Rego language preview

1. HTTP API authorization

allow rules referencing input.method and input.path

horizon-dark

package authz

import future.keywords.if

default allow := false

allow if {
	input.method == "GET"
	startswith(input.path, "/public")
}

allow if {
	input.method == "POST"
	input.path == "/login"
}

allow if {
	some role in input.user.roles
	role == "admin"
}

atom-one-dark

package authz

import future.keywords.if

default allow := false

allow if {
	input.method == "GET"
	startswith(input.path, "/public")
}

allow if {
	input.method == "POST"
	input.path == "/login"
}

allow if {
	some role in input.user.roles
	role == "admin"
}

github-dark

package authz

import future.keywords.if

default allow := false

allow if {
	input.method == "GET"
	startswith(input.path, "/public")
}

allow if {
	input.method == "POST"
	input.path == "/login"
}

allow if {
	some role in input.user.roles
	role == "admin"
}

dracula

package authz

import future.keywords.if

default allow := false

allow if {
	input.method == "GET"
	startswith(input.path, "/public")
}

allow if {
	input.method == "POST"
	input.path == "/login"
}

allow if {
	some role in input.user.roles
	role == "admin"
}

nord

package authz

import future.keywords.if

default allow := false

allow if {
	input.method == "GET"
	startswith(input.path, "/public")
}

allow if {
	input.method == "POST"
	input.path == "/login"
}

allow if {
	some role in input.user.roles
	role == "admin"
}

github

package authz

import future.keywords.if

default allow := false

allow if {
	input.method == "GET"
	startswith(input.path, "/public")
}

allow if {
	input.method == "POST"
	input.path == "/login"
}

allow if {
	some role in input.user.roles
	role == "admin"
}

2. Kubernetes admission control

deny rules for pod security policy

horizon-dark

package kubernetes.admission

import future.keywords.if
import future.keywords.in
import future.keywords.contains

deny contains msg if {
	some container in input.request.object.spec.containers
	container.image == ""
	msg := sprintf("container %v has no image", [container.name])
}

deny contains msg if {
	not input.request.object.spec.securityContext.runAsNonRoot
	msg := "pods must not run as root"
}

deny contains msg if {
	input.request.kind.kind == "Pod"
	count(input.request.object.spec.containers) == 0
	msg := "pod must define at least one container"
}

atom-one-dark

package kubernetes.admission

import future.keywords.if
import future.keywords.in
import future.keywords.contains

deny contains msg if {
	some container in input.request.object.spec.containers
	container.image == ""
	msg := sprintf("container %v has no image", [container.name])
}

deny contains msg if {
	not input.request.object.spec.securityContext.runAsNonRoot
	msg := "pods must not run as root"
}

deny contains msg if {
	input.request.kind.kind == "Pod"
	count(input.request.object.spec.containers) == 0
	msg := "pod must define at least one container"
}

github-dark

package kubernetes.admission

import future.keywords.if
import future.keywords.in
import future.keywords.contains

deny contains msg if {
	some container in input.request.object.spec.containers
	container.image == ""
	msg := sprintf("container %v has no image", [container.name])
}

deny contains msg if {
	not input.request.object.spec.securityContext.runAsNonRoot
	msg := "pods must not run as root"
}

deny contains msg if {
	input.request.kind.kind == "Pod"
	count(input.request.object.spec.containers) == 0
	msg := "pod must define at least one container"
}

dracula

package kubernetes.admission

import future.keywords.if
import future.keywords.in
import future.keywords.contains

deny contains msg if {
	some container in input.request.object.spec.containers
	container.image == ""
	msg := sprintf("container %v has no image", [container.name])
}

deny contains msg if {
	not input.request.object.spec.securityContext.runAsNonRoot
	msg := "pods must not run as root"
}

deny contains msg if {
	input.request.kind.kind == "Pod"
	count(input.request.object.spec.containers) == 0
	msg := "pod must define at least one container"
}

nord

package kubernetes.admission

import future.keywords.if
import future.keywords.in
import future.keywords.contains

deny contains msg if {
	some container in input.request.object.spec.containers
	container.image == ""
	msg := sprintf("container %v has no image", [container.name])
}

deny contains msg if {
	not input.request.object.spec.securityContext.runAsNonRoot
	msg := "pods must not run as root"
}

deny contains msg if {
	input.request.kind.kind == "Pod"
	count(input.request.object.spec.containers) == 0
	msg := "pod must define at least one container"
}

github

package kubernetes.admission

import future.keywords.if
import future.keywords.in
import future.keywords.contains

deny contains msg if {
	some container in input.request.object.spec.containers
	container.image == ""
	msg := sprintf("container %v has no image", [container.name])
}

deny contains msg if {
	not input.request.object.spec.securityContext.runAsNonRoot
	msg := "pods must not run as root"
}

deny contains msg if {
	input.request.kind.kind == "Pod"
	count(input.request.object.spec.containers) == 0
	msg := "pod must define at least one container"
}

3. Function-style rule heads

helper functions with (params), not just partial sets

horizon-dark

package authz

is_valid_user(u) {
	u.age >= 18
	u.status == "active"
}

allow if {
	is_valid_user(input.user)
	count(input.user.roles) > 0
}

atom-one-dark

package authz

is_valid_user(u) {
	u.age >= 18
	u.status == "active"
}

allow if {
	is_valid_user(input.user)
	count(input.user.roles) > 0
}

github-dark

package authz

is_valid_user(u) {
	u.age >= 18
	u.status == "active"
}

allow if {
	is_valid_user(input.user)
	count(input.user.roles) > 0
}

dracula

package authz

is_valid_user(u) {
	u.age >= 18
	u.status == "active"
}

allow if {
	is_valid_user(input.user)
	count(input.user.roles) > 0
}

nord

package authz

is_valid_user(u) {
	u.age >= 18
	u.status == "active"
}

allow if {
	is_valid_user(input.user)
	count(input.user.roles) > 0
}

github

package authz

is_valid_user(u) {
	u.age >= 18
	u.status == "active"
}

allow if {
	is_valid_user(input.user)
	count(input.user.roles) > 0
}

4. Data references and built-ins

object, string, and aggregate built-in functions

horizon-dark

package rbac

user_roles[user] := roles if {
	some user
	roles := {role |
		some binding in data.role_bindings
		binding.user == user
		role := binding.role
	}
}

allowed_actions := object.get(data.permissions, input.role, [])

is_owner if {
	input.resource.owner == input.user.id
}

# require at least one matching permission
authorized if {
	count(allowed_actions) > 0
	input.action in allowed_actions
}

atom-one-dark

package rbac

user_roles[user] := roles if {
	some user
	roles := {role |
		some binding in data.role_bindings
		binding.user == user
		role := binding.role
	}
}

allowed_actions := object.get(data.permissions, input.role, [])

is_owner if {
	input.resource.owner == input.user.id
}

# require at least one matching permission
authorized if {
	count(allowed_actions) > 0
	input.action in allowed_actions
}

github-dark

package rbac

user_roles[user] := roles if {
	some user
	roles := {role |
		some binding in data.role_bindings
		binding.user == user
		role := binding.role
	}
}

allowed_actions := object.get(data.permissions, input.role, [])

is_owner if {
	input.resource.owner == input.user.id
}

# require at least one matching permission
authorized if {
	count(allowed_actions) > 0
	input.action in allowed_actions
}

dracula

package rbac

user_roles[user] := roles if {
	some user
	roles := {role |
		some binding in data.role_bindings
		binding.user == user
		role := binding.role
	}
}

allowed_actions := object.get(data.permissions, input.role, [])

is_owner if {
	input.resource.owner == input.user.id
}

# require at least one matching permission
authorized if {
	count(allowed_actions) > 0
	input.action in allowed_actions
}

nord

package rbac

user_roles[user] := roles if {
	some user
	roles := {role |
		some binding in data.role_bindings
		binding.user == user
		role := binding.role
	}
}

allowed_actions := object.get(data.permissions, input.role, [])

is_owner if {
	input.resource.owner == input.user.id
}

# require at least one matching permission
authorized if {
	count(allowed_actions) > 0
	input.action in allowed_actions
}

github

package rbac

user_roles[user] := roles if {
	some user
	roles := {role |
		some binding in data.role_bindings
		binding.user == user
		role := binding.role
	}
}

allowed_actions := object.get(data.permissions, input.role, [])

is_owner if {
	input.resource.owner == input.user.id
}

# require at least one matching permission
authorized if {
	count(allowed_actions) > 0
	input.action in allowed_actions
}