Combining exit codes and 'defined' string return values from rules in Rego

Question

I want to return a non-zero exit code when my policy fails so that my CI/CD buildspec stops building. I also want to return a string error message from my rule(s).

I noticed the --fail and --fail-defined options for opa eval command. These options seem perfect. However, returning a string technically isn't 'failing' or returning 'undefined'. So, it seems to me impossible to return a string error message as well as a non-zero exit code without also sabotaging a good output string and test case.

Am I correct here? Is there any way to get the best of both worlds? I'm still new to Rego

Ex rego file:

package play

default hello := "hello failed"

hello := "hello passed" {
     input.message == "world"
}

input: {"message": "world"}

Running the following command will return a non-zero exit code no matter what opa eval -i .\input.json -d .\test_rego.rego 'data.play.hello' --fail-defined -f raw

Similarly, the command below won't help because in this case the result is always defined opa eval -i .\input.json -d .\test_rego.rego 'data.play.hello' --fail -f raw

Any help is appreciated

Devoops · Accepted Answer · 2022-07-19 07:55:07Z

1

That's an interesting case. Normally you'll have either boolean rules to work with, or in the case where you want to return e.g. a message partial set rules where you can test for emptiness. If you really want to return a string for both the failure and the success case, you could use not to achieve that:

opa eval -d test_rego.rego -i input.json --fail 'not data.play.hello == "hello passed"'

If using partial rules, i.e:

hello["hello passed"] {
     input.message == "world"
}

You could test iteration over the rule to check for empty:

opa eval -d play.rego --fail 'data.play.hello[_]'

answered Jul 19, 2022 at 7:55

Devoops

2,45510 silver badges25 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Steven DeVerteuil Over a year ago

My coworker and I considered partial set rules and chaining together a nice output message. I'll revisit that with him now that I know we can test for emptiness. However, our policies are often relatively short, and the trying to write partial set rules that encompass only a few checks. We will certainly look at using 'not' for both strings cases

Devoops Over a year ago

Great! Don't forget to accept the answer so it won't show up when searching for unanswered questions :)

Collectives™ on Stack Overflow

Combining exit codes and 'defined' string return values from rules in Rego

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related