mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
Sebastian Spaink
8e2f1807ac
Part of #2745 Like most of his ideas, @anderseknert's suggestion to use Rego to replace the `validateAndInjectDefaults` functions throughout the codebase is another winner. This PR starts the migration by replacing the top-level `validateAndInjectDefaults` in `v1/config/config.go` with an embedded policy, `validate.rego`. The policy injects the top-level defaults (`default_decision`, `default_authorization_decision`, `labels`) and reports unrecognized configuration options, so a typo such as `decision_log` instead of `decision_logs` is logged as a warning at startup rather than silently ignored. It's evaluated in `ParseConfig` using the low-level `ast`/`topdown` packages rather than the top-level `rego` package. This keeps `config` off the heavy `rego → bundle → …` dependency web (which would otherwise create import cycles as more packages' tests reach `config`), and we don't need any of the `rego` package's conveniences here — it's one module compiled once and a single query. The Rego unit tests run in CI via `build/run-rego-tests.sh` (and locally with `make rego-test`). This sets the foundation for the other plugin `validateAndInjectDefaults` functions to migrate to Rego as well; where the logic isn't too complicated it should be a fairly easy replacement. At the moment all known keys live in `validate.rego` under `_specs` to support the "warn on unrecognized options" check, but the plugin-specific entries can move closer to each plugin as it migrates. It would also be nice for `_specs` to be auto-generated somehow in the future. Supporting extension of config validation with custom policies is something I'd like to follow up with, so keeping #2745 open for now. I also think these policies could be reusable with [java-opa-sdk](https://github.com/open-policy-agent/java-opa-sdk) 👀 Signed-off-by: Sebastian Spaink <sebastianspaink@gmail.com>
31 lines
792 B
Bash
Executable File
31 lines
792 B
Bash
Executable File
#!/usr/bin/env bash
|
|
# Runs `opa test` over every directory that contains *_test.rego files, so Rego
|
|
# unit tests for embedded/internal policies are exercised in CI. build/policy is
|
|
# excluded because it is tested separately with its JSON schemas; test fixtures
|
|
# are excluded because they are not meant to be run as tests.
|
|
set -euo pipefail
|
|
|
|
OPA="${OPA:-opa}"
|
|
|
|
dirs=$(find . -name '*_test.rego' \
|
|
-not -path './build/policy/*' \
|
|
-not -path '*/testdata/*' \
|
|
-not -path '*/testfiles/*' \
|
|
-not -path '*/node_modules/*' \
|
|
-not -path './.git/*' \
|
|
-not -path './.claude/*' \
|
|
-exec dirname {} \; | sort -u)
|
|
|
|
if [ -z "$dirs" ]; then
|
|
echo "No Rego test directories found."
|
|
exit 0
|
|
fi
|
|
|
|
status=0
|
|
for d in $dirs; do
|
|
echo "==> ${OPA} test ${d}"
|
|
"$OPA" test "$d" || status=1
|
|
done
|
|
|
|
exit "$status"
|