Skip to main content
Filter by
Sorted by
Tagged with
0 votes
0 answers
8 views

How to use 'or' in rego OPA

I have a list, and I want to check that every string in the list contains a substring, such as 'a' or 'b'. allow { every x in str_list { contains(lower(x), 'a') or contains(lower(x), 'b') }...
Dean Taler's user avatar
0 votes
0 answers
38 views

How can I check OPA memory usage with big file size?

I know that benchmarking in OPA shows memory usage as B/op. I want to see how much memory it takes up on actual memory when the file size of data.json is large + how much memory it consumes when ...
이소민's user avatar
0 votes
0 answers
30 views

Validate after_unknown attribute with conftest/OPA

When I run the validation, conftest returns a Failure result because it's not validating with after_unknown attribute in JSON terraform plan. If I move manually some attribute inside that block to ...
mgg's user avatar
  • 341
0 votes
0 answers
32 views

opal client is very slow

I'm using OPAL(Open Policy Administration Layer) . OPAL is fetching rego files from gitlab and I have about 200 rego files in gitlab. when opal-client is started, it has 4 minutes to start up the opal-...
m-masa's user avatar
  • 238
1 vote
0 answers
40 views

OPA | Conftest incorrect parse yaml file

ResourceQuota object definition involves limits keys with dots and there is issue to get the value of the limits: policy.rego package main deny_incorrect_memory_unit[msg] { input.kind == "...
Kucharsky's user avatar
  • 253
0 votes
0 answers
55 views

OPA multiple default rules error when loaded into config-map

I'm following OPA deployment to kubernetes article. I try to load a different policy though, from the REGO playground. this is an official policy example so the syntax supposed to be impeccable. Using ...
Yaron's user avatar
  • 2,649
1 vote
1 answer
109 views

OPA Gatekeeper: match everything

In OPA Gatekeeper, is there a configuration for spec.match.kinds in a constraint to match everything? I've tried using a bunch of combinations, like this a one: ... spec: match: kinds: - ...
Felipe Sierra's user avatar
2 votes
0 answers
631 views

x509: certificate is not valid for any names, but wanted to match admission-controller.opa-istio.svc

I m trying to enable mTLS in STRICT mode in Istio on my cluster with OPA, but when I try to create a pod, I m getting error: Error from server (InternalError): Internal error occurred: failed calling ...
jasiekkm's user avatar
  • 103
2 votes
1 answer
161 views

Cannot load github.com/open-policy-agent/opa/capabilities: no Go source files

I was trying to install the OPA library using command go get github.com/open-policy-agent/opa/rego but installation is getting stuck with message build github.com/open-policy-agent/opa/capabilities: ...
van neilsen's user avatar
2 votes
1 answer
505 views

OPA Gatekeeper Policy to block priviliged Pods

Since 2 days I try to create a simple OPA Gatekeeper Policy which blocks the creation of pods with "privileged:true" for some namespaces. Some more details: Im using opa-gatekeeper in ...
Christian K.'s user avatar
1 vote
0 answers
358 views

How to debug and fix "SSL handshake failed" for Kafka broker in docker-compose?

ULTIMATE GOAL: I make a research trying to understand how Kafka and OPA Plugin integrated between each other and how easy it will be to use OPA Plugin in production. STEPS: I followed OPA Policy Agent ...
Dmytro Chasovskyi's user avatar
0 votes
1 answer
199 views

OPA doesn't find key if its value is false

I have noticed that if a certain key has false as a value, OPA ignores it. Take this policy code: package play violation[{"msg": msg}] { provided := {context | input.securityContext[...
fardin's user avatar
  • 1,479
0 votes
1 answer
385 views

Opa eval command line - always evaluates to false

Attempting to evaluate opa via command line but for some reason the evaluation output is always set to false. In this case, the rego policy is just validating the input checking if the RoleID has ...
Yehuda Yefet's user avatar
0 votes
1 answer
109 views

Check if Array exists in OPA

I am struggling to write a policy that should check an element of an array but the array itself is optional. { "load_balancer":[{ "target_group_arn":true }] } deny[message]...
deals my's user avatar
  • 133
0 votes
1 answer
327 views

how to control/sanitise Open Policy Agent (OPA) response

I have the following policy working just fine but its response feels a bit dirty. I am only interested in the allow and permissions keys. package example default allow = false getUserPermissions(...
Ahmed Ayoub's user avatar
0 votes
1 answer
95 views

OPA server with input.method policy fails to allow simple correct request

I try to get an allow:true for POST request to an opa server, but I get always false no matter what method I use. This is the policy package learn.test import future.keywords.if default allow := ...
Andrei Toader's user avatar
1 vote
1 answer
856 views

Rego - Combine Values of Case Sensitive Keys from json like abc, ABc to single lowercase key abc

I've below json as an input: { "data": { "abc": 123, "Abc": 345, "bcd": 789 } } I want the result like: { "data": ...
Shivshankar Nagarsoge's user avatar
0 votes
1 answer
1k views

OPA rego policy - pattern matching using valid regex not working

I'm using OPA to write an access policy to a microservice, and I'm now tackling the problem of matching an URL containing a path param. The URL follows the pattern: /v1/users/{uuid} I came up with the ...
João Simões's user avatar
1 vote
1 answer
1k views

Error validating webhook configuration yaml file when trying to setup OPA, using minikube

I am trying to setup OPA inside a minikube cluster. After deploying the admission-controller, i am trying to setup the webhook configuration, but failing to validate the yaml. Below is my Yaml code : ...
Rohan Bansal's user avatar
0 votes
1 answer
367 views

Rego policy for Kubernets label with /

I'm trying to write some Rego policies to enforce some company labels on our Kubernetes objects, and I'm struggling to get the right syntax for labels that have an additional slash (/) or periods (.) ...
NA Slacker's user avatar
0 votes
1 answer
535 views

Rego check env values file

I am a new in Rego. I have values file for helm template and want check that all envs (envmap or envNginxSocket, envPhpSocket, etc) in global section are in quotes. Example, REDIS_PORT: 6379 - value ...
unitrade's user avatar
0 votes
1 answer
708 views

How can I use OPA in server mode with dynamic data?

I have an event-based system where the input data changes with each event (it's a payload in the event). The rego rule(s) are static for our purposes. I run the server like this from command line: ./...
Greg's user avatar
  • 11.3k
1 vote
2 answers
522 views

OPA Rego - How to do tag or label matching

I have... List of tasks tagged with "must match" labels. User tagged with labels. Now I want to filter only the tasks that match all task-tags with user-tags(user may have extra tags). // ...
sriba's user avatar
  • 775
2 votes
1 answer
4k views

How to import different policies inside OPA rego policy?

I am working on writing new rego policies. I have few rules defined in single policy file which I want to break into sub policy and import it. Something like this: A.rego package com.example import ...
Ajay Kedare's user avatar
1 vote
2 answers
749 views

OPA: Mask sensitive data

I want to mask the password in my Open Policy Agent (OPA) logs. This is my input data: { "decision_id":"71e99093-b980-4c67-bd0c-87fcc071571a", "input":{ "...
flo-ferox's user avatar
  • 158
0 votes
1 answer
526 views

Traverse Json objects inside Arrays in Rego

I want to get the value of client_broker key and check if it is TLS or not ,if TLS the rego should pass else it will fail,but i am not able to traverse the nested json within the array element,tried ...
Samriddha Choudhuri's user avatar
2 votes
0 answers
504 views

Rego based OPA Policy for restricting Argo CD applications being created in default Argo CD project is not working with Gatekeeper

Rego based OPA Policy for restricting Argo CD applications being created in default Argo CD project is not working with Gatekeeper. I have tried multiple combinations of api versions and kinds in the ...
Mukul Garg's user avatar
0 votes
1 answer
225 views

Foreach loop to check a list for dupes

Literally looking to do the below pseudocode in Rego: listA = {itemA, itemB, itemC} listB = "items": { "item1": "value1", "item2&...
Adi's user avatar
  • 277
0 votes
1 answer
362 views

Can this Rego policy be simplified

I have this Rego policy that I want to simplify (fewer lines of code) more if possible especially the two findings blocks. I tried but failed miserably given that I'm a Rego noob. package test ...
cepro's user avatar
  • 3
0 votes
1 answer
162 views

How to detect illegal password handling in Terraform code using Open Policy Agent (OPA)?

I am creating RDS using Terraform by using a code that looks something like this: data "aws_secretsmanager_secret_version" "creds" { # Fill in the name you gave to your secret ...
Biju's user avatar
  • 970
2 votes
1 answer
2k views

How can I use regex in rego for OPA to identify matching paths and allow or deny admission of pods?

I have below volumes.rego file that I want to use for OPA. package kubernetes.admission deny[msg] { input.request.kind.kind == "Pod" path := input.request.object.spec.volumes[_].nfs....
Ravi Mahankali's user avatar
0 votes
1 answer
239 views

Sorting objects in Rego, based on multiple attributes

I'm trying to write some code in OPA Rego to sort a collection of objects based on the value of multiple attributes. I start with the objects in a dictionary as below and I'd like to sort the objects ...
gabic's user avatar
  • 3
1 vote
1 answer
820 views

Combining exit codes and 'defined' string return values from rules in Rego

I want to return a non-zero exit code when my policy fails so that my CI/CD buildspec stops building. I also want to return a string error message from my rule(s). I noticed the --fail and --fail-...
Steven DeVerteuil's user avatar
0 votes
1 answer
1k views

Determine why a rego test fails

new to Opa/rego. So, I have some rego test code test_protected_allow { test_token := test.create_test_token({ "audience": "https://whatever.companyname.com", ...
Steve's user avatar
  • 4,651
0 votes
1 answer
752 views

OPA glob pattern that excludes URL's that have a specific part in their path

I'm trying to write an OPA glob pattern that matches any URL path that does NOT have the string /special-part/{whatever}/callback in it, where {whatever} is a path parameter, and this path can ...
brietsparks's user avatar
  • 4,976
1 vote
0 answers
90 views

Can OPA be used in use-cases where the concurrency and throughput is very high?

I'm running OPA as a server(running on AWS) and I did couple of performance test, For the first test I allocated 1 vCPU for the OPA container but for a concurrency of 100 I got a throughput of 2.5k ...
Ashay Fernandes's user avatar
0 votes
1 answer
269 views

Multiple property rules

I must be missing the right words because I can not find how to create a rule that uses multiple properties of an object. I am trying to validate that "bob" has the action and resource in ...
Heath's user avatar
  • 13
0 votes
1 answer
2k views

Specifying input.json file from another directory for use in opa test

I am new to opa/rego and have an opa test that I would like to run. Within that test .rego file, I would like to use an input.json file from a different directory. Is there a way to specify that file ...
Steven DeVerteuil's user avatar
0 votes
1 answer
1k views

Rego: Set comprehension undefined

I am trying to understand why the following examples on using set comprehension give different results: https://play.openpolicyagent.org/p/5x5mXmsyr0 https://play.openpolicyagent.org/p/IVQlTYcVpD In ...
Leo's user avatar
  • 21
0 votes
1 answer
420 views

ProcessBuilder is not working correctly when I deploy my Spring boot Application to a Linux server

public void pushDataToOPA() throws IOException, InterruptedException { ProcessBuilder pb = new ProcessBuilder("curl", "-X", "PUT", "-H", "\"...
YaziD's user avatar
  • 57
1 vote
1 answer
4k views

rego to check for existance of a field in an array

How could the existance of the "spec.rules.host" field in each item under "speck.rules" can be checked, in a way that if any of them do not have such entry, it would trigger a &...
carrotcakeslayer's user avatar
2 votes
1 answer
5k views

How to check if an array is empty in OPA Rego

I have an array which declare like this- arr = []. I want to check it it's empty. I tried: count(arr)==0, is_null(arr), arr==[] and arr=="".
Kfir-G's user avatar
  • 21
0 votes
1 answer
3k views

Rego function to define variables

For several rules, we need to define the same set of variables. In the example, these are "ns", "externaldns", "svc", "nssvc". How could we take these ...
carrotcakeslayer's user avatar
1 vote
1 answer
1k views

How to I combine the results of multiple rules

I have 3 roles and I am trying to return what actions a user can do based on the assigned roles. Playground: https://play.openpolicyagent.org/p/5gN7ObojXh The first part should check if the object ...
Bill Mair's user avatar
  • 1,151
2 votes
0 answers
230 views

OPA Middleware with Dapr not invoking

I am unable to get the OPA middleware to execute on a service to service invocation. I am using the simple OPA example online and cannot seem to get it to trigger when invoking it from another ...
ewassef's user avatar
  • 340
0 votes
1 answer
1k views

OPA rego policy to block access to kubernetes namespace

I am trying to write a policy that blocks permission for specific users to a list of specific kubernetes namespaces. This is what I have so far, it works for singular user/namespace but I need one ...
Ken L's user avatar
  • 1
1 vote
1 answer
601 views

OPA test coverage schema?

What is the schema of the JSON returned by a call to opa test --coverage? And is there a tool I can use to create a human-friendly coverage report?
lencharest's user avatar
  • 2,915
0 votes
1 answer
544 views

OPEN POLICY AGENT: Unable to download bundles from S3

I have set s3 related information as in config.yaml.This get call also returned 200 ok response. GET call: https://s3.console.aws.amazon.com/s3/object/{bucket_name}/policy.tar.gz But when download, it ...
dr88's user avatar
  • 69
1 vote
1 answer
733 views

OPA authorization policies with scopes and roles

I'm using Open Policy Agent as an authorization component together with OIDC enabled apps. I have input from the apps in the format: { "token": { "scopes": [ ...
onlyteo's user avatar
  • 113
0 votes
2 answers
968 views

Is there any way to validate if input is passed in REGO language?

In REGO language how can we validate if an input exists? I got one way to do this. package play default hello = false hello { input.message } But is this the right approach? Or is there a ...
Aiswarya M's user avatar

1
2 3 4 5