eval+rego: Support caching output of non-deterministic builtins. (#4926)

This commit includes evaluator support for an opt-in, non-deterministic
builtins caching system, designed to help with future replay of decision
logs.

The cache allows early-exit in the evaluator if the builtin is
non-deterministic, and has already cached a result. Since the cache can
be pre-populated by `rego` module users, this should make offline policy
testing and future work around decision replay more straightforward.

Fixes: #1514

Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
This commit is contained in:
Philip Conrad
2022-09-01 11:35:09 -04:00
committed by GitHub
parent 1e12cc2edf
commit 01fc9ec013
15 changed files with 355 additions and 31 deletions
+18 -9
View File
@@ -1284,7 +1284,8 @@
"type": "object"
},
"type": "function"
}
},
"nondeterministic": true
},
{
"name": "indexof",
@@ -1493,7 +1494,8 @@
"type": "array"
},
"type": "function"
}
},
"nondeterministic": true
},
{
"name": "io.jwt.encode_sign",
@@ -1537,7 +1539,8 @@
"type": "string"
},
"type": "function"
}
},
"nondeterministic": true
},
{
"name": "io.jwt.encode_sign_raw",
@@ -1557,7 +1560,8 @@
"type": "string"
},
"type": "function"
}
},
"nondeterministic": true
},
{
"name": "io.jwt.verify_es256",
@@ -2529,7 +2533,8 @@
"type": "set"
},
"type": "function"
}
},
"nondeterministic": true
},
{
"name": "numbers.range",
@@ -2819,7 +2824,8 @@
"type": "object"
},
"type": "function"
}
},
"nondeterministic": true
},
{
"name": "or",
@@ -2918,7 +2924,8 @@
"type": "number"
},
"type": "function"
}
},
"nondeterministic": true
},
{
"name": "re_match",
@@ -3690,7 +3697,8 @@
"type": "number"
},
"type": "function"
}
},
"nondeterministic": true
},
{
"name": "time.parse_duration_ns",
@@ -4091,7 +4099,8 @@
"type": "string"
},
"type": "function"
}
},
"nondeterministic": true
},
{
"name": "walk",