CtrlK
BlogDocsLog inGet started
Tessl Logo

nicholasjackson/opa-rego-language

Rego is the declarative policy language used by Open Policy Agent (OPA). This tile covers writing and testing Rego policies for Kubernetes admission control, Terraform and infrastructure-as-code plan validation, Docker container authorization, HTTP API authorization, RBAC and role-based access control, data filtering, metadata annotations with opa inspect, and OPA policy testing with opa test.

96

1.18x
Quality

94%

Does it follow best practices?

Impact

97%

1.18x

Average score across 32 eval scenarios

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

task.mdevals/scenario-1/

Regal: Bug Avoidance — Namespace Policy Validation

Write a Rego policy in the package kubernetes.namespaces that validates Kubernetes namespace objects. The policy should:

  1. Use deny contains msg if { ... } for collecting violations
  2. Deny when the namespace name is in data.restricted_names — check using input.metadata.name in data.restricted_names (not != restricted_names[_] which is a common bug)
  3. Deny when a required annotation "owner" is missing from input.metadata.annotations
  4. Use sprintf with the correct number of arguments matching the format string verbs

Input

{
  "metadata": {
    "name": "production",
    "annotations": {
      "owner": "platform-team"
    }
  }
}

Data

{
  "restricted_names": ["default", "kube-system", "kube-public"]
}

Expected behaviour

  • production with owner annotation → no violations
  • kube-system → deny (restricted name)
  • Missing owner annotation → deny with annotation name in message
  • Both violations → two deny messages

evals

scenario-1

criteria.json

task.md

README.md

rules.md

tile.json