open-policy-agent / library Goto Github PK

When adding a patch for an annotation with a path like /metadata/annotations/kubernetes.io/role the annotation isn't added, and any existing annotations are removed.
This happens whether or not there are any existing annotations in that path.

Each PR should be tested and checked before merge is allowed. See OPA for Travis CI setup.

According to https://kubernetes.io/docs/reference/access-authn-authz/extensible-admission-controllers/ the response needs to look like this

{
  "apiVersion": "admission.k8s.io/v1",
  "kind": "AdmissionReview",
  "response": {
    "uid": "<value from request.uid>",
    "allowed": true
  }
}

The library should include a Makefile with common targets to help develop policies.

• test : run all tests (see open-policy-agent/opa#428)
• check : run all linters (for now this would be a wrapper around opa fmt)

Repeatedly, the handling of time and date using nanoseconds has gotten people stumbling.

The situation could perhaps be improved if we had some rego-only helper methods? I'm imaging something like

days(n) = x {
  x := n * hours(24)
}

hours(n) = x {
  x := n * minutes(60)
}

minutes(n) = x {
  x := n * seconds(60)
}

seconds(n) = x {
  x := n * 1000000000
}

So that you could write time.now_ns() - time.days(1) etc.

This would be similar to how golang does it in time's constants.