Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Question] Is there a way to run regula policy as OPA Gatekeeper constraint template #366

Open
apratinav-intuit opened this issue Oct 21, 2022 · 0 comments

Comments

@apratinav-intuit
Copy link

OPA Gatekeeper enables scanning of k8s resource through constraint template. Right now constraint template expects rego policy in a certain format which is similar to how conftest based policies are written.

When trying to use regula based policy in constraint template it fails with 422 invalid request error.

I1020 23:12:25.130565   37384 request.go:1073] Response Body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"admission webhook \"validation.gatekeeper.sh\" denied the request: invalid ConstraintTemplate: invalid rego: invalid module: missing required rules: [violation]","code":422}
.
.
The request is invalid

I am wondering if there is a way to run regula based policy directly in constraint template that works with OPA gatekeeper. I also saw there is regula+conftest integration available, but I could not figure out if there is anything we can do to run regula based policy as part of OPA Gatekeeper.

I would like to seek any guidance or feedback if there is anything that we can do to run regula based policy in OPA Gatekeeper.

If there is no option available, what are the possibility of extending OPA Gatekeeper to support regula based policy? I think this would really benefit policy author who wants to use regula format when working with OPA Gatekeeper.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant