Skip to content

Commit 015175c

Browse files
authored
docs: Make iteration content flow better (#8064)
Also condense the main intro on this page. This has been done in response to https://openpolicyagent.slack.com/archives/C08V59T3NAF/p1763518441971569 Signed-off-by: Charlie Egan <[email protected]>
1 parent f34b921 commit 015175c

File tree

1 file changed

+20
-21
lines changed

1 file changed

+20
-21
lines changed

docs/docs/index.md

Lines changed: 20 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,12 @@ code and simple APIs to offload policy decision-making from your software. You
1010
can use OPA to enforce policies in microservices, Kubernetes, CI/CD pipelines,
1111
API gateways, and more.
1212

13-
OPA was originally created by [Styra](https://www.styra.com) and is proud to be
14-
a graduated project in the [Cloud Native Computing Foundation
15-
(CNCF)](https://www.cncf.io/) landscape. For details read the CNCF
16-
[announcement](https://www.cncf.io/announcements/2021/02/04/cloud-native-computing-foundation-announces-open-policy-agent-graduation/).
13+
OPA is proud to be a graduated
14+
[Cloud Native Computing Foundation (CNCF)](https://www.cncf.io/announcements/2021/02/04/cloud-native-computing-foundation-announces-open-policy-agent-graduation/)
15+
project.
1716

18-
Read this page to learn about the core concepts in OPA's policy language
19-
([Rego](./docs/policy-language)) as well as how to download, run, and integrate OPA.
17+
This page covers core concepts in OPA's policy language
18+
([Rego](./docs/policy-language)) as well as how to download and run OPA.
2019

2120
## What is OPA?
2221

@@ -274,23 +273,19 @@ output if {
274273

275274
<RunSnippet files="#input.json" command="data.servers.output"/>
276275

277-
Like other declarative languages (e.g., SQL), iteration in Rego happens
278-
implicitly when you inject variables into expressions.
279-
280-
There are explicit iteration constructs to express _FOR ALL_ and _FOR SOME_, [see below](#for-some-and-for-all).
276+
Imagine you need to check if any networks are public. Recall that the networks
277+
are supplied inside an array:
281278

282-
To understand how iteration works in Rego, imagine you need to check if any
283-
networks are public. Recall that the networks are supplied inside an array:
284279
`[{"id": "net1", "public": false}, {"id": "net2", "public": false}, ...]`
285280

286-
One option would be to test each network in the input (which is undefined since
287-
networks 1 and 2 are not public). Incremental definitions of a rule are
288-
[OR'd together](#logical-or) so if any are true, the result of the whole rule is
289-
true.
281+
To solve this problem, you might naively first think to test each network
282+
individually by checking specific array indices like this:
290283

291284
```rego
292285
package servers
293286
287+
# if any are true, the result of the exists_public_network is true.
288+
294289
exists_public_network if input.networks[0].public == true
295290
# or
296291
exists_public_network if input.networks[1].public == true
@@ -303,9 +298,12 @@ exists_public_network if input.networks[3].public == true
303298

304299
<RunSnippet files="#input.json" command="data.servers.exists_public_network"/>
305300

306-
**This approach is problematic**. There may be too many networks to list
307-
statically, or more importantly, the number of networks may not be known in
308-
advance. In Rego, the solution is to substitute the array index with a variable.
301+
This approach is problematic, there may be too many networks to list statically,
302+
the number of networks may not be known in advance.
303+
304+
Like other declarative languages (e.g., SQL), iteration in Rego happens
305+
implicitly when you inject variables into expressions. The solution for this
306+
case is to substitute the array index with a variable:
309307

310308
```rego
311309
package servers
@@ -323,8 +321,9 @@ you substitute variables in references, OPA automatically finds variable
323321
assignments that satisfy all of the expressions in the query. Just like
324322
intermediate variables, OPA returns the values of the variables.
325323

326-
You can substitute as many variables as you want. For example, to find out if
327-
any servers expose the insecure `"http"` protocol you could write:
324+
You can substitute as many variables as you want to do nested iteration. For
325+
example, to find out if any servers expose the insecure `"http"` protocol you
326+
could write:
328327

329328
```rego
330329
package servers

0 commit comments

Comments
 (0)