Rego is a Query Language. To make a policy decision in Rego, you write logical tests on the data that comes in as input (such as the API or SSH data from the last section)
Questions tagged [rego]
161 questions
1
vote
1 answer
Combining exit codes and 'defined' string return values from rules in Rego
I want to return a non-zero exit code when my policy fails so that my CI/CD buildspec stops building. I also want to return a string error message from my rule(s).
I noticed the --fail and --fail-defined options for opa eval command. These options…
Steven DeVerteuil
- 13
- 1
- 5
1
vote
3 answers
REGO: Is it possible to parse a regex group from the regex statement?
Cant find any information about regex groups, but what i want to do is:
Filter out a string of all ARN's, extract the AWS Services from the ARN's, is it even possible in REGO?
What i currently have:
output = matches {
string := "\"Resource\":…
A K
- 31
- 5
1
vote
1 answer
rego to check for existance of a field in an array
How could the existance of the "spec.rules.host" field in each item under "speck.rules" can be checked, in a way that if any of them do not have such entry, it would trigger a "deny"?
apiVersion: getambassador.io/v3alpha1
kind:…
carrotcakeslayer
- 809
- 2
- 9
- 33
1
vote
1 answer
How to check if an array is empty in OPA Rego
I have an array which declare like this- arr = [].
I want to check it it's empty.
I tried: count(arr)==0, is_null(arr), arr==[] and arr=="".
Kfir-G
- 11
- 1
- 3
1
vote
1 answer
Rego regex to match a specific word from a sentence
I've written a regex
\blates(t|)?\b
to search for a word "latest" in a sentence "/man/service/man-aaaaaa-lllll-latest/zzzn2-iii-ooo-x00_00-gg".
I'm testing a rule in 'Rego' through Rego playground, whenever there's a word 'latest' in a sentence, I…
Katelyn Raphael
- 253
- 2
- 4
- 16
1
vote
1 answer
How to I combine the results of multiple rules
I have 3 roles and I am trying to return what actions a user can do based on the assigned roles.
Playground: https://play.openpolicyagent.org/p/5gN7ObojXh
The first part should check if the object being processed is in a list, and then if the…
Bill Mair
- 1,073
- 6
- 15
1
vote
1 answer
OPA authorization policies with scopes and roles
I'm using Open Policy Agent as an authorization component together with OIDC enabled apps.
I have input from the apps in the format:
{
"token": {
"scopes": [
"read:books",
"write:books"
]
},
…
onlyteo
- 113
- 1
- 5
1
vote
1 answer
How do i connect a simple node.js app running on docker to a Open Policy Server also running on a docker container
I'm trying to bundle together a node app and a Open Policy Agent server using docker compose, i can access the OPA server from my browser but when i tried to to a request using axios from the node app i get this:
Error: connect ECONNREFUSED…
Heyker
- 41
- 3
1
vote
1 answer
What is the difference between Assignment(=) operator and Equality(==) operator in OPA rule body
In OPA documentation https://www.openpolicyagent.org/docs/latest/policy-testing/ there is a policy definition given like below:
allow {
input.path == ["users"]
input.method == "POST"
}
allow {
some profile_id
input.path = ["users",…
Rithu
- 79
- 1
- 6
1
vote
2 answers
How to check OPA Rego file is correct or not
I have created one sample.rego file and I encoded in base64.
so is there any way in Golang Library that validate rego base64 encoded value is correct or not.
Sample.rego file:
package policy.authz
default allow = false
allow {
input.policy ==…
Anupam Somani
- 224
- 1
- 7
- 17
1
vote
1 answer
How to return error messages per object in rego response when using nested objects
I am creating a policy to validate access to a collection of Records. These records are passed as input and have a collection of permissions attached to them. I validate them against permissions data stored in the OPA.
For instance, I can return…
Ashley Kelham
- 13
- 3
1
vote
1 answer
Pass back a value from Open Policy Agent (OPA) query
Instead of seeing who can access what, I want to setup policies that return how many connections are allowed per second, or, how much bandwidth is allowed. How do I define my policies to return values instead of true/false?
JD Allen
- 799
- 5
- 12
1
vote
1 answer
OPA (Rego) as Go lib: How to apply external data?
I followed the example of https://www.openpolicyagent.org/docs/latest/#5-try-opa-as-a-go-library. Important code snippets:
r := rego.New(
rego.Query("x = data.example.allow"),
rego.Load([]string{"./example.rego"}, nil)
...
rs, err := query.Eval(ctx,…
bogg
- 31
- 5
1
vote
2 answers
Converting rego policy to json
I am trying to read rego format of policy and save into json format. However could not find a way to read using "go" package of rego. Any suggestions/advise ?
vnn
- 31
- 1
- 4
1
vote
1 answer
Rego Playground Sort
I have been playing with the OPA Rego Playground. Nice tool. Very powerful.
The default sort is alphabetical. But I'd like to sort the output in the same order as defined in the policy
I saw some switches for the opa command line tool. …
Tom Turner
- 11
- 2