cpa

Documentation

Index

• Variables
• type Decision
• type EvalOption
  • func Meta(value interface{}) EvalOption
• type LintError
  • func (e LintError) Error() string
  • func (LintError) Is(target error) bool
• type LintRule
  • func AllowedPackages(names ...string) LintRule
  • func DisallowMetaBranch() LintRule
• type MultiError
  • func (err MultiError) Error() string
  • func (err MultiError) Unwrap() []error
• type Policy
  • func LoadPolicyFromFS(root string) (*Policy, error)
  • func ParseBundle(files map[string]string) (*Policy, error)
  • func (policy Policy) Decide(ctx context.Context, input interface{}, opts ...EvalOption) (*Decision, error)
  • func (policy Policy) Eval(ctx context.Context, query string, input interface{}, opts ...EvalOption) (interface{}, error)
  • func (policy Policy) Modules() map[string]*ast.Module
  • func (policy Policy) Source() map[string]string
• type Status
• type Violation

Variables

var ErrLint = LintError("linting error")

var ErrNoPolicies = errors.New("no rego policies found")

Types

type Decision

type Decision struct {
	Status       Status      `json:"status"`
	Reason       string      `json:"reason,omitempty"`
	EnabledRules []string    `json:"enabled_rules,omitempty"`
	HardFailures []Violation `json:"hard_failures,omitempty"`
	SoftFailures []Violation `json:"soft_failures,omitempty"`
}

Decision is a circleci flavoured output representing a policy decision.

type EvalOption

type EvalOption func(*evalOptions)

func Meta

func Meta(value interface{}) EvalOption

Meta is an option that sets the data.meta property during policy evaluation.

type LintError

type LintError string

func (LintError) Error

func (e LintError) Error() string

func (LintError) Is

func (LintError) Is(target error) bool

type LintRule

type LintRule func(*ast.Module) error

func AllowedPackages

func AllowedPackages(names ...string) LintRule

func DisallowMetaBranch

func DisallowMetaBranch() LintRule

type MultiError

type MultiError []error

func (MultiError) Error

func (err MultiError) Error() string

func (MultiError) Unwrap

func (err MultiError) Unwrap() []error

type Policy

type Policy struct {
	// contains filtered or unexported fields
}

func LoadPolicyFromFS

func LoadPolicyFromFS(root string) (*Policy, error)

LoadPolicyFromFS takes a filesystem path to load policy files from. It returns a parsed policy. If the path is a file that policy is loaded as a bundle of 1 file. If the path is a directory that directory is walked recursively searching for all rego files. If the bundle is empty an error is returned.

func ParseBundle

func ParseBundle(files map[string]string) (*Policy, error)

ParseBundle will restrict package name to 'org'. This allows us to more easily extract information from the OPA output after evaluating a policy, because we know what the keys will be in the map that contains the results (e.g., map["org"]["enable_rule"] to find enabled rules).

func (Policy) Decide

func (policy Policy) Decide(ctx context.Context, input interface{}, opts ...EvalOption) (*Decision, error)

Decide takes an input and evaluates it against a policy. Evaluation options will be passed down to policy.Eval

func (Policy) Eval

func (policy Policy) Eval(ctx context.Context, query string, input interface{}, opts ...EvalOption) (interface{}, error)

Eval will run native OPA query against your document, input, and apply any evaluation options. It returns raw OPA expression values.

func (Policy) Modules

func (policy Policy) Modules() map[string]*ast.Module

Modules returns the built module map used in the opa compiler. It includes any circleci rego source imported in the source code.

func (Policy) Source

func (policy Policy) Source() map[string]string

Source returns a map of policy_name to normalized rego source code used to build the policy

type Status

type Status string

const (
	StatusPass     Status = "PASS"
	StatusSoftFail Status = "SOFT_FAIL"
	StatusHardFail Status = "HARD_FAIL"
	StatusError    Status = "ERROR"
)

type Violation

type Violation struct {
	Rule   string `json:"rule"`
	Reason string `json:"reason"`
}