The Rego language

Learn the Rego policy language.

The Rego language

OPA policies are written in the Rego language. Rego is declarative: a rule fires if all the expressions inside it are true. In Gatekeeper, violations are produced with the violation rule; the object under review is in input.review.object:

package image_kaynagi

violation[{"msg": msg}] {
  c := input.review.object.spec.template.spec.containers[_]
  not startswith(c.image, "ghcr.io/sirket/")
  msg := sprintf("izinsiz image: %v", [c.image])
}

[_] tries the rule for each element of the array; not negates; := assigns a variable.

Testing Rego locally

opa eval runs a policy locally with a sample input; opa test runs unit tests written in Rego. Policies are tested this way before going to the cluster:

$ opa eval -d politika.rego -i girdi.json "data.image_kaynagi.violation"
{"result": [{"expressions": [{"value": [{"msg": "izinsiz image: nginx:1.27"}]}]}]}
$ opa test . -v
data.image_kaynagi.test_izinli_image: PASS (1.2ms)
data.image_kaynagi.test_izinsiz_image: PASS (0.9ms)

Exercise Test the policy locally

Write two commands: run the query "data.image_kaynagi.violation" with opa eval using politika.rego and girdi.json (-d, -i); run the tests in the current folder verbosely (-v).

Show example solution

opa eval -d politika.rego -i girdi.json "data.image_kaynagi.violation"
opa test . -v

Test yourself

How many violations does the rule above produce if one of two containers uses an unauthorized image?
- 1
- 2
- 0
- It errors
Show answer

1 — The rule is tried separately for each container; a violation appears only for the one meeting the condition.

Try every container in the array.

  c := input.review.object.spec.template.spec.containers[____]

Show answer

  c := input.review.object.spec.template.spec.containers[_]

Match.

violation

Violation rule
input.review.object

Object under review
not

Negation
opa test

Unit tests

Next lesson: What is Gatekeeper?

We Are Enhancing Your Experience

Cookie Preferences

Strictly Necessary Cookies

Analytical Cookies