235
questions
0
votes
0
answers
8
views
How to use 'or' in rego OPA
I have a list, and I want to check that every string in the list contains a substring, such as 'a' or 'b'.
allow {
every x in str_list {
contains(lower(x), 'a') or contains(lower(x), 'b')
}...
0
votes
0
answers
38
views
How can I check OPA memory usage with big file size?
I know that benchmarking in OPA shows memory usage as B/op. I want to see how much memory it takes up on actual memory when the file size of data.json is large + how much memory it consumes when ...
0
votes
0
answers
30
views
Validate after_unknown attribute with conftest/OPA
When I run the validation, conftest returns a Failure result because it's not validating with after_unknown attribute in JSON terraform plan.
If I move manually some attribute inside that block to ...
0
votes
0
answers
32
views
opal client is very slow
I'm using OPAL(Open Policy Administration Layer) .
OPAL is fetching rego files from gitlab and I have about 200 rego files in gitlab.
when opal-client is started, it has 4 minutes to start up the opal-...
1
vote
0
answers
40
views
OPA | Conftest incorrect parse yaml file
ResourceQuota object definition involves limits keys with dots and there is issue to get the value of the limits:
policy.rego
package main
deny_incorrect_memory_unit[msg] {
input.kind == "...
0
votes
0
answers
55
views
OPA multiple default rules error when loaded into config-map
I'm following OPA deployment to kubernetes article.
I try to load a different policy though, from the REGO playground. this is an official policy example so the syntax supposed to be impeccable.
Using ...
1
vote
1
answer
109
views
OPA Gatekeeper: match everything
In OPA Gatekeeper, is there a configuration for spec.match.kinds in a constraint to match everything?
I've tried using a bunch of combinations, like this a one:
...
spec:
match:
kinds:
- ...
2
votes
0
answers
631
views
x509: certificate is not valid for any names, but wanted to match admission-controller.opa-istio.svc
I m trying to enable mTLS in STRICT mode in Istio on my cluster with OPA, but when I try to create a pod, I m getting error:
Error from server (InternalError): Internal error occurred: failed calling ...
2
votes
1
answer
161
views
Cannot load github.com/open-policy-agent/opa/capabilities: no Go source files
I was trying to install the OPA library using command
go get github.com/open-policy-agent/opa/rego
but installation is getting stuck with message
build github.com/open-policy-agent/opa/capabilities: ...
2
votes
1
answer
505
views
OPA Gatekeeper Policy to block priviliged Pods
Since 2 days I try to create a simple OPA Gatekeeper Policy which blocks the creation of pods with "privileged:true" for some namespaces.
Some more details:
Im using opa-gatekeeper in ...
1
vote
0
answers
358
views
How to debug and fix "SSL handshake failed" for Kafka broker in docker-compose?
ULTIMATE GOAL:
I make a research trying to understand how Kafka and OPA Plugin integrated between each other and how easy it will be to use OPA Plugin in production.
STEPS:
I followed OPA Policy Agent ...
0
votes
1
answer
199
views
OPA doesn't find key if its value is false
I have noticed that if a certain key has false as a value, OPA ignores it. Take this policy code:
package play
violation[{"msg": msg}] {
provided := {context | input.securityContext[...
0
votes
1
answer
385
views
Opa eval command line - always evaluates to false
Attempting to evaluate opa via command line but for some reason the evaluation output is always set to false. In this case, the rego policy is just validating the input checking if the RoleID has ...
0
votes
1
answer
109
views
Check if Array exists in OPA
I am struggling to write a policy that should check an element of an array but the array itself is optional.
{
"load_balancer":[{
"target_group_arn":true
}]
}
deny[message]...
0
votes
1
answer
327
views
how to control/sanitise Open Policy Agent (OPA) response
I have the following policy working just fine but its response feels a bit dirty. I am only interested in the allow and permissions keys.
package example
default allow = false
getUserPermissions(...
0
votes
1
answer
95
views
OPA server with input.method policy fails to allow simple correct request
I try to get an allow:true for POST request to an opa server, but I get always false no matter what method I use.
This is the policy
package learn.test
import future.keywords.if
default allow := ...
1
vote
1
answer
856
views
Rego - Combine Values of Case Sensitive Keys from json like abc, ABc to single lowercase key abc
I've below json as an input:
{
"data": {
"abc": 123,
"Abc": 345,
"bcd": 789
}
}
I want the result like:
{
"data": ...
0
votes
1
answer
1k
views
OPA rego policy - pattern matching using valid regex not working
I'm using OPA to write an access policy to a microservice, and I'm now tackling the problem of matching an URL containing a path param.
The URL follows the pattern: /v1/users/{uuid}
I came up with the ...
1
vote
1
answer
1k
views
Error validating webhook configuration yaml file when trying to setup OPA, using minikube
I am trying to setup OPA inside a minikube cluster.
After deploying the admission-controller, i am trying to setup the webhook configuration, but failing to validate the yaml.
Below is my Yaml code :
...
0
votes
1
answer
367
views
Rego policy for Kubernets label with /
I'm trying to write some Rego policies to enforce some company labels on our Kubernetes objects, and I'm struggling to get the right syntax for labels that have an additional slash (/) or periods (.) ...
0
votes
1
answer
535
views
Rego check env values file
I am a new in Rego. I have values file for helm template and want check that all envs (envmap or envNginxSocket, envPhpSocket, etc) in global section are in quotes. Example, REDIS_PORT: 6379 - value ...
0
votes
1
answer
708
views
How can I use OPA in server mode with dynamic data?
I have an event-based system where the input data changes with each event (it's a payload in the event). The rego rule(s) are static for our purposes.
I run the server like this from command line:
./...
1
vote
2
answers
522
views
OPA Rego - How to do tag or label matching
I have...
List of tasks tagged with "must match" labels.
User tagged with labels.
Now I want to filter only the tasks that match all task-tags with user-tags(user may have extra tags).
// ...
2
votes
1
answer
4k
views
How to import different policies inside OPA rego policy?
I am working on writing new rego policies.
I have few rules defined in single policy file which I want to break into sub policy and import it.
Something like this:
A.rego
package com.example
import ...
1
vote
2
answers
749
views
OPA: Mask sensitive data
I want to mask the password in my Open Policy Agent (OPA) logs.
This is my input data:
{
"decision_id":"71e99093-b980-4c67-bd0c-87fcc071571a",
"input":{
"...
0
votes
1
answer
526
views
Traverse Json objects inside Arrays in Rego
I want to get the value of client_broker key and check if it is TLS or not ,if TLS the rego should pass else it will fail,but i am not able to traverse the nested json within the array element,tried ...
2
votes
0
answers
504
views
Rego based OPA Policy for restricting Argo CD applications being created in default Argo CD project is not working with Gatekeeper
Rego based OPA Policy for restricting Argo CD applications being created in default Argo CD project is not working with Gatekeeper. I have tried multiple combinations of api versions and kinds in the ...
0
votes
1
answer
225
views
Foreach loop to check a list for dupes
Literally looking to do the below pseudocode in Rego:
listA = {itemA, itemB, itemC}
listB = "items":
{
"item1": "value1",
"item2&...
0
votes
1
answer
362
views
Can this Rego policy be simplified
I have this Rego policy that I want to simplify (fewer lines of code) more if possible especially the two findings blocks. I tried but failed miserably given that I'm a Rego noob.
package test
...
0
votes
1
answer
162
views
How to detect illegal password handling in Terraform code using Open Policy Agent (OPA)?
I am creating RDS using Terraform by using a code that looks something like this:
data "aws_secretsmanager_secret_version" "creds" {
# Fill in the name you gave to your secret
...
2
votes
1
answer
2k
views
How can I use regex in rego for OPA to identify matching paths and allow or deny admission of pods?
I have below volumes.rego file that I want to use for OPA.
package kubernetes.admission
deny[msg] {
input.request.kind.kind == "Pod"
path := input.request.object.spec.volumes[_].nfs....
0
votes
1
answer
239
views
Sorting objects in Rego, based on multiple attributes
I'm trying to write some code in OPA Rego to sort a collection of objects based on the value of multiple attributes. I start with the objects in a dictionary as below and I'd like to sort the objects ...
1
vote
1
answer
820
views
Combining exit codes and 'defined' string return values from rules in Rego
I want to return a non-zero exit code when my policy fails so that my CI/CD buildspec stops building. I also want to return a string error message from my rule(s).
I noticed the --fail and --fail-...
0
votes
1
answer
1k
views
Determine why a rego test fails
new to Opa/rego. So, I have some rego test code
test_protected_allow {
test_token := test.create_test_token({
"audience": "https://whatever.companyname.com",
...
0
votes
1
answer
752
views
OPA glob pattern that excludes URL's that have a specific part in their path
I'm trying to write an OPA glob pattern that matches any URL path that does NOT have the string /special-part/{whatever}/callback in it, where {whatever} is a path parameter, and this path can ...
1
vote
0
answers
90
views
Can OPA be used in use-cases where the concurrency and throughput is very high?
I'm running OPA as a server(running on AWS) and I did couple of performance test,
For the first test I allocated 1 vCPU for the OPA container but for a concurrency of 100 I got a throughput of 2.5k ...
0
votes
1
answer
269
views
Multiple property rules
I must be missing the right words because I can not find how to create a rule that uses multiple properties of an object. I am trying to validate that "bob" has the action and resource in ...
0
votes
1
answer
2k
views
Specifying input.json file from another directory for use in opa test
I am new to opa/rego and have an opa test that I would like to run. Within that test .rego file, I would like to use an input.json file from a different directory. Is there a way to specify that file ...
0
votes
1
answer
1k
views
Rego: Set comprehension undefined
I am trying to understand why the following examples on using set comprehension give different results:
https://play.openpolicyagent.org/p/5x5mXmsyr0
https://play.openpolicyagent.org/p/IVQlTYcVpD
In ...
0
votes
1
answer
420
views
ProcessBuilder is not working correctly when I deploy my Spring boot Application to a Linux server
public void pushDataToOPA() throws IOException, InterruptedException {
ProcessBuilder pb = new ProcessBuilder("curl", "-X", "PUT", "-H", "\"...
1
vote
1
answer
4k
views
rego to check for existance of a field in an array
How could the existance of the "spec.rules.host" field in each item under "speck.rules" can be checked, in a way that if any of them do not have such entry, it would trigger a &...
2
votes
1
answer
5k
views
How to check if an array is empty in OPA Rego
I have an array which declare like this- arr = [].
I want to check it it's empty.
I tried: count(arr)==0, is_null(arr), arr==[] and arr=="".
0
votes
1
answer
3k
views
Rego function to define variables
For several rules, we need to define the same set of variables. In the example, these are "ns", "externaldns", "svc", "nssvc". How could we take these ...
1
vote
1
answer
1k
views
How to I combine the results of multiple rules
I have 3 roles and I am trying to return what actions a user can do based on the assigned roles.
Playground: https://play.openpolicyagent.org/p/5gN7ObojXh
The first part should check if the object ...
2
votes
0
answers
230
views
OPA Middleware with Dapr not invoking
I am unable to get the OPA middleware to execute on a service to service invocation.
I am using the simple OPA example online and cannot seem to get it to trigger when invoking it from another ...
0
votes
1
answer
1k
views
OPA rego policy to block access to kubernetes namespace
I am trying to write a policy that blocks permission for specific users to a list of specific kubernetes namespaces. This is what I have so far, it works for singular user/namespace but I need one ...
1
vote
1
answer
601
views
OPA test coverage schema?
What is the schema of the JSON returned by a call to opa test --coverage? And is there a tool I can use to create a human-friendly coverage report?
0
votes
1
answer
544
views
OPEN POLICY AGENT: Unable to download bundles from S3
I have set s3 related information as in config.yaml.This get call also returned 200 ok response.
GET call: https://s3.console.aws.amazon.com/s3/object/{bucket_name}/policy.tar.gz
But when download, it ...
1
vote
1
answer
733
views
OPA authorization policies with scopes and roles
I'm using Open Policy Agent as an authorization component together with OIDC enabled apps.
I have input from the apps in the format:
{
"token": {
"scopes": [
...
0
votes
2
answers
968
views
Is there any way to validate if input is passed in REGO language?
In REGO language how can we validate if an input exists?
I got one way to do this.
package play
default hello = false
hello {
input.message
}
But is this the right approach? Or is there a ...