时间戳

首页 > 解决方案 > Kubernetes Open Policy Agent (OPA) If Else

kubernetes - Kubernetes Open Policy Agent (OPA) If Else

问题描述

我正在尝试在这样的变异规则中实现 if else 子句...

a := {
 "alb.ingress.kubernetes.io/healthcheck-path": "/healthz",
"alb.ingress.kubernetes.io/listen-ports": `[{"HTTPS": 443}]`
}

b := {
  "alb.ingress.kubernetes.io/target-type": "ip",
   "alb.ingress.kubernetes.io/ssl-policy": "ELBSecurityPolicy-TLS-1-2-2017-01"
}

annotations := merge_objects(a,b) {
   kinds[input.request.object.kind] == "Ingress"
}

什么是正确的语法？

标签： kubernetesopen-policy-agentrego

解决方案

如果您希望注释为空，除非类型匹配Ingress，您可以执行以下操作，使用else：

a := {
    "alb.ingress.kubernetes.io/healthcheck-path": "/healthz",
    "alb.ingress.kubernetes.io/listen-ports": `[{"HTTPS": 443}]`
}

b := {
    "alb.ingress.kubernetes.io/target-type": "ip",
    "alb.ingress.kubernetes.io/ssl-policy": "ELBSecurityPolicy-TLS-1-2-2017-01"
}

annotations = object.union(a, b) {
    kinds[input.request.object.kind] == "Ingress"
} else = {}

更惯用的 Rego 可能会使用默认值annotations：

default annotations = {}

annotations = object.union(a, b) {
    kinds[input.request.object.kind] == "Ingress"
}

推荐阅读