Questions tagged [open-policy-agent]

Open Policy Agent is an open source, general-purpose policy engine that enables policy-based control across the stack. Use this tag for questions related to using OPA, the Rego Language, or any of its derivatives (such as Gatekeeper or Conftest).

Filter by
Sorted by
Tagged with
0 votes
2 answers
17 views

Rego: how to merge objects set values

How can I merge the values of an object in rego (set type) into a single set containing all the object values ? This is my input object : input_data = { "1": { "bob": {"...
navi's user avatar
  • 1
-1 votes
0 answers
18 views

Any best practice or use case for integration with elastic search

We want to use OPA to make decision with elasticsearch as data resource. May I know if any best practice or use case for it as reference? Thanks.
walkaround2002's user avatar
1 vote
2 answers
46 views

Will my (Open Policy Architecture) OPA architecture work for microservice authorization?

I am planning to use OPA for Authorizations in microservice architecture. Initially i thought of Sidecar option, but it seams little complex and decided to start with centralized authorization service ...
Jeevika's user avatar
  • 155
0 votes
1 answer
35 views

How can I loop over multiple values in OPA to validate

I have 'JSON' file something like below, now i want to validate is label cat is set or not? "labels": { "apple": "one", "banana": "two", "cat&...
Antham's user avatar
  • 21
0 votes
0 answers
27 views

Setup a user with everyting allowed except access to the kube-system namespace and deploying privileged pods

I want to setup a Kubernetes cluster where every user can do anything with the following exceptions: Deny everything not allowed in "Baseline" Pod Security Standard (PSA) No access to the ...
H. Kubi's user avatar
0 votes
2 answers
28 views

PATCH OPA Data when array data based on id

I have data loaded to OPA server something like this : { "admin": [ { "id": 1, "action": "create", "object&...
Narayan bhat's user avatar
0 votes
1 answer
29 views

Why execution stops and false is returned (Open Policy Agent, Rego)

I want to implement complex validation but I don't have enough knowledge. This is how I imagine the rule to work in python: input_data = { "attributes": { "request": { ...
RubiniuM's user avatar
0 votes
1 answer
51 views

Update OPA data using PATCH

I was trying to update data in Open Policy Agent(OPA). First I am adding the data using PUT http://localhost:8181/v1/data/user Request : { "admin": [ { "action&...
Narayan bhat's user avatar
0 votes
0 answers
52 views

Gatekeeper OPA AssignMetadata dynamically from userInfo of current user

I would like to assign metadata (annotations) to any resource created/updated with the username who creates/updates that resource. In kyverno, it's straightforward. But for some reasons, we stop using ...
Abdennour TOUMI's user avatar
0 votes
0 answers
104 views

OPA Gatekeeper constraints not working only allow images from a private registry

So I have installed a OPA Gatekeeper in kubernetes in AWS using helm chart. I have tried v3.9.0 and v3.12.0 helm chart for gatekeeper. Once I apply constraints template and constraint that allow only ...
GeetT's user avatar
  • 315
1 vote
1 answer
118 views

Getting Error: undefined: rego.ReadFile while trying to read rego file

While I was trying to compile the code, getting below error. I have imported "github.com/open-policy-agent/opa/rego" but still getting the error. -bash-4.2$ go build main.go # command-line-...
van neilsen's user avatar
1 vote
1 answer
70 views

Cannot load github.com/open-policy-agent/opa/capabilities: no Go source files

I was trying to install the OPA library using command go get github.com/open-policy-agent/opa/rego but installation is getting stuck with message build github.com/open-policy-agent/opa/capabilities: ...
van neilsen's user avatar
0 votes
1 answer
68 views

How to create custom Azure Policy for k8s deployments?

I am looking into creating a custom Azure policy for AKS deployments. There is a bunch of built in policies available: https://learn.microsoft.com/en-us/azure/aks/policy-reference but I have not found ...
Kjempen's user avatar
  • 15
0 votes
0 answers
52 views

How to let Open Policy Agent control global rate limit in Envoy proxy

I want to use Envoy proxy to globally limit number of HTTP requests per unit of time to my service. Every server will host my service instance, an Envoy instance filtering traffic to service and an ...
Łukasz Bownik's user avatar
0 votes
1 answer
205 views

Open Policy Agent - partial policy evaluation and http.send

With OPA, I would like to implement data query protection and filtering. There is this blog article about this: https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4 ...
Christian Wunder's user avatar
1 vote
1 answer
107 views

OPA Gatekeeper Policy to block priviliged Pods

Since 2 days I try to create a simple OPA Gatekeeper Policy which blocks the creation of pods with "privileged:true" for some namespaces. Some more details: Im using opa-gatekeeper in ...
Christian K.'s user avatar
0 votes
1 answer
150 views

Rego: merge arrays from different objects

In OPA, I take an input of type { roles, action, object }, and I return a matching permission which contains data regarding what the user is allowed to do based on the input This is rather simple if ...
Jason's user avatar
  • 632
0 votes
0 answers
65 views

Query multiple external data in parallel with bulk

We received documents (d1, d2, d3) from two different companies (c1, c2). Each document has a property defining the company it belongs to. Each company provides a REST service (s1, s2) to manage ...
Piu130's user avatar
  • 1,308
0 votes
1 answer
68 views

conftest verify is unexpectedly passing

Running conftest verify resulted in a pass even though the rule should have failed at db.storage_encrypted != true. What am I missing here? # deny.rego deny_unencrypted[msg] { db := input.resource....
Gerald's user avatar
  • 567
0 votes
1 answer
64 views

OPA doesn't find key if its value is false

I have noticed that if a certain key has false as a value, OPA ignores it. Take this policy code: package play violation[{"msg": msg}] { provided := {context | input.securityContext[...
fardin's user avatar
  • 1,399
0 votes
1 answer
208 views

Caching in OPA where data is pulled from external source for eval

I have a pretty common use case where I would like to cache the results of a http.send for a given amount of time. I know I can do something like value := http.send({ "url": "https:/...
Adi's user avatar
  • 259
0 votes
1 answer
58 views

Transform ["a=b","c=d","e=f"] to {"a":"b","c":"d","e":"f"} in rego

I have an array as defined below ["dev=devA", "instance=instanceA", "domain=domainA", "namespace=namespaceA", "...
raj ramalingam's user avatar
0 votes
0 answers
216 views

How to write a while loop in Rego in OPA

I have a requirement to write a Rego policy that expands an object and build a new one, after referring a data source. Input comes with { "users": { "userid1": { "...
Pushpalanka's user avatar
0 votes
1 answer
156 views

Can OPA check all rules individually or these rules have to be combined into one parent rule to make a decision?

I'm trying to integrate OPA/open policy agent/ into gitlab ci-cd job, and evaluate it against terraform plan output. I have independent rules in rego file and want to run each of them from package ...
kini_dot's user avatar
0 votes
3 answers
200 views

How to ignore FAIL during conftest policy check in atlantis

I am still in the testing phase and would like to allow merging of my PR even if the policy_check is FAIlING. What flag I can pass to enable that ? My current config: repos: - id: /.*/ ...
chan214's user avatar
  • 21
1 vote
1 answer
192 views

How do I merge array of duplicated object with OPA Rego rule

I have written a OPA policy that creates the following output: [ { "permission": [ "module:get", "workflow:get", "...
Swan2017's user avatar
0 votes
1 answer
83 views

Rego - how to mimic set generation using functions

I have a rule that I expect to be reused by a variety of modules. I figured, let's turn that into a function, have the modules pass their input into a function and use a set comprehension like ...
Szymon Rozga's user avatar
0 votes
1 answer
423 views

How to fix my comparison of two values in my OPA rules?

I would like to make comparison between two values in a OPA rule. My OPA rule is : package example vm_name = input.planned_values.root_module.resources[0].values.name vm_name_length = count(vm_name) ...
Gryzm024's user avatar
0 votes
0 answers
49 views

How to enable the "status" plugin in Open Policy Agent server?

Currently, hitting the /v1/status endpoint causes the server to return the following error message: { "code": "internal_error", "message": "status plugin not ...
Marco Massenzio's user avatar
0 votes
1 answer
81 views

how to control/sanitise Open Policy Agent (OPA) response

I have the following policy working just fine but its response feels a bit dirty. I am only interested in the allow and permissions keys. package example default allow = false getUserPermissions(...
Ahmed Ayoub's user avatar
0 votes
0 answers
31 views

how to create OPA contraints and templates for setting a warning message to the client if there is some label present

I would like to know how to create a OPA constraints and templates for having a warning message to the client for kubernetes label present in the kind: helmrelease. example: kustomize.toolkit.fluxcd....
John's user avatar
  • 1
0 votes
0 answers
36 views

Support multiple input data models (i.e. polyglot) while reusing the same policy in Open Policy Agent

Has the Rego community settled on some practices for reuse of policy rules while supporting different input data models? Problem Assume the same policy is to be enforced by two different PEP:s (Policy ...
Robert Gartman's user avatar
0 votes
1 answer
66 views

OPA policy where if kustomize.toolkit.fluxcd.io/reconcile: disabled label is present in helm release yaml it should display a message

is their any OPA policy example where i can design a OPA policy like if specific label is present than it should display the message or warning i mean i want to design an OPA policy where if kustomize....
Sourav's user avatar
  • 1
1 vote
1 answer
440 views

Loop through a nested json object in OPA

I am very new to OPA and trying to loop through the below input data input = "data":{ "list":[ {"Name": "abc", "Status": "Done"}...
mrb28830's user avatar
  • 224
0 votes
1 answer
469 views

K8s OPA Gatekeeper doesn't block DELETE operation

I'm using K8s OPA to enforce policies. From the official document debugging section (https://open-policy-agent.github.io/gatekeeper/website/docs/debug), I created constraintTemplate as below. ...
Piljae Chae's user avatar
0 votes
0 answers
185 views

Is there a way to auto download OPA bundles when the are updated?

OPA can download bundles from OCI compatible registries. Artifactory is one such host that can have bundles stored as containers. We have the following config file: services: docker-registry: ...
am24's user avatar
  • 1
1 vote
1 answer
378 views

Rego - Combine Values of Case Sensitive Keys from json like abc, ABc to single lowercase key abc

I've below json as an input: { "data": { "abc": 123, "Abc": 345, "bcd": 789 } } I want the result like: { "data": ...
Shivshankar Nagarsoge's user avatar
0 votes
1 answer
549 views

Is there a way in OPA to only evaluate policies relevant to certain request?

I'm experimenting with OPA and securing HTTP REST API. I want to implement ABAC authorization. My question is if it's possible to create rules in such a way that only those relevant to the request ...
goatrenz's user avatar
1 vote
1 answer
233 views

Find out what is OPA getting as request from api-server?

We have OPA installed in our Kubernetes cluster. Not Gatekeeper. The "original" OPA... I don't understand how I can look at what OPA is receiving as input request from the API-server ? => ...
Doctor's user avatar
  • 7,185
0 votes
1 answer
340 views

Docker run failing with syntax error after build successful

I built the docker image locally in mac system and then when I'm trying to run the docker getting the below error. I tried both below options. # Build OPA Service directory, load policies and data, ...
Siva Prasad Koka's user avatar
0 votes
1 answer
239 views

Dockerfile with No such file or directory OPA throwing error

I'm trying to run dockerfile in my local and I'm getting the below error not sure why it is. I set permissions to chmod 777, still getting the error. # Build OPA Service directory, load policies and ...
Siva Prasad Koka's user avatar
0 votes
1 answer
196 views

cast_set deprecated. What’s the replacement?

I’m currently running OPA version 0.39.0, but I’m trying to upgrade to a more recent version and am getting the following issue: rego_type_error: deprecated built-in function calls in expression: ...
ShrewdCleric's user avatar
0 votes
1 answer
864 views

How to determine if an object is empty with rego language

In kuberntes OPA gatekeeper, I need to determine if there is volumeName defined in PVC object, like below code: { "apiVersion": "v1", "kind": "...
Marco Mei's user avatar
  • 107
0 votes
1 answer
201 views

Rego check env values file

I am a new in Rego. I have values file for helm template and want check that all envs (envmap or envNginxSocket, envPhpSocket, etc) in global section are in quotes. Example, REDIS_PORT: 6379 - value ...
unitrade's user avatar
0 votes
1 answer
115 views

How to use OPA Gatekeeper to change GKE deployments?

I am trying to use OPA Gatekeeper to modify certain Kubernetes deployments. In this example I want to change the display name of service accounts, regardless of what the user provided. So far I was ...
Beembo's user avatar
  • 307
1 vote
2 answers
258 views

OPA Rego - How to do tag or label matching

I have... List of tasks tagged with "must match" labels. User tagged with labels. Now I want to filter only the tasks that match all task-tags with user-tags(user may have extra tags). // ...
sriba's user avatar
  • 745
1 vote
1 answer
2k views

How to import different policies inside OPA rego policy?

I am working on writing new rego policies. I have few rules defined in single policy file which I want to break into sub policy and import it. Something like this: A.rego package com.example import ...
Ajay Kedare's user avatar
1 vote
2 answers
322 views

OPA: Mask sensitive data

I want to mask the password in my Open Policy Agent (OPA) logs. This is my input data: { "decision_id":"71e99093-b980-4c67-bd0c-87fcc071571a", "input":{ "...
flo-ferox's user avatar
  • 158
2 votes
1 answer
386 views

set annotation/label with slash (/) in mutating-webhook of opa-gatekeeper

due to company policies I have to replace my Kyverno rules by OPA ones. One of my rule is, that I want to add all pods of a specific namespace to our service-mesh (we're using Kuma) So for this I have ...
Zwelch's user avatar
  • 153
1 vote
2 answers
725 views

rego check if item in list exists in item in another list

We have an undertermined list of items in a resource that need to be checked in case they are using one of the deprecated given paramenters. In gatekeeper, the constraint with the parameters looks ...
carrotcakeslayer's user avatar

1
2 3 4 5