sh
$ genpolicy --help
```

For advanced command line parameters, see [`genpolicy` advanced command line parameters](genpolicy-advanced-command-line-parameters.md).


# Supported Kubernetes `YAML` file types

`genpolicy` has support for automatic Policy generation based on Kubernetes `DaemonSet`, `Deployment`, `Job`, `Pod`, `ReplicaSet`, `ReplicationController`, and `StatefulSet` input `YAML` files.

# Policy details

See [auto-generated Policy details](genpolicy-auto-generated-policy-details.md).
