Rego检查env值文件

Question

我是Rego的新人。我有helm模板的值文件，并希望检查全局部分中所有env (envmap或envNginxSocket、envPhpSocket等)是否都在引号中。例如，REDIS_PORT: 6379 -值不能没有引号.这是我的值文件

global:
  release: &release "{{ .ReleaseTag }}"
  env: "{{ .Environment }}"
  namespace: &namespace "{{ .Namespace }}"
  cluster: "{{ .Cluster }}"
  envMap: &service-env
    APP_ENV: "prod"
    APP_DEBUG: "0"
    WEB_HOST: "https://example.com"
    ENDPOINT_PATH: "/api"
    JWT_SECRET_KEY: "%kernel.project_dir%/config/jwt/private.pem"
    JWT_PUBLIC_KEY: "%kernel.project_dir%/config/jwt/public.pem"
    JWT_TOKEN_TTL: "86400"
    REFRESH_JWT_TOKEN_TTL: "2592000"
    LOG_ENVIRONMENT: "prod"
    REDIS_HOST: "redis.service.consul"
    REDIS_PORT: "6379"
    ...
  envNginxSocket: &nginx-socket-env
    BACKEND_LISTEN: "unix:/tmp/php/php.socket"
    FCGI_CONNECT: "/tmp/php/php.socket"
    PHP_FPM_SCRAPE_URI: "unix:///tmp/php/php.socket;/status"
    ...
  envPhpSocket: &php-socket-env
    PHP_WWW_PM_MAX_CHILD: "32"
    PHP_WWW_LISTEN: "/tmp/php/php.socket"
    FCGI_CONNECT: "/tmp/php/php.socket"
    ...

我的计划

1. 输入全局节
2. 筛选器仅用于env*
3. 检查值

但我不知道如何从2步到3步。这是我的密码

violation[msg] {
    some key
    k8s_values := input.global[key]
    c := split(concat(",", [ v | v := key ]), ",")
    arr := [cont | cont = c[i] ; regex.match(".*env.*", c[i])]
    1 + 0 != 0 # only for check result
    msg := sprintf("%v | Values",[arr])
}

结果

+---------+-----------------------------+-----------+-----------------------------+
| RESULT  |            FILE             | NAMESPACE |           MESSAGE           |
+---------+-----------------------------+-----------+-----------------------------+
| failure | deployment/values-prod.yaml | main      | ["env"] | Values            |
| failure | deployment/values-prod.yaml | main      | ["envMap"] | Values         |
| failure | deployment/values-prod.yaml | main      | ["envNginxSocket"] | Values |
| failure | deployment/values-prod.yaml | main      | ["envPhpSocket"] | Values   |
| failure | deployment/values-prod.yaml | main      | [] | Values                 |
+---------+-----------------------------+-----------+-----------------------------+

有什么建议吗？

Answer 1

你是说像这样的事吗？

violation[msg] {
    value := input.global[group][key]
    startswith(group, "env")
    not is_string(value)
    msg := sprintf("%s in %s is not a string (%v)", [key, group, value])
}

交互式示例：https://play.openpolicyagent.org/p/Ckn9LvgBWG

如果这不会产生预期的结果，请指出我误解了什么。