Search code examples
open-policy-agent

Will other rule results impact the correctness of the policy?


I am working on a rego policy that has multiple conditions. Each condition needs to make a call to the same endpoint of a REST api.

I have managed to retain the result of the service call as a result of another rule.

The result of the Evaluate Package command (VS Code with OPA extension) on the policy looks like this now:

[ [ { "allow": false, "someProp": [ "N/A" ] } ] ]

Will this affect the correctness of the policy once it gets deployed to the server?

EDIT

Until my changes, the policy only returned allow.


Solution

  • The "evaluate package" feature of the VS Code plugin does pretty much just that :) i.e. it evaluates the whole package including all rules. You'll see the same default behavior in the Rego Playground, since it's a pretty good way of learning what's going on to see what all rules evaluate to.

    When running OPA as a server (or by all means, opa eval), you'll commonly query only the specific rule you're interested in, so if in your case you had defined your policy in a package called mypolicy a request to the OPA REST API might be sent to the /v1/data/mypolicy/allow endpoint to evaluate only the allow rule rathe than the whole package (which could be queried at /v1/data/mypolicy.