nicholasjackson/opa-rego-language
Rego is the declarative policy language used by Open Policy Agent (OPA). This tile covers writing and testing Rego policies for Kubernetes admission control, Terraform and infrastructure-as-code plan validation, Docker container authorization, HTTP API authorization, RBAC and role-based access control, data filtering, metadata annotations with opa inspect, and OPA policy testing with opa test.
96
94%
Does it follow best practices?
Impact
97%
1.18xAverage score across 32 eval scenarios
Low
Low-risk findings worth noting
task.mdevals/scenario-32/
Terraform: Repeatable Block Serialization Shape
Write an OPA policy that denies docker_container resources being created or
updated without dropping all Linux capabilities.
The container must set capabilities { drop = ["ALL"] } in its Terraform
configuration. Deny the resource if this is missing, or if "ALL" is not
present in the drop list.
Note: in terraform show -json plan output, a repeatable HCL block (one
written as capabilities { ... } rather than as an attribute) is serialized
as a list of 0 or 1 objects, not as a bare object. A container with no
capabilities block at all will show "capabilities": [] in the plan JSON —
not a missing key and not {}.
.tessl-plugin
evals
scenario-1
scenario-2
scenario-3
scenario-4
scenario-5
scenario-6
scenario-7
scenario-8
scenario-9
scenario-10
scenario-11
scenario-12
scenario-13
scenario-14
scenario-15
scenario-16
scenario-17
scenario-18
scenario-19
scenario-20
scenario-21
scenario-22
scenario-23
scenario-24
scenario-25
scenario-26
scenario-27
scenario-28
scenario-29
scenario-30
scenario-31
scenario-32
skills
rego-domain-reference
references