Questions tagged [open-policy-agent]
Open Policy Agent is an open source, general-purpose policy engine that enables policy-based control across the stack. Use this tag for questions related to using OPA, the Rego Language, or any of its derivatives (such as Gatekeeper or Conftest).
186
questions
0
votes
1
answer
10
views
rego_unsafe_var_error, but only in tests
I'm writing a test for a rule but am hitting the error below in the test;
rego_unsafe_var_error: var canWrite is unsafe
The test rule;
test_canWrite_allowed {
canWrite with data.applications ...
0
votes
1
answer
30
views
Rego Object matching and comparison
I'm trying to match the domain key ("domain":"example.com") from the given input, and return an error if the values are not identical. This is what I've thought of so far, but I ...
1
vote
3
answers
32
views
How to capture all request logs from OPA server
I'm using Open Policy Agent (https://www.openpolicyagent.org/docs/latest/). I'm using it in kubernetes. I have various user traffic going on. I have such container logs:
{"client_addr":"...
0
votes
1
answer
30
views
rego to check for existance of a field in an array
How could the existance of the "spec.rules.host" field in each item under "speck.rules" can be checked, in a way that if any of them do not have such entry, it would trigger a &...
-1
votes
1
answer
23
views
Understanding the Open Policy Agent (OPA) Disk-Storage implementation's use of .sst and .vlog files (BadgerDB)
I'm working through some OPA examples like this one that leverage disk storage. I've removed the temporary directory in favor of a permanent one (like we'd have in a production system) and I'm ...
2
votes
1
answer
47
views
Rego regex to match a specific word from a sentence
I've written a regex
\blates(t|)?\b
to search for a word "latest" in a sentence "/man/service/man-aaaaaa-lllll-latest/zzzn2-iii-ooo-x00_00-gg".
I'm testing a rule in 'Rego' ...
0
votes
1
answer
50
views
Rego function to define variables
For several rules, we need to define the same set of variables. In the example, these are "ns", "externaldns", "svc", "nssvc". How could we take these ...
0
votes
0
answers
55
views
Open Policy Agent (OPA) for front and back end policy evaluation
We have a business application that has a number of policy rules for which OPA seems well suited for. As a simple example: "an order can by modified from status 'X' to 'Y' iif the user is in role ...
1
vote
1
answer
45
views
How to I combine the results of multiple rules
I have 3 roles and I am trying to return what actions a user can do based on the assigned roles.
Playground: https://play.openpolicyagent.org/p/5gN7ObojXh
The first part should check if the object ...
0
votes
1
answer
27
views
Will other rule results impact the correctness of the policy?
I am working on a rego policy that has multiple conditions. Each condition needs to make a call to the same endpoint of a REST api.
I have managed to retain the result of the service call as a result ...
1
vote
1
answer
27
views
integrate Open policy Agent with Knative/Kourier
"Open Policy agent" & "Knative" each provide a tutorial for integration with "Istio". There's a lighter alternative to "Istio" : "Kourier" that ...
0
votes
1
answer
22
views
OPA test coverage schema?
What is the schema of the JSON returned by a call to opa test --coverage? And is there a tool I can use to create a human-friendly coverage report?
0
votes
1
answer
108
views
Has anyone installed OPA (open policy agent) Docker Container in Azure App Services?
Has anyone installed 'openpolicyagent/opa' as a docker image deployment in Azure App Service successfully? If yes can you please share how you did this? I attempted to do this with the startup ...
0
votes
1
answer
38
views
OPEN POLICY AGENT: Unable to download bundles from S3
I have set s3 related information as in config.yaml.This get call also returned 200 ok response.
GET call: https://s3.console.aws.amazon.com/s3/object/{bucket_name}/policy.tar.gz
But when download, it ...
0
votes
1
answer
69
views
OPA authorization policies with scopes and roles
I'm using Open Policy Agent as an authorization component together with OIDC enabled apps.
I have input from the apps in the format:
{
"token": {
"scopes": [
...
0
votes
1
answer
29
views
Is there any way to store values in OPA
I have a usecase to do like, if a variable is already defined then return that value else invoke a rest endpoint to get the variable.
get_value = value {
data.value
value
}else = value {
...
0
votes
2
answers
161
views
Authentication & Authorization using Ingress-nginx
We have services deployed in K8s with istio as service mesh and exposed using Ingress-nginx.
Now, we would like to add AuthN and AuthZ using Ingress-nginx ingress controller.
We would like do Oauth2-...
0
votes
0
answers
32
views
How to get the attributes of a OPA policy?
Let's say I have a OPA policy
allow {
input.path == ["users"]
input.method == "POST"
}
and I would like to get a list of the attributes of input using Golang, which in ...
0
votes
1
answer
30
views
How to validate AWS Service belonging to an arn during terraform plan using Open Policy Agent?
resource "aws_cloudwatch_event_target" "sns" {
rule = aws_cloudwatch_event_rule.console.name
target_id = "SendToSNS"
arn = aws_sns_topic.aws_logins.arn
}
...
0
votes
0
answers
15
views
How to use Open Policy Agent to check if an AWS AMI is available or not?
I am using Open Policy Agent to implement Policy as Code policy governance in my AWS work.
Is there a way to use OPA to validate if an EC2 was created using an AWS AMI which is available and not de-...
2
votes
3
answers
262
views
How to validate application authorizations in a hierarchical RBAC/ABAC policy definition with Open Policy Agent?
We are building a cloud based application, using C# as our main language and running on Microsoft Azure.
One of the key pieces of the architecture is to have fine grained authorization rights ...
1
vote
1
answer
150
views
OPA REGO: How to find all not matching items in another dictionary?
Given input as follow:
{
"source": "serverA",
"destination": "serverB",
"rules": {
"tcp": {
"ssh": ...
1
vote
1
answer
109
views
OPA/rego result is true even if a comparison evaluates to false
I just started to use OPA, so there is a high chance I'm doing something wrong.
I have the following input:
{
"request": {
"principalId": "user1",
"scope&...
0
votes
1
answer
154
views
Why we are unable to evaluate comprehension if we have defined it inside a rule body in OPA?
The following is my sample code: https://play.openpolicyagent.org/p/oyY1GOsYaf
Here when I try to evaluate names array, it is showing:
error occurred: 1:1: rego_unsafe_var_error: var names is unsafe
...
0
votes
1
answer
66
views
What is the difference between Assignment(=) operator and Equality(==) operator in OPA rule body
In OPA documentation https://www.openpolicyagent.org/docs/latest/policy-testing/ there is a policy definition given like below:
allow {
input.path == ["users"]
input.method == "...
0
votes
1
answer
33
views
Open Policy Agent - Authorizing READ on a list of data
Problem
We've been using OPA to do data authorization of our REST HTTP APIs. We secure our APIs as such
allow {
input.method == "GET"
glob.match(input.path, ["/"], "/...
0
votes
2
answers
156
views
REGO how to get object (map) keys that match a pattern
Working with Rego, the Open Policy Agent (OPA) "rules" language, and given the following data:
{
"x-foo": "a",
"x-bar": "b",
"y-foo&...
0
votes
2
answers
96
views
How to create OPA rego policy for a whitelist?
I am trying to implement a whitelist policy in OPA rego. The purpose of the policy is to block all attributes except for attributes that have been whitelisted. However, I cannot get it to work.
Here ...
1
vote
1
answer
37
views
Isolation between kubernetes.admission policies in OPA
I use the vanilla Open Policy Agent as a deployment on Kubernetes for handling admission webhooks.
The behavior of multiple policies evaluation is not clear to me, see this example:
## policy-1.rego
...
1
vote
1
answer
97
views
How to return error messages per object in rego response when using nested objects
I am creating a policy to validate access to a collection of Records. These records are passed as input and have a collection of permissions attached to them. I validate them against permissions ...
0
votes
1
answer
180
views
OPA Rego issues counting
I am trying to write a rule but am running into an issue. I managed to extract the following from as my input:
myData:= [{"Key": "use", "Value": "1"}, {"...
0
votes
1
answer
130
views
How can i access the Open Policy Agent Command Line via Docker Desktop in Windows 10
I am attempting to learn the various features of something called Open Policy Agent because I think it may be a useful tool in a microservices based application.
Here is a link to the 'Running with ...
0
votes
1
answer
91
views
Retrieve a value from a set where the key comes from another set in Open Policy Agent (OPA)
I've read through the OPA 'Policy Language' page, but my problem is only sorta addressed...looking for clarity here ;)
I have two sets:
"servers": {
"server1": [ "silver&...
1
vote
1
answer
162
views
Pass back a value from Open Policy Agent (OPA) query
Instead of seeing who can access what, I want to setup policies that return how many connections are allowed per second, or, how much bandwidth is allowed. How do I define my policies to return ...
0
votes
1
answer
45
views
Using contains in conftest rules
I have following XML (it is a dotnet project file:
<Project Sdk="Microsoft.NET.Sdk">
<ItemGroup>
<None Remove="appsettings.json" />
</ItemGroup>
&...
0
votes
0
answers
115
views
VSCode OPA extension not able to find input file on Mac
I'm unable to get the Open-Policy-Agent extension on VScode to run a simple example.
I keep getting the error open file:///Users/nimararora/github/opa-bundle/policy/input.json: no such file or ...
0
votes
0
answers
52
views
How to compare an input array with an array property in an object, when iterating over an array?
I want the rule to evaluate to true:
if input.resource == data.grants[i].resource OR
data.grants[i].resource == '*'
AND
if there's a exact match for every input.scopes item in data.grants[i].scopes ...
1
vote
1
answer
632
views
OPA (Rego) as Go lib: How to apply external data?
I followed the example of https://www.openpolicyagent.org/docs/latest/#5-try-opa-as-a-go-library. Important code snippets:
r := rego.New(
rego.Query("x = data.example.allow"),
rego.Load([]...
0
votes
1
answer
196
views
How to use simple hello world example on opa server
I have defined a file with name - play.rego
package play
default hello = false
hello {
m := input.message
m == "world"
}
I also have file called -input.json
{ "message": &...
0
votes
1
answer
32
views
Not able to use nodeSelector PodSpec in OPA
I want to add policy that node Selector should exists in pod.
I have made the below code not able to wrap my head around the issue with this as not able to get desired output.
package kubernetes....
1
vote
2
answers
143
views
Using opa for abac to check user claims agains defined policies
So I'm trying implement a fairly simple ABAC system for my application and came across open policy agent during my investigations. It seems to be a good fit for my needs but I just can't make it work ...
1
vote
1
answer
163
views
Converting rego policy to json
I am trying to read rego format of policy and save into json format. However could not find a way to read using "go" package of rego. Any suggestions/advise ?
0
votes
1
answer
269
views
Rego: Given a list of regex and a list of strings create a set of all strings that don't match any of the regex
I have a list of strings and I want to remove each string from the list that matches any of the regex patterns from another list. I have solved it this way, however, I know there is a better way to do ...
1
vote
0
answers
141
views
Overlapping roots across multiple bundles
I was trying to understand the significance of roots.
As per the docs,
The roots are not overlapping (e.g., a/b/c and a/b are overlapped and will result in an error.) Note: This is not enforced ...
1
vote
1
answer
57
views
OPA masking a dynamic array field
I'm trying to apply masking on an input and result field that is part of an array. And the size of the array is dynamic. Based on the documentation, it is instructed to provide absolute array index ...
0
votes
1
answer
53
views
Transform { key: [values] } to {value: [keys]} in rego
Please help me write a rule on rego that returns a transformed object.
My object:
{
"read": [
"server1",
"server2"
],
"write": [
"server2&...
2
votes
0
answers
144
views
How to implement OPA with Django microservices?
I am starting a project where there'll be a bunch of microservices in Django. I want to implement a separate Authentication and Authorization system that all the microservices will talk to for end-...
1
vote
1
answer
87
views
Different input formats in OPA when query using rest api vs local tool
When evaluating a query in Open Policy Agent (OPA) using local tool with opa eval command the input of the query is just a normal json/yaml.
Ex input yaml:
apiVersion: v1
kind: Pod
metadata:
name: ...
1
vote
1
answer
375
views
Check if array contained within another in rego
I have two arrays: x and y
I want to check if x is contained within y.
There is not contains() function in rego.
Next thing I tried is to create the mathematical equivalent to the contains() function:
...
0
votes
1
answer
184
views
Rego - assign array to existing array
I'm getting a weird behavior in Rego and I wonder why does it happen.
Link to Rego Playground
When I create an empty array, and than assign to it new array, the count of the first array is still zero:
...