@@ -10,13 +10,12 @@ code and simple APIs to offload policy decision-making from your software. You
1010can use OPA to enforce policies in microservices, Kubernetes, CI/CD pipelines,
1111API gateways, and more.
1212
13- OPA was originally created by [ Styra] ( https://www.styra.com ) and is proud to be
14- a graduated project in the [ Cloud Native Computing Foundation
15- (CNCF)] ( https://www.cncf.io/ ) landscape. For details read the CNCF
16- [ announcement] ( https://www.cncf.io/announcements/2021/02/04/cloud-native-computing-foundation-announces-open-policy-agent-graduation/ ) .
13+ OPA is proud to be a graduated
14+ [ Cloud Native Computing Foundation (CNCF)] ( https://www.cncf.io/announcements/2021/02/04/cloud-native-computing-foundation-announces-open-policy-agent-graduation/ )
15+ project.
1716
18- Read this page to learn about the core concepts in OPA's policy language
19- ([ Rego] ( ./docs/policy-language ) ) as well as how to download, run, and integrate OPA.
17+ This page covers core concepts in OPA's policy language
18+ ([ Rego] ( ./docs/policy-language ) ) as well as how to download and run OPA.
2019
2120## What is OPA?
2221
@@ -274,23 +273,19 @@ output if {
274273
275274<RunSnippet files =" #input.json " command =" data.servers.output " />
276275
277- Like other declarative languages (e.g., SQL), iteration in Rego happens
278- implicitly when you inject variables into expressions.
279-
280- There are explicit iteration constructs to express _ FOR ALL_ and _ FOR SOME_ , [ see below] ( #for-some-and-for-all ) .
276+ Imagine you need to check if any networks are public. Recall that the networks
277+ are supplied inside an array:
281278
282- To understand how iteration works in Rego, imagine you need to check if any
283- networks are public. Recall that the networks are supplied inside an array:
284279` [{"id": "net1", "public": false}, {"id": "net2", "public": false}, ...] `
285280
286- One option would be to test each network in the input (which is undefined since
287- networks 1 and 2 are not public). Incremental definitions of a rule are
288- [ OR'd together] ( #logical-or ) so if any are true, the result of the whole rule is
289- true.
281+ To solve this problem, you might naively first think to test each network
282+ individually by checking specific array indices like this:
290283
291284``` rego
292285package servers
293286
287+ # if any are true, the result of the exists_public_network is true.
288+
294289exists_public_network if input.networks[0].public == true
295290# or
296291exists_public_network if input.networks[1].public == true
@@ -303,9 +298,12 @@ exists_public_network if input.networks[3].public == true
303298
304299<RunSnippet files =" #input.json " command =" data.servers.exists_public_network " />
305300
306- ** This approach is problematic** . There may be too many networks to list
307- statically, or more importantly, the number of networks may not be known in
308- advance. In Rego, the solution is to substitute the array index with a variable.
301+ This approach is problematic, there may be too many networks to list statically,
302+ the number of networks may not be known in advance.
303+
304+ Like other declarative languages (e.g., SQL), iteration in Rego happens
305+ implicitly when you inject variables into expressions. The solution for this
306+ case is to substitute the array index with a variable:
309307
310308``` rego
311309package servers
@@ -323,8 +321,9 @@ you substitute variables in references, OPA automatically finds variable
323321assignments that satisfy all of the expressions in the query. Just like
324322intermediate variables, OPA returns the values of the variables.
325323
326- You can substitute as many variables as you want. For example, to find out if
327- any servers expose the insecure ` "http" ` protocol you could write:
324+ You can substitute as many variables as you want to do nested iteration. For
325+ example, to find out if any servers expose the insecure ` "http" ` protocol you
326+ could write:
328327
329328``` rego
330329package servers
0 commit comments