OP-24522: Feature Implementation Pipeline Runtime Policies direct with OPA

[sudhakaropsmx]

https://devopsmx.atlassian.net/browse/OP-24522

Sample configuration for OPA and runtime policies in orca-local.yml

policy:
  opa:
    enabled: true
    url: http://oes-sapor:8085/
    runtimeUrl: http://opa:8181/ # RUN OPA policy check
    runtime:   # RUN OPA policy check
      enabled: false
      policies:
        - name: test                # RUN OPA policy check
          packageName: testopa      # RUN OPA policy check
    manualjudgment:
      enabled: true
      policies:
        - name: test                # RUN OPA policy check
          packageName: testmj    # RUN OPA policy check
    failOpen:
      enabled: false
      timeout: 10

Plugin Conguration in orca-local.yml

spinnaker:
  extensibility:
    plugins:
      Opsmx.PipelineRuntimePolicyPlugin:    # RUN OPA policy check
        enabled: true
        version: 1.0.3
    repositories:
      opsmx-repo:
        url: https://raw.githubusercontent.com/OpsMx/spinnakerPluginRepository/refs/heads/wu-pipeline-policy-validate/plugins.json

[yugaa22]

package testmj

default allow = false

deny[msg] {
    stage := input.pipeline.stages[_]
    stage.type == "manualJudgment"

    trigger_user := input.pipeline.trigger.user
    modified_by := stage.context.lastModifiedBy

    trigger_user == modified_by

    msg := sprintf("Approval denied: trigger user '%s' cannot approve manual judgment they modified.", [trigger_user])
}

allow {
    count(deny) == 0
}

sample OPA code tested and working

[emanipravallika]

Approved