I am looking to code rego to evaluate to false when the "type" == "SOA" or "MX"

[sbalakrishn]

Need Help !!! In Rego coding ...

I am looking to code rego to evaluate to false when the record "type" == "SOA" or "MX"
and true when they are not "SOA" and "MX"
But it is always evaluating to true even while I am using "!=" symbol

Shared the link below.

https://play.openpolicyagent.org/p/DEo9jsiDIX

[charlieegan3]

Hi @sbalakrishn, there are a few things going on here. I think that you might want to use the planned_values data. I've put together a playground that uses that here: https://play.openpolicyagent.org/p/yaR5KnliJt, I've removed the other keys from the top-level object for clarity. Hope that helps, if not, let me know in more detail about where the data is in the input that you need to check and I can have another go.

[sbalakrishn]

@charlieegan3
Firstly I would to thank you indeed for looking into this.

I had one question , If you can look into this code and let me know if this would be correct to code it this way ?

https://play.openpolicyagent.org/p/y8eV1Q066f

[sbalakrishn]

Yes I would like to check resources in all three, and make sure non of the records has "MX" and "SOA"
and if any of them have them it should evaluate to false .
I think your first code does that . Would I be right ?

[sbalakrishn]

Perhaps, this is the correct one that I am trying to achieve . Kindly check this one and if I can have your input on this code

https://play.openpolicyagent.org/p/tvvwIVLt1G

[charlieegan3]

Yes I would like to check resources in all three

Ok, I can have a go at that. My initial example does not do this.

[sbalakrishn]

I think your initial example helps. and does exactly what I am expected to do.
I just checked . I think your example aptly solves the problem
Thank you very much @charlieegan3

I cannot thank you enough for that Help ...God Bless...

[charlieegan3]

Ahh, ok. That's good. I was just about to show this: https://play.openpolicyagent.org/p/xDFTrXcoOW which is just to demonstrate that the data is not the same in each of the three lists of resources/changes. I think that the first example I provided is correct, so if that works for you then great!

No problem :)

[sbalakrishn]

Hi @charlieegan3

Sorry for disturbing you once again... But I need your help.....

With the code structure change the OPA code needs to be changed ,,,
I have a different JSON input and I am trying the same of - evaluating the OPA to false if the SOA and MX records are found in the JSON input.

Can you help me with this code. : https://play.openpolicyagent.org/p/NQTQdD0jNq

And I am getting the below error while I am evaluating OPA

To perform exactly these actions, run the following command to apply:
terraform apply "/root/.atlantis/repos/8x8/auto_gitops_dns_test_srj/7/default/domains/8x8.int/regions/sv1/sv1.8x8.int/records/a_records/default.tfplan"
8 errors occurred during loading:
/root/record_policy_check.rego:5: rego_parse_error: rule name conflicts with built-in function
/root/record_policy_check.rego:6: rego_parse_error: multiple expressions cannot be used for rule head
/root/record_policy_check.rego:11: rego_parse_error: rule name conflicts with built-in function
/root/record_policy_check.rego:12: rego_parse_error: multiple expressions cannot be used for rule head
/root/record_policy_check.rego:17: rego_parse_error: rule name conflicts with built-in function
/root/record_policy_check.rego:18: rego_parse_error: multiple expressions cannot be used for rule head
/root/record_policy_check.rego:23: rego_parse_error: rule name conflicts with built-in function
/root/record_policy_check.rego:24: rego_parse_error: multiple expressions cannot be used for rule head

[charlieegan3]

Hey

if the SOA and MX records are found in the JSON input.

Is the data you want to check in planned_values.root_module.resources?

https://play.openpolicyagent.org/p/lNYwhT1fYD will do that for you.

[sbalakrishn]

In both indeed.
The completed JSON file needs to be evaluated the complete file is what the requirement

[charlieegan3]

😕 hmm, but the only place that that the records types are shown is in the planned_values part of the data.

[sbalakrishn]

The first few lines .

{
"format_version": "1.1",
"terraform_version": "1.2.7",
"variables": {
"dns_records": {
"value": {
"rec0": {
"name": "ps12.dctest.io.",
"pdns_zone": "dctest.io",
"records": [
"10.10.33.138",
"10.10.33.129"
],
"ttl": "300",
"type": "A"
},
"rec1": {
"name": "sp.dctest.io.",
"pdns_zone": "dctest.io",
"records": [
"10.10.33.211",
"10.10.33.201"
],
"ttl": "300",
"type": "A"
},
"rec2": {
"name": "dc.dctest.io.",
"pdns_zone": "dctest.io",
"records": [
"8.8.1.8"
],
"ttl": "300",
"type": "A"
}
}
},

[sbalakrishn]

@charlieegan3 -- Thanks for the help once again. I have one small question for you.

I would like to take your opening on the Rego code that I have used to achieve this .
Is it advisable to use decision head to use "true" as its default value

such as this one >>> default allow_update = true

My code can be found here : https://play.openpolicyagent.org/p/1KHmGx00S8

This code looks to do its job by I am not sure if the default value can be true instead of false -- generally I have seen them setting it to false need your confirmation
In my case I have set the default value to true .

default allow_update := true
default allow_update_1 := true

[charlieegan3]

Whether or not the default value is true or false depends on how the rule is used. In this case I think it makes sense to use false. You rule will match the cases you want to test and be true if it's permitted. In all other cases (banned values, and invalid input) we want to return false.