Skip to main content
Filter by
Sorted by
Tagged with
0 votes
1 answer
18 views

How can I return a single value in rego function?

I have the following rego: retry_count_key := "retry" get_retries_count(str) := {x | some i parts := split(str[i], ":") parts[0] == retry_count_key x := to_number(...
Joey Stout's user avatar
-1 votes
1 answer
31 views

Can I run something like the OPA playground locally?

I am using OPA v0.68.0, and would like to use something like https://play.openpolicyagent.org/ to test changes quickly, but ideally I would like to do that hosted locally. Is that possible?
LentilSoup's user avatar
0 votes
0 answers
14 views

syntex error with OPA rego file for authentication

I am writing very simple rego file but it is showing syntex error. Can anyone suggest what am I doing wrong? package example.accesscontrol # Define the allowed UPNs allowed_upns = {"[email protected]&...
Rahul Dankhara's user avatar
0 votes
0 answers
15 views

OPA/REGO Using AND condition to combine two arrays of Boolean values

I whish to combine two arrays of Boolean value using AND. For example: a1 := [true, true, false], a2 := [false, true, false]. the resulting AND operation: a3 = a1 AND a2 would be [false, true, false]
PsychicPuppy's user avatar
1 vote
1 answer
46 views

How to prevent http.send if subsequent allow's are true?

I am trying to use OPA as authorization service for Trino. I wrote a rego file according to my needs. package mytrino import rego.v1 default allow := false allow if { input.action.operation == &...
Alper İnan's user avatar
0 votes
0 answers
20 views

Open Policy Agent - Retrive object within data json array on URL matches

I wrote a fine grained rego policy for m2m and user application invoking rest api server. The problem to solve is how to retrive the right object within an array once the incoming path (like /api/v1/...
riccio's user avatar
  • 29
0 votes
0 answers
50 views

integrating OPA having external data calls with envoy

I am trying to integrate OPA with Envoy for authorization purposes. It works successfully with OPA without any external data calls, but I need to bundle my auth.rego file with a data.json file to ...
Jislin Anna Thomas's user avatar
0 votes
0 answers
59 views

How to assign roles to Keycloak created uses in Datahub?

I am trying to create users and groups via Keycloak which works for me perfectly following the tutorial on: https://www.syscrest.com/2022/11/datahub-oidc-identity-group-managment-with-keycloak/ The ...
Ada's user avatar
  • 21
0 votes
0 answers
230 views

OPA rego check for tags in AWS Resources from Terraform JSON

I am trying to write a policy where I want to enforce tags to exist on AWS resources using Open Policy Agent (OPA). I am attempting to parse the JSON output of a run of terraform plan in order to ...
el n00b's user avatar
  • 1,835
2 votes
2 answers
116 views

Calling a bash script from Gitlab CI

I have no ideas what I am doing wrong. Just running this simple bash script on my pipeline. It also does not work when I test it locally. Same error. refresh.sh #!/bin/sh # refresh.sh # Create a ...
Tate_87's user avatar
  • 151
0 votes
0 answers
31 views

Rego object comprehension seems incomprehensible to me; lowercase the keys

In rego, I want to convert this: d := {"a": "aye", "B": "bEe"} to: l := {"a": "aye", "b": "bEe"} where the keys are ...
theherk's user avatar
  • 7,494
2 votes
2 answers
377 views

How do I integrate envoy as a gateway, auth0 as an authentication system and OPA as an authorization system?

I'm working on a server configuration with: envoy proxy as a gateway, with a simple python web server behind it to serve web pages and API calls. Auth0 to authenticate my users. OPA as the ...
DannyA's user avatar
  • 1,541
0 votes
1 answer
31 views

What would be the opa policy for accessung a special path?

I am new to OPA and have tried a lot to get this result: I want OPA to only allow access to /index. I am working on minikube with docker installed and I have a mciroservice as webserver. But the ...
Andrea's user avatar
  • 11
1 vote
0 answers
43 views

Problems with opa configuration for own application

I am trying to use OPA as a Policy Engine in my test application. I have a node.js application running in minikube on macOS via Docker. The problem is, that since I installed OPA with quick_start.yaml ...
Andrea's user avatar
  • 11
0 votes
1 answer
40 views

Tutorial from the OPA-Website for Istio is not working as it should

I followed all these steps here: https://istio.io/latest/docs/setup/getting-started/ And then all steps for the Opa-Istio-Tutorial here: https://www.openpolicyagent.org/docs/latest/envoy-tutorial-...
Andrea's user avatar
  • 11
1 vote
1 answer
252 views

How to build OPA bundles when data files can exceed 1gb size?

I'm trying to build an OPA bundle. Some of the included raw data.json files are larger than 1GB (1073741824 bytes) and exceed the preconfigured size_limit_bytes. Build CLI command: ./opa build -b /...
grey's user avatar
  • 57
0 votes
0 answers
58 views

Rego - Pass if resource tag value matches exception tag values

I'm trying to allow specific resources to pass a check if their tag values match an array of values. I originally asked this question - Rego - Pass if value in set is in allowed_values set - However ...
user3367760's user avatar
0 votes
1 answer
358 views

Rego - Pass if value in set is in allowed_values set

I'm trying to have a policy pass if a value in input_set matches a value in allow_values The below policy example is also here if you'd like to modify it easier - https://play.openpolicyagent.org/ I'm ...
user3367760's user avatar
0 votes
1 answer
248 views

OPA eval command

I am very new to OPA but testing something very simple. I would like to create a policy to ensure my s3 is not public. my simple TF file: terraform { required_providers { aws = { source = ...
Tate_87's user avatar
  • 151
1 vote
0 answers
39 views

OPA | Conftest incorrect parse yaml file

ResourceQuota object definition involves limits keys with dots and there is issue to get the value of the limits: policy.rego package main deny_incorrect_memory_unit[msg] { input.kind == "...
Kucharsky's user avatar
  • 253
0 votes
0 answers
143 views

Check for mandatory tag keys and values

I am new with rego and I am finding it difficult to get my head around on how to write a policy. Based on information on the internet, I tried to write a policy to ensure that required tag keys and ...
Akshay's user avatar
  • 65
0 votes
1 answer
221 views

Wildcard in OPA policy definition

I am trying to write a policy for an endpoint that looks like /xyz/v1.0/applicationVersions?applicationName=blah&default=true&pageSize=3&pageNumber=1 What is a wildcard/regex match I can ...
Adi's user avatar
  • 277
0 votes
0 answers
44 views

Generate dictionary with a string as a key and an array of strings as value

I have the following Rego policy: package authz import future.keywords.in # The permissions the user has for each property permissions[property_id][permission] { some property_id, property_roles ...
dario's user avatar
  • 5,239
0 votes
1 answer
71 views

Rego write a test for every entry with a condition has to have another condition

Example data: { "serviceA_primary": { "foo": 1 "bar": 2 }, "serviceA_secondary": { "foo": 1, "bar&...
saxo's user avatar
  • 91
0 votes
0 answers
21 views

Importing data without exact reference

I have a policy that has the following imports package abc.xyz import data.abc_xyz_sourceOne as sourceOne import data.abc_xyz_sourceTwo as sourceTwo … If I were to include another import it would ...
LentilSoup's user avatar
1 vote
0 answers
99 views

Conditions in a OPA policy function (Rego)

I have the following helper function in a test of my OPA policy. I would like to make it more generic and return the resource with the commonName field only if cn is not empty. Any ideas on how I can ...
Erkan's user avatar
  • 153
1 vote
0 answers
163 views

How can I implement OPA for Frontend and Backend microservices?

I am looking to use the OPA policy based authorization in my project. I can use the bundle server to push my polices and data.json files to backend server and can evaluate policies for backend. I am ...
LiveSK's user avatar
  • 61
0 votes
0 answers
104 views

Panic error when ' opa eval --partial --unknowns ... '

I am getting this error while trying partially evaluate a very simple query against a very simple policy which consists of a very simple complete rule. Working on MacOS, but getting same error on ...
Cengo's user avatar
  • 93
0 votes
1 answer
386 views

Hiding an object from output in Rego Policy

I created a Rego Policy but I would like to hide some of the objects from the output of the Rego. Lets take this simple Rego as an example. package cats default cats := false cats{ input.cat == ...
Matwo's user avatar
  • 1
0 votes
0 answers
104 views

OPA Istio setup on EKS returns 503 Error with loadbalance setup

I am trying to setup OPA with Istio on EKS Cluster. Here is the tutorial that I am following: https://www.openpolicyagent.org/docs/latest/envoy-tutorial-istio/#5-exercise-the-opa-policy Since I am ...
RSharma's user avatar
  • 130
1 vote
1 answer
156 views

How to extract a portion of string if it exist in rego

I have the following response from an API and I need to get the resourceName if it consists the keywords -ecs-cloudwatch-policy. How can this be achieved in rego? { 'resourceId': 'ABCDEF12345', ...
Jessica's user avatar
  • 25
0 votes
0 answers
96 views

rego_unsafe_var_error: expression is unsafe -- OPA policy

When I run make test on the following rego code: package policy.ecs.alb_logging import data.encryption.get_yyy import data.terraform.library.get_xxx import input as tfplan ######### # Policy ########...
Chethan's user avatar
  • 311
0 votes
0 answers
139 views

Validate tags using rego

I'm trying to validate the input tags against the standard tags defined by our team. A tag is a key-value pair which we are assigning to a cloud resources, for example, in case of AWS cloud, EC2 ...
Yogesh Jilhawar's user avatar
0 votes
0 answers
237 views

REGO policy failing because variable is unsafe

Im exploring the use of OPA for a project whereby I need to validate some of the contents of JWT. However when I use this expression I get an unsafe error: config := payload[1].main-application....
user1513388's user avatar
  • 7,411
0 votes
0 answers
65 views

Transform a input json to { "Name": ["John Doe"], "Email": ["[email protected]"],"Address": ["123 Willow Dr, San Jose, CA"]}

How Do i transform this line from { "Name": ["John Doe"], "Email": ["[email protected]"],"Address": ["123 Willow Dr, San Jose, CA"]} to ...
raj ramalingam's user avatar
0 votes
2 answers
537 views

Rego: how to merge objects set values

How can I merge the values of an object in rego (set type) into a single set containing all the object values ? This is my input object : input_data = { "1": { "bob": {"...
navi's user avatar
  • 1
1 vote
2 answers
252 views

Will my (Open Policy Architecture) OPA architecture work for microservice authorization?

I am planning to use OPA for Authorizations in microservice architecture. Initially i thought of Sidecar option, but it seams little complex and decided to start with centralized authorization service ...
Jeevika's user avatar
  • 165
0 votes
1 answer
523 views

How can I loop over multiple values in OPA to validate

I have 'JSON' file something like below, now i want to validate is label cat is set or not? "labels": { "apple": "one", "banana": "two", "cat&...
Antham's user avatar
  • 41
1 vote
0 answers
196 views

Rego number of policies evaluated

I am trying to validate some policies using the /opa/rego package. The policies are evaluated as expected in this script. But, I also want to count the number of rules and the rule names evaluated as ...
santoshdts's user avatar
1 vote
1 answer
644 views

How to import policies from different files

This could potentially be a duplicate of this post but I'm still having real trouble. I have a function defined in one file. A.rego package authorizer default username := null decode_user(jwt) := ...
equatorial_daydreamer's user avatar
0 votes
1 answer
127 views

OPA REGO deconstructing nested array

I got data something like this: { "TENANT1":{ <-- Multiple tenants "SITE1":{ <-- Every tenant can have multiple sites "SITE1_DEVICE1":[ <-- Every ...
Martin Hoang's user avatar
0 votes
2 answers
156 views

PATCH OPA Data when array data based on id

I have data loaded to OPA server something like this : { "admin": [ { "id": 1, "action": "create", "object&...
Narayan bhat's user avatar
0 votes
1 answer
156 views

Why execution stops and false is returned (Open Policy Agent, Rego)

I want to implement complex validation but I don't have enough knowledge. This is how I imagine the rule to work in python: input_data = { "attributes": { "request": { ...
RubiniuM's user avatar
0 votes
1 answer
311 views

Update OPA data using PATCH

I was trying to update data in Open Policy Agent(OPA). First I am adding the data using PUT http://localhost:8181/v1/data/user Request : { "admin": [ { "action&...
Narayan bhat's user avatar
0 votes
1 answer
515 views

OPA Gatekeeper constraints not working only allow images from a private registry

So I have installed a OPA Gatekeeper in kubernetes in AWS using helm chart. I have tried v3.9.0 and v3.12.0 helm chart for gatekeeper. Once I apply constraints template and constraint that allow only ...
GeetT's user avatar
  • 315
1 vote
1 answer
439 views

Getting Error: undefined: rego.ReadFile while trying to read rego file

While I was trying to compile the code, getting below error. I have imported "github.com/open-policy-agent/opa/rego" but still getting the error. -bash-4.2$ go build main.go # command-line-...
van neilsen's user avatar
2 votes
1 answer
161 views

Cannot load github.com/open-policy-agent/opa/capabilities: no Go source files

I was trying to install the OPA library using command go get github.com/open-policy-agent/opa/rego but installation is getting stuck with message build github.com/open-policy-agent/opa/capabilities: ...
van neilsen's user avatar
1 vote
1 answer
263 views

How to create custom Azure Policy for k8s deployments?

I am looking into creating a custom Azure policy for AKS deployments. There is a bunch of built in policies available: https://learn.microsoft.com/en-us/azure/aks/policy-reference but I have not found ...
Kjempen's user avatar
  • 25
0 votes
1 answer
844 views

Open Policy Agent - partial policy evaluation and http.send

With OPA, I would like to implement data query protection and filtering. There is this blog article about this: https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4 ...
Christian Wunder's user avatar
2 votes
1 answer
499 views

OPA Gatekeeper Policy to block priviliged Pods

Since 2 days I try to create a simple OPA Gatekeeper Policy which blocks the creation of pods with "privileged:true" for some namespaces. Some more details: Im using opa-gatekeeper in ...
Christian K.'s user avatar

1
2 3 4 5 6