Open Policy Agent (OPA) Rego - Accessing Input Object Nested Fields At Runtime

Question

I am trying to create a somewhat generic rego policy that can evaluate a nested object field that is given from an input. For example:

field_from_input := "spec.securityContext.runAsRoot"

violation[{"msg": msg}] {
  fields := split(field_from_input, ".")
  # Somehow get the inner "runAsRoot" field value
  nested_value := input.object[fields]
  nested_value == "test"
  msg := "some message..."
}

I've tried using the built in "object.filter" and "json.filter" function but they don't seem to work for nested attributes. I've also tried splitting the attribute path by "." and somehow iterate the object by the fields, but had no success.

Any help will be much appreciated.

Devoops · Accepted Answer · 2020-12-06 15:43:12Z

1

This seems like a good case for the walk built-in. Using that to traverse the object allows you to check both the path and/or the value to match any conditions you may wish for.

package play

spec := {
    "securityContext": {
        "runAsRoot": true,
    },
}

violation[{"msg": msg}] {
    walk(spec, [path, value])
    node := path[count(path) - 1]
    
    node == "runAsRoot"
    value == true

    msg := "some message..."
}

See playground example here.

answered Dec 6, 2020 at 15:43

Devoops

2,45510 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Open Policy Agent (OPA) Rego - Accessing Input Object Nested Fields At Runtime

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related