Default rule engine to Rego v1#179
Conversation
|
🎯 Code Coverage (details) 🔗 Commit SHA: fdb17b0 | Docs | Datadog PR Page | Give us feedback! |
1e7832e to
da7fb03
Compare
da7fb03 to
fdb17b0
Compare
ChouraquiBen
left a comment
ChouraquiBen
left a comment
There was a problem hiding this comment.
nit: it would've made the review easier if the PR had been split between the formatting, the changes in the regos to make them have the v1 syntax and one for the changes in the go code.
I left a comment that may be naive, correct me if I am wrong.
| result.path == "spec" | ||
| result.spec.containers[0].name == "test" | ||
| test_get_spec_info_job_template if { | ||
| resource := {"spec": {"job_template": {"spec": {"template": {"spec": {"containers": [{"name": "test"}]}}}}}} |
There was a problem hiding this comment.
nit: imho, I preferred the previous formatting
There was a problem hiding this comment.
I agree it's less readable, but this is opa fmt output, overriding it manually would immediately cause the test-rego-libraries check to fail
| rego.Module("Common", q.commonLibrary.LibraryCode), | ||
| rego.Module("Generic", platformGeneralQuery.LibraryCode), | ||
| rego.Module(query.Query, query.Content), | ||
| rego.Module("dd_iac_compat.rego", utils.RegoCompatShim), |
There was a problem hiding this comment.
Question: Isn't it possible to just add the rego version here to declare it in the files just like you did with the regoshim? This would be convenient to write import rego.v1 only once here
There was a problem hiding this comment.
The rules still need to use the v1 format, so no, it would not be enough
There was a problem hiding this comment.
Yes, I am planning on cleaning up afterwards
2 participants
Motivation
Rego v1 is the current OPA syntax and is the syntax expected for future custom IaC rules. This PR updates the scanner engine and embedded rule assets so generated and authored rules can use Rego v1 directly.
Changes
Rule engine
The engine now prepares rules with Rego v1 enabled and parses coverage modules with Rego v1 parser options. The compatibility query shim was updated to v1 syntax while preserving support for the existing result contract.
Embedded Rego assets
Shared libraries, library tests, and scanner test fixtures were migrated to Rego v1 syntax. Removed builtins were replaced with equivalent rule logic where needed.
Author Checklist
QA Instruction
opa test assets/libraries/go build ./...go test $(go list ./... | grep -v e2e) -count=1./tool.sh testin the companion default-rules repo with a local workspace replacement pointing at this branch (PASS: 1397 rules)../tool.sh testin the companion default-rules repo with the released scanner dependency (github.com/DataDog/datadog-iac-scanner v1.4.0) also passed (PASS: 1397 rules).Deployment order
iac-scanningin dd-source and deploy.Do not deploy this binary before step 1 is complete in production. The v1-default engine rejects v0-syntax rules, so all rules must be migrated first.
Blast Radius
This impacts scanner rule compilation and embedded Rego libraries. Existing default rules are covered by the companion rules migration, and custom rules are not yet released.
Additional Notes
Companion default-rules PR: https://github.com/DataDog/datadog-iac-scanner-default-rules/pull/31
I submit this contribution under the Apache-2.0 license.