fugue / regula

Regula checks infrastructure as code templates (Terraform, CloudFormation, k8s manifests) for AWS, Azure, Google Cloud, and Kubernetes security and compliance using Open Policy Agent/Rego

Home Page:https://regula.dev/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

[Question] Is there a way to run regula policy as OPA Gatekeeper constraint template

apratinav-intuit opened this issue · comments

OPA Gatekeeper enables scanning of k8s resource through constraint template. Right now constraint template expects rego policy in a certain format which is similar to how conftest based policies are written.

When trying to use regula based policy in constraint template it fails with 422 invalid request error.

I1020 23:12:25.130565   37384 request.go:1073] Response Body: {"kind":"Status","apiVersion":"v1","metadata":{},"status":"Failure","message":"admission webhook \"validation.gatekeeper.sh\" denied the request: invalid ConstraintTemplate: invalid rego: invalid module: missing required rules: [violation]","code":422}
.
.
The request is invalid

I am wondering if there is a way to run regula based policy directly in constraint template that works with OPA gatekeeper. I also saw there is regula+conftest integration available, but I could not figure out if there is anything we can do to run regula based policy as part of OPA Gatekeeper.

I would like to seek any guidance or feedback if there is anything that we can do to run regula based policy in OPA Gatekeeper.

If there is no option available, what are the possibility of extending OPA Gatekeeper to support regula based policy? I think this would really benefit policy author who wants to use regula format when working with OPA Gatekeeper.