Configure kata-agent to read policy from /run/peerpod/policy.rego

yousef-cohere · yousef-cohere · commit bcbe1bdfd982 · 2026-03-26T13:01:53.000-04:00
Without an explicit policy_file, kata-agent falls back to
/etc/kata-opa/default-policy.rego and ignores the initdata-provided
policy written by process-user-data. The tmpfiles rule already seeds
/run/peerpod/policy.rego with allow-all.rego at boot, and
process-user-data overwrites it when cc_init_data is present.

Made-with: Cursor
diff --git a/src/cloud-api-adaptor/podvm/files/etc/agent-config.toml b/src/cloud-api-adaptor/podvm/files/etc/agent-config.toml
@@ -1,2 +1,3 @@
 server_addr = "unix:///run/kata-containers/agent.sock"
 guest_components_procs = "none"
+policy_file = "/run/peerpod/policy.rego"

Original file line number	Diff line number	Diff line change
`@@ -1,2 +1,3 @@`
`1`	`1`	`server_addr = "unix:///run/kata-containers/agent.sock"`
`2`	`2`	`guest_components_procs = "none"`
	`3`	`+policy_file = "/run/peerpod/policy.rego"`