How can a Rego script call a shell script?

Question

I'd like to call a shell script from within a Rego script. How can I do it?

The rego built-in functions don't seem to help.

Answer 1

You can't. Rego isn't a general purpose programming language, and policy evaluation should ideally be free of side effects — i.e evaluating the same policy twice with identical input should render identical results. Best alternative is likely to execute your shell script first, and provide the result as input to OPA. If you really want to run a shell script from inside your policy, a custom built-in function would be the way to go.