271
questions
0
votes
1
answer
18
views
How can I return a single value in rego function?
I have the following rego:
retry_count_key := "retry"
get_retries_count(str) := {x |
some i
parts := split(str[i], ":")
parts[0] == retry_count_key
x := to_number(...
-1
votes
1
answer
31
views
Can I run something like the OPA playground locally?
I am using OPA v0.68.0, and would like to use something like https://play.openpolicyagent.org/ to test changes quickly, but ideally I would like to do that hosted locally. Is that possible?
0
votes
0
answers
14
views
syntex error with OPA rego file for authentication
I am writing very simple rego file but it is showing syntex error. Can anyone suggest what am I doing wrong?
package example.accesscontrol
# Define the allowed UPNs
allowed_upns = {"[email protected]&...
0
votes
0
answers
15
views
OPA/REGO Using AND condition to combine two arrays of Boolean values
I whish to combine two arrays of Boolean value using AND.
For example: a1 := [true, true, false], a2 := [false, true, false].
the resulting AND operation:
a3 = a1 AND a2 would be [false, true, false]
1
vote
1
answer
46
views
How to prevent http.send if subsequent allow's are true?
I am trying to use OPA as authorization service for Trino. I wrote a rego file according to my needs.
package mytrino
import rego.v1
default allow := false
allow if {
input.action.operation == &...
0
votes
0
answers
20
views
Open Policy Agent - Retrive object within data json array on URL matches
I wrote a fine grained rego policy for m2m and user application invoking rest api server.
The problem to solve is how to retrive the right object within an array once the incoming path (like /api/v1/...
0
votes
0
answers
50
views
integrating OPA having external data calls with envoy
I am trying to integrate OPA with Envoy for authorization purposes. It works successfully with OPA without any external data calls, but I need to bundle my auth.rego file with a data.json file to ...
0
votes
0
answers
59
views
How to assign roles to Keycloak created uses in Datahub?
I am trying to create users and groups via Keycloak which works for me perfectly following the tutorial on: https://www.syscrest.com/2022/11/datahub-oidc-identity-group-managment-with-keycloak/
The ...
0
votes
0
answers
230
views
OPA rego check for tags in AWS Resources from Terraform JSON
I am trying to write a policy where I want to enforce tags to exist on AWS resources using Open Policy Agent (OPA). I am attempting to parse the JSON output of a run of terraform plan in order to ...
2
votes
2
answers
116
views
Calling a bash script from Gitlab CI
I have no ideas what I am doing wrong. Just running this simple bash script on my pipeline. It also does not work when I test it locally. Same error.
refresh.sh
#!/bin/sh
# refresh.sh
# Create a ...
0
votes
0
answers
31
views
Rego object comprehension seems incomprehensible to me; lowercase the keys
In rego, I want to convert this:
d := {"a": "aye", "B": "bEe"}
to:
l := {"a": "aye", "b": "bEe"}
where the keys are ...
2
votes
2
answers
377
views
How do I integrate envoy as a gateway, auth0 as an authentication system and OPA as an authorization system?
I'm working on a server configuration with:
envoy proxy as a gateway, with a simple python web server behind it to serve web pages and API calls.
Auth0 to authenticate my users.
OPA as the ...
0
votes
1
answer
31
views
What would be the opa policy for accessung a special path?
I am new to OPA and have tried a lot to get this result:
I want OPA to only allow access to /index. I am working on minikube with docker installed and I have a mciroservice as webserver. But the ...
1
vote
0
answers
43
views
Problems with opa configuration for own application
I am trying to use OPA as a Policy Engine in my test application. I have a node.js application running in minikube on macOS via Docker. The problem is, that since I installed OPA with quick_start.yaml ...
0
votes
1
answer
40
views
Tutorial from the OPA-Website for Istio is not working as it should
I followed all these steps here:
https://istio.io/latest/docs/setup/getting-started/
And then all steps for the Opa-Istio-Tutorial here:
https://www.openpolicyagent.org/docs/latest/envoy-tutorial-...
1
vote
1
answer
252
views
How to build OPA bundles when data files can exceed 1gb size?
I'm trying to build an OPA bundle. Some of the included raw data.json files are larger than 1GB (1073741824 bytes) and exceed the preconfigured size_limit_bytes. Build CLI command:
./opa build -b /...
0
votes
0
answers
58
views
Rego - Pass if resource tag value matches exception tag values
I'm trying to allow specific resources to pass a check if their tag values match an array of values.
I originally asked this question - Rego - Pass if value in set is in allowed_values set - However ...
0
votes
1
answer
358
views
Rego - Pass if value in set is in allowed_values set
I'm trying to have a policy pass if a value in input_set matches a value in allow_values
The below policy example is also here if you'd like to modify it easier - https://play.openpolicyagent.org/
I'm ...
0
votes
1
answer
248
views
OPA eval command
I am very new to OPA but testing something very simple. I would like to create a policy to ensure my s3 is not public.
my simple TF file:
terraform {
required_providers {
aws = {
source = ...
1
vote
0
answers
39
views
OPA | Conftest incorrect parse yaml file
ResourceQuota object definition involves limits keys with dots and there is issue to get the value of the limits:
policy.rego
package main
deny_incorrect_memory_unit[msg] {
input.kind == "...
0
votes
0
answers
143
views
Check for mandatory tag keys and values
I am new with rego and I am finding it difficult to get my head around on how to write a policy. Based on information on the internet, I tried to write a policy to ensure that required tag keys and ...
0
votes
1
answer
221
views
Wildcard in OPA policy definition
I am trying to write a policy for an endpoint that looks like
/xyz/v1.0/applicationVersions?applicationName=blah&default=true&pageSize=3&pageNumber=1
What is a wildcard/regex match I can ...
0
votes
0
answers
44
views
Generate dictionary with a string as a key and an array of strings as value
I have the following Rego policy:
package authz
import future.keywords.in
# The permissions the user has for each property
permissions[property_id][permission] {
some property_id, property_roles ...
0
votes
1
answer
71
views
Rego write a test for every entry with a condition has to have another condition
Example data:
{
"serviceA_primary": {
"foo": 1
"bar": 2
},
"serviceA_secondary": {
"foo": 1,
"bar&...
0
votes
0
answers
21
views
Importing data without exact reference
I have a policy that has the following imports
package abc.xyz
import data.abc_xyz_sourceOne as sourceOne
import data.abc_xyz_sourceTwo as sourceTwo
…
If I were to include another import it would ...
1
vote
0
answers
99
views
Conditions in a OPA policy function (Rego)
I have the following helper function in a test of my OPA policy. I would like to make it more generic and return the resource with the commonName field only if cn is not empty. Any ideas on how I can ...
1
vote
0
answers
163
views
How can I implement OPA for Frontend and Backend microservices?
I am looking to use the OPA policy based authorization in my project. I can use the bundle server to push my polices and data.json files to backend server and can evaluate policies for backend. I am ...
0
votes
0
answers
104
views
Panic error when ' opa eval --partial --unknowns ... '
I am getting this error while trying partially evaluate a very simple query against a very simple policy which consists of a very simple complete rule. Working on MacOS, but getting same error on ...
0
votes
1
answer
386
views
Hiding an object from output in Rego Policy
I created a Rego Policy but I would like to hide some of the objects from the output of the Rego.
Lets take this simple Rego as an example.
package cats
default cats := false
cats{
input.cat == ...
0
votes
0
answers
104
views
OPA Istio setup on EKS returns 503 Error with loadbalance setup
I am trying to setup OPA with Istio on EKS Cluster. Here is the tutorial that I am following:
https://www.openpolicyagent.org/docs/latest/envoy-tutorial-istio/#5-exercise-the-opa-policy
Since I am ...
1
vote
1
answer
156
views
How to extract a portion of string if it exist in rego
I have the following response from an API and I need to get the resourceName if it consists the keywords -ecs-cloudwatch-policy. How can this be achieved in rego?
{
'resourceId': 'ABCDEF12345',
...
0
votes
0
answers
96
views
rego_unsafe_var_error: expression is unsafe -- OPA policy
When I run make test on the following rego code:
package policy.ecs.alb_logging
import data.encryption.get_yyy
import data.terraform.library.get_xxx
import input as tfplan
#########
# Policy
########...
0
votes
0
answers
139
views
Validate tags using rego
I'm trying to validate the input tags against the standard tags defined by our team.
A tag is a key-value pair which we are assigning to a cloud resources, for example, in case of AWS cloud, EC2 ...
0
votes
0
answers
237
views
REGO policy failing because variable is unsafe
Im exploring the use of OPA for a project whereby I need to validate some of the contents of JWT. However when I use this expression I get an unsafe error:
config := payload[1].main-application....
0
votes
0
answers
65
views
Transform a input json to { "Name": ["John Doe"], "Email": ["[email protected]"],"Address": ["123 Willow Dr, San Jose, CA"]}
How Do i transform this line from { "Name": ["John Doe"], "Email": ["[email protected]"],"Address": ["123 Willow Dr, San Jose, CA"]} to ...
0
votes
2
answers
537
views
Rego: how to merge objects set values
How can I merge the values of an object in rego (set type) into a single set containing all the object values ?
This is my input object :
input_data = {
"1": {
"bob": {"...
1
vote
2
answers
252
views
Will my (Open Policy Architecture) OPA architecture work for microservice authorization?
I am planning to use OPA for Authorizations in microservice architecture. Initially i thought of Sidecar option, but it seams little complex and decided to start with centralized authorization service ...
0
votes
1
answer
523
views
How can I loop over multiple values in OPA to validate
I have 'JSON' file something like below, now i want to validate is label cat is set or not?
"labels": {
"apple": "one",
"banana": "two",
"cat&...
1
vote
0
answers
196
views
Rego number of policies evaluated
I am trying to validate some policies using the /opa/rego package.
The policies are evaluated as expected in this script. But, I also want to count the number of rules and the rule names evaluated as ...
1
vote
1
answer
644
views
How to import policies from different files
This could potentially be a duplicate of this post but I'm still having real trouble.
I have a function defined in one file.
A.rego
package authorizer
default username := null
decode_user(jwt) := ...
0
votes
1
answer
127
views
OPA REGO deconstructing nested array
I got data something like this:
{
"TENANT1":{ <-- Multiple tenants
"SITE1":{ <-- Every tenant can have multiple sites
"SITE1_DEVICE1":[ <-- Every ...
0
votes
2
answers
156
views
PATCH OPA Data when array data based on id
I have data loaded to OPA server something like this :
{
"admin": [
{
"id": 1,
"action": "create",
"object&...
0
votes
1
answer
156
views
Why execution stops and false is returned (Open Policy Agent, Rego)
I want to implement complex validation but I don't have enough knowledge.
This is how I imagine the rule to work in python:
input_data = {
"attributes": {
"request": {
...
0
votes
1
answer
311
views
Update OPA data using PATCH
I was trying to update data in Open Policy Agent(OPA).
First I am adding the data using PUT http://localhost:8181/v1/data/user
Request :
{
"admin": [
{
"action&...
0
votes
1
answer
515
views
OPA Gatekeeper constraints not working only allow images from a private registry
So I have installed a OPA Gatekeeper in kubernetes in AWS using helm chart. I have tried v3.9.0 and v3.12.0 helm chart for gatekeeper.
Once I apply constraints template and constraint that allow only ...
1
vote
1
answer
439
views
Getting Error: undefined: rego.ReadFile while trying to read rego file
While I was trying to compile the code, getting below error. I have imported "github.com/open-policy-agent/opa/rego" but still getting the error.
-bash-4.2$ go build main.go
# command-line-...
2
votes
1
answer
161
views
Cannot load github.com/open-policy-agent/opa/capabilities: no Go source files
I was trying to install the OPA library using command
go get github.com/open-policy-agent/opa/rego
but installation is getting stuck with message
build github.com/open-policy-agent/opa/capabilities: ...
1
vote
1
answer
263
views
How to create custom Azure Policy for k8s deployments?
I am looking into creating a custom Azure policy for AKS deployments. There is a bunch of built in policies available: https://learn.microsoft.com/en-us/azure/aks/policy-reference but I have not found ...
0
votes
1
answer
844
views
Open Policy Agent - partial policy evaluation and http.send
With OPA, I would like to implement data query protection and filtering. There is this blog article about this:
https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4
...
2
votes
1
answer
499
views
OPA Gatekeeper Policy to block priviliged Pods
Since 2 days I try to create a simple OPA Gatekeeper Policy which blocks the creation of pods with "privileged:true" for some namespaces.
Some more details:
Im using opa-gatekeeper in ...