Questions tagged [opa]

Opa is an open source programming language for both backend and frontend web development. Opa therefore provides a unified syntax and semantics for writing all aspects of a web application: client-side, server-side and database queries. But it’s not only about expressiveness: Opa also features a unique type system that provides strong static typing from the client UI to the MongoDB queries.

Filter by
Sorted by
Tagged with
0 votes
0 answers
14 views

Validate tags using rego

I'm trying to validate the input tags against the standard tags defined by our team. A tag is a key-value pair which we are assigning to a cloud resources, for example, in case of AWS cloud, EC2 ...
Yogesh Jilhawar's user avatar
0 votes
0 answers
5 views

REGO policy failing because variable is unsafe

Im exploring the use of OPA for a project whereby I need to validate some of the contents of JWT. However when I use this expression I get an unsafe error: config := payload[1].main-application....
user1513388's user avatar
  • 7,177
0 votes
0 answers
17 views

Transform a input json to { "Name": ["John Doe"], "Email": ["[email protected]"],"Address": ["123 Willow Dr, San Jose, CA"]}

How Do i transform this line from { "Name": ["John Doe"], "Email": ["[email protected]"],"Address": ["123 Willow Dr, San Jose, CA"]} to ...
raj ramalingam's user avatar
0 votes
2 answers
22 views

Rego: how to merge objects set values

How can I merge the values of an object in rego (set type) into a single set containing all the object values ? This is my input object : input_data = { "1": { "bob": {"...
navi's user avatar
  • 1
0 votes
0 answers
24 views

How to compile rego file into WASM using Java?

Is there a way to compile the rego file used by OPA into WASM using Java? Currently I'm using the following command to compile a rego policy into WASM and bundling it with data into a gz file ./opa ...
Bhaskar's user avatar
0 votes
0 answers
25 views

Using OPA Gatekeeper Mutating Webhooks to remove a sidecar container

We have a third-party component we install in our cluster, which (after a series of hoops irrelevant to this question have been jumped through) creates StatefulSets. These StatefulSets are configured ...
Tomas Aschan's user avatar
  • 58.7k
0 votes
0 answers
13 views

Supplying secrets to a rego Gatekeeper policy when doing an http.send() call?

The documentation here explains how the http.send() method can be used to make GET requests to external data sources. However for calls to internal sources the request would require a token of some ...
Beembo's user avatar
  • 307
1 vote
0 answers
13 views

OPA Gatekeeper: match everything

In OPA Gatekeeper, is there a configuration for spec.match.kinds in a constraint to match everything? I've tried using a bunch of combinations, like this a one: ... spec: match: kinds: - ...
Felipe Sierra's user avatar
0 votes
0 answers
37 views

x509: certificate is not valid for any names, but wanted to match admission-controller.opa-istio.svc

I m trying to enable mTLS in STRICT mode in Istio on my cluster with OPA, but when I try to create a pod, I m getting error: Error from server (InternalError): Internal error occurred: failed calling ...
jasiekkm's user avatar
1 vote
0 answers
36 views

Rego number of policies evaluated

I am trying to validate some policies using the /opa/rego package. The policies are evaluated as expected in this script. But, I also want to count the number of rules and the rule names evaluated as ...
santoshdts's user avatar
0 votes
0 answers
22 views

OPA List of objects - Finding two values in multiples objects within list

Due to limitations, I am using if/else blocks within OPA. I am writing control rules where it will fail all conditions and pass the remaining. I have a list of extensions (objects) where each object ...
Dalton Lu's user avatar
0 votes
1 answer
75 views

How to import policies from different files

This could potentially be a duplicate of this post but I'm still having real trouble. I have a function defined in one file. A.rego package authorizer default username := null decode_user(jwt) := ...
equatorial_daydreamer's user avatar
0 votes
1 answer
19 views

OPA REGO deconstructing nested array

I got data something like this: { "TENANT1":{ <-- Multiple tenants "SITE1":{ <-- Every tenant can have multiple sites "SITE1_DEVICE1":[ <-- Every ...
Martin Hoang's user avatar
0 votes
0 answers
53 views

Error "Must not change a property before it has been read" only in OPA test

I have a UI to test that looks like this: I am trying to navigate to another view when user enters the value in description fields and presses save button. I have the following code: opaTest("...
Maliha 's user avatar
0 votes
1 answer
31 views

Why execution stops and false is returned (Open Policy Agent, Rego)

I want to implement complex validation but I don't have enough knowledge. This is how I imagine the rule to work in python: input_data = { "attributes": { "request": { ...
RubiniuM's user avatar
0 votes
0 answers
35 views

Why do I get rego_unsafe_var_error in the rego playground trying to follow the rego documentation?

I am at the Variables section of the documentation ( https://www.openpolicyagent.org/docs/latest/policy-language/#variables) trying to make q[x] work in the rego playground - https://play....
mark's user avatar
  • 59.2k
1 vote
1 answer
126 views

Getting Error: undefined: rego.ReadFile while trying to read rego file

While I was trying to compile the code, getting below error. I have imported "github.com/open-policy-agent/opa/rego" but still getting the error. -bash-4.2$ go build main.go # command-line-...
van neilsen's user avatar
1 vote
1 answer
74 views

Cannot load github.com/open-policy-agent/opa/capabilities: no Go source files

I was trying to install the OPA library using command go get github.com/open-policy-agent/opa/rego but installation is getting stuck with message build github.com/open-policy-agent/opa/capabilities: ...
van neilsen's user avatar
0 votes
0 answers
26 views

OPA & Istio - create basic example with different image?

This quick start is awesome - works great and gives a good example of using OPA and Istio: https://www.openpolicyagent.org/docs/latest/envoy-tutorial-istio/ If I use the same steps but instead copy ...
Mario's user avatar
  • 3,405
0 votes
0 answers
79 views

How to send OPA Decision Logs to OpenTelemetry

I would like to send all the Decision Logs from an OPA server to AWS CloudWatch, using an OpenTelemetry collector. Is there any support for this in the Open Policy Agent, or are there any examples of ...
user6131697's user avatar
1 vote
1 answer
117 views

OPA Gatekeeper Policy to block priviliged Pods

Since 2 days I try to create a simple OPA Gatekeeper Policy which blocks the creation of pods with "privileged:true" for some namespaces. Some more details: Im using opa-gatekeeper in ...
Christian K.'s user avatar
2 votes
1 answer
667 views

OPA giving error "rego_parse_error: var cannot be used for rule name"

I have a simple rego file like this: package example default isApplicable := false isApplicable if { timeNow := time.now_ns() timeNow >= input.startDatetime } and I keep getting parse ...
rsc's user avatar
  • 10.4k
1 vote
0 answers
84 views

How to debug and fix "SSL handshake failed" for Kafka broker in docker-compose?

ULTIMATE GOAL: I make a research trying to understand how Kafka and OPA Plugin integrated between each other and how easy it will be to use OPA Plugin in production. STEPS: I followed OPA Policy Agent ...
Dmytro Chasovskyi's user avatar
0 votes
1 answer
66 views

OPA doesn't find key if its value is false

I have noticed that if a certain key has false as a value, OPA ignores it. Take this policy code: package play violation[{"msg": msg}] { provided := {context | input.securityContext[...
fardin's user avatar
  • 1,399
0 votes
0 answers
227 views

How to write a while loop in Rego in OPA

I have a requirement to write a Rego policy that expands an object and build a new one, after referring a data source. Input comes with { "users": { "userid1": { "...
Pushpalanka's user avatar
0 votes
0 answers
66 views

How to verify a cosign keyless signed image in OPA rego rules?

I need verify an keyless signed [using google mail] image in Tekton pipelies using OPA rego rules as task and download .sig file from the repository and varify the image. I am new to Open policy agent,...
Pradeep Goru's user avatar
0 votes
0 answers
70 views

Envoy websocket with OPA

Verify the authorization for every message on websocket using Envoy and OPA. I am trying to do a use case where I have a websocket. The ideia is create a websocket passing in Envoy and authorize the ...
khennedy bacule's user avatar
0 votes
0 answers
35 views

Rego Policy to ensure an efs_file_system has a back up policy in terraform

i’m trying to write an OPA rego policy that ensures that an aws efs_file_system has an associated back up policy in terraform. My thought process is that I would do a list comprehension to cycle ...
just-another-dev's user avatar
0 votes
1 answer
146 views

Opa eval command line - always evaluates to false

Attempting to evaluate opa via command line but for some reason the evaluation output is always set to false. In this case, the rego policy is just validating the input checking if the RoleID has ...
Yehuda Yefet's user avatar
1 vote
1 answer
201 views

How do I merge array of duplicated object with OPA Rego rule

I have written a OPA policy that creates the following output: [ { "permission": [ "module:get", "workflow:get", "...
Swan2017's user avatar
0 votes
0 answers
105 views

Extract a regex capturing group with rego

I'm trying to build a rule based file access "engine", that evaluates whether a service is allowed to access a file or not via rego rules/data. Here's what I have so far data { "...
Dominik's user avatar
  • 1,633
0 votes
0 answers
71 views

How to parse filepath recursively Rego

Let's say I have a file id as /foo/bar/baz.txt. There might be access policies attached in any part of the hierarchy (on folders and individual files). Is there is a way that I can write a single ...
Pooya's user avatar
  • 1
0 votes
1 answer
41 views

Check if Array exists in OPA

I am struggling to write a policy that should check an element of an array but the array itself is optional. { "load_balancer":[{ "target_group_arn":true }] } deny[message]...
deals my's user avatar
  • 123
0 votes
0 answers
65 views

How do I check in "rego" that aws arn contains both valid bucket name and object name? One way is regex match , but its not giving me valid result

I am running as below : package play import future.keywords.if default hello := false arn_list := input.message hello if { regex.match("aws:arn:s3:::.*/*", arn_list) } arn_list is { "...
Awantika Singh's user avatar
0 votes
1 answer
84 views

how to control/sanitise Open Policy Agent (OPA) response

I have the following policy working just fine but its response feels a bit dirty. I am only interested in the allow and permissions keys. package example default allow = false getUserPermissions(...
Ahmed Ayoub's user avatar
0 votes
0 answers
31 views

how to create OPA contraints and templates for setting a warning message to the client if there is some label present

I would like to know how to create a OPA constraints and templates for having a warning message to the client for kubernetes label present in the kind: helmrelease. example: kustomize.toolkit.fluxcd....
John's user avatar
  • 1
0 votes
0 answers
36 views

Support multiple input data models (i.e. polyglot) while reusing the same policy in Open Policy Agent

Has the Rego community settled on some practices for reuse of policy rules while supporting different input data models? Problem Assume the same policy is to be enforced by two different PEP:s (Policy ...
Robert Gartman's user avatar
0 votes
1 answer
32 views

OPA server with input.method policy fails to allow simple correct request

I try to get an allow:true for POST request to an opa server, but I get always false no matter what method I use. This is the policy package learn.test import future.keywords.if default allow := ...
Andrei Toader's user avatar
0 votes
0 answers
107 views

REGA OPA don't add duplicate values to array

I am trying to do validations , some duplicate keys should not be available in yaml object, so when I am trying to add the values in array it behaves like set and removes the duplicates. I wanted to ...
Sushant Sharma's user avatar
1 vote
1 answer
384 views

Rego - Combine Values of Case Sensitive Keys from json like abc, ABc to single lowercase key abc

I've below json as an input: { "data": { "abc": 123, "Abc": 345, "bcd": 789 } } I want the result like: { "data": ...
Shivshankar Nagarsoge's user avatar
0 votes
0 answers
26 views

how to get keys from array of objects

I have this data in my input: "attributes" :[ {"subscribe_member.added_countryCode": ["FR"]}, {"subscribe_member.added_supplierId": ["0001&...
Romik romikromik's user avatar
0 votes
1 answer
559 views

OPA rego policy - pattern matching using valid regex not working

I'm using OPA to write an access policy to a microservice, and I'm now tackling the problem of matching an URL containing a path param. The URL follows the pattern: /v1/users/{uuid} I came up with the ...
João Simões's user avatar
1 vote
1 answer
549 views

Error validating webhook configuration yaml file when trying to setup OPA, using minikube

I am trying to setup OPA inside a minikube cluster. After deploying the admission-controller, i am trying to setup the webhook configuration, but failing to validate the yaml. Below is my Yaml code : ...
Rohan Bansal's user avatar
0 votes
1 answer
185 views

Rego policy for Kubernets label with /

I'm trying to write some Rego policies to enforce some company labels on our Kubernetes objects, and I'm struggling to get the right syntax for labels that have an additional slash (/) or periods (.) ...
NA Slacker's user avatar
0 votes
1 answer
212 views

Rego check env values file

I am a new in Rego. I have values file for helm template and want check that all envs (envmap or envNginxSocket, envPhpSocket, etc) in global section are in quotes. Example, REDIS_PORT: 6379 - value ...
unitrade's user avatar
0 votes
1 answer
388 views

How can I use OPA in server mode with dynamic data?

I have an event-based system where the input data changes with each event (it's a payload in the event). The rego rule(s) are static for our purposes. I run the server like this from command line: ./...
Greg's user avatar
  • 10.7k
1 vote
2 answers
266 views

OPA Rego - How to do tag or label matching

I have... List of tasks tagged with "must match" labels. User tagged with labels. Now I want to filter only the tasks that match all task-tags with user-tags(user may have extra tags). // ...
sriba's user avatar
  • 745
1 vote
1 answer
2k views

How to import different policies inside OPA rego policy?

I am working on writing new rego policies. I have few rules defined in single policy file which I want to break into sub policy and import it. Something like this: A.rego package com.example import ...
Ajay Kedare's user avatar
1 vote
2 answers
330 views

OPA: Mask sensitive data

I want to mask the password in my Open Policy Agent (OPA) logs. This is my input data: { "decision_id":"71e99093-b980-4c67-bd0c-87fcc071571a", "input":{ "...
flo-ferox's user avatar
  • 158
0 votes
1 answer
141 views

Traverse Json objects inside Arrays in Rego

I want to get the value of client_broker key and check if it is TLS or not ,if TLS the rego should pass else it will fail,but i am not able to traverse the nested json within the array element,tried ...
Samriddha Choudhuri's user avatar

1
2 3 4 5 6