Rego Language

A Rego rule cannot invent a fact. It must be loaded into the engine before the query, supplied by the caller inside the query itself, or fetched during evaluation with http.send. Nothing else reaches a rule.

OPA v1 makes if and contains mandatory, so a partial set rule must read deny contains msg if { ... }. The bare v0 head is a parse error, not a deprecation. import rego.v1 opts a single file into v1 syntax on an older engine.

input is the document the caller sends with a single query, the thing being judged. data is the tree the engine already holds: JSON loaded alongside the policy, plus the virtual documents that rules themselves define.

False is a value; undefined means Rego found no value at all. Both stop a rule body, but false is an answer, while undefined leaves the rule with no result to emit and no error to report.

:= declares a local variable and assigns a value to it. == compares two values that are already bound and yields true or false. = unifies: it binds whichever side is still unbound, and compares when both sides are bound.

opa test evaluates every rule whose name begins with test_, in any package it loaded. A test passes if that rule evaluates to a defined value that is not false, and fails if it is undefined or false.

A deny set treats absence of messages as approval, so anything that stops the rule from matching produces a pass. A complete allow rule with default false has an explicit value of false whenever its body does not succeed, so absence of evidence becomes a denial.

Use object.get whenever the field is optional and the rule must still reach a verdict. A direct reference to a missing key is undefined, so the whole rule body stops and yields nothing; object.get substitutes your default and evaluation continues.

A complete rule defines at most one value and is undefined when no body succeeds. A partial set rule, written with contains, collects elements; a partial object rule, written with a bracketed key, collects pairs. Partial rules are always defined.

A missing key makes the reference undefined rather than false, and undefined propagates through the whole body. The rule then contributes no message, the deny set stays empty, and the gate reports a clean pass with nothing to alert on.

The underscore is an anonymous variable, so the reference iterates: OPA tries every element of the array and the expression succeeds if at least one element makes it hold. Each underscore is a separate variable whose value you cannot refer to later.

with substitutes a document only while the single expression it is attached to is evaluated. with input as {...} swaps the whole input document, and with data.waivers as {...} swaps that one path under data. Nothing persists afterwards.

The helper is undefined for that input, and an undefined call makes the whole rule body undefined. A partial deny rule with an undefined body adds no message, so the image passes. Undefined is not false.

Reproduce it locally with opa eval on the same template, add a print of the resource id and the value the rule reads, and read it back with --explain=notes. Then fix the message to carry that context.

Profile with opa eval --profile: the top row is the comparison inside the scan, its redo count near the record count. Fix the data shape — key the inventory by namespace name so the lookup is one reference.

Use a function when one check must run over several different values: it takes arguments and evaluates per call site. Use a helper rule when the value depends only on the input, so OPA computes it once.

walk emits one [path, value] pair for every node in the document, starting with the root itself. The path is an array of object keys and array indexes; the value is the whole subtree sitting at that path.

print() is Rego's debugging built-in. It writes its arguments to the stderr of the tool evaluating the policy and always succeeds, so adding it never changes a decision. The JSON result on stdout never contains it.

opa test --coverage marks every expression the tests actually evaluated, reported per file with a percentage. That proves the policy text ran; it does not prove the rule decided correctly, and it says nothing about which inputs were tried.

In Rego's http.send, timeout bounds how long evaluation waits. raise_error decides whether a failed call aborts evaluation or returns an error field. force_cache reuses a response across queries for force_cache_duration_seconds, ignoring the server's cache headers.

Use the with keyword to replace evaluation context: with input as {...} supplies a fake document, with data.x as {...} replaces a data subtree, and with http.send as {...} mocks the built-in, so opa test runs offline and deterministically.

Rego allows a name to be defined twice, but a function must not produce two different values for the same arguments. When both definitions hold and disagree, OPA fails the query with a conflict error.

It succeeds. A negated expression in Rego is satisfied whenever the inner expression is undefined or false, so a negated reference to a path that does not exist always passes — absent and explicitly-not-set look identical to the rule.

Use the every keyword: every c in the container list, the body asserting the limits exist. The alternative is to find a counterexample with iteration and negate it. Plain iteration cannot express this, because an unbound variable means at least one element.

It runs partial evaluation at build time, specialising the policy for named entrypoints against the data packaged in the bundle. You must supply at least one entrypoint; without one there is nothing for the optimiser to specialise towards.

It returns a residual policy rather than a decision. OPA evaluates every expression it can already decide, then hands back the conditions that still depend on the unknown values, plus any support rules those conditions reference.

A waived repository then produces output identical to a compliant one: no messages, exit zero. You lose the ability to tell an exception from a pass, to count how many waivers are live, and to notice when the rule stopped firing at all.

Separate evaluated-and-found-nothing from never-loaded. Ask the running engine which modules it holds and whether its bundle activated, then replay the exact input against that same bundle. A bundle that fails to compile is rejected whole, leaving older policy serving.

Walk the whole bundle instead of enumerating paths: for every node that is an object whose apiVersion is in your removed set, emit a warning that includes the walk path. The path is what makes the advisory list actionable.