Clarification of inspect to create OPA policy

[jimmyraywv]

So, if I run: kubectl advise-policy inspect --OPADefaultRule > opa-psp.rego in a ns with multiple service accounts and multiple applied PSPs, I seem to get an OPA policy that reflects the aggregate of all the rules specified in all the PSPs within the target ns. Is that correct? Is there a way to target a specific PSP and generate an OPA policy from it, with this tool?

[darryk10]

Hi,
Thanks for the question. The tool is actually checking the env for the specific ns and generate PSP or OPA policies. It isn't evaluating the PSPs already deployed and convert those PSPs in OPAs but it's generating the OPA policy based on the env directly. So at the moment there isn't the feature to translate a specific PSP to OPA in this tool. However this could be a feature for the future.
Thanks