Rego policy with ExternalData Provider : undefined function external_data

[adriil]

Hi team,

I've a policy that uses external_data built-in function, but the compilation fails with undefined function external_data :

docker run --rm -v "${BASE}:/policies" "${CONFTEST_IMAGE}:v0.44.1" verify --report notes -p /policies/policy -d /policies/data

Error: running verification: load: loading policies: get compiler: 1 error occurred: /policies/policy/kubernetes/enforcesignedimage/policy.rego:28: rego_type_error: undefined function external_data
make: *** [conftest-test] Error 1

• Policy :

  
  package mypolicy

import data.lib.kubernetes

violation[{"msg": msg}] {

build a list of keys containing images

images := containers[_].image
count(images) > 0

# send external data request
response := external_data({"provider": "my-provider", "keys": images})

response_with_error(response)
msg := sprintf("Issue from provider : %v", [response])

}

response_with_error(response) { count(response.errors) > 0 }

response_with_error(response) { count(response.system_error) > 0 }

Does `conftest` support `external_data` or can we only use this along with Gatekeeper ? I understand that the actual call can't be done and will need to be mocked, but at least having the function recognised would help.

Thanks,
Adrien

[boranx]

Hi, thanks for reporting the issue

At first glance, this built-in is implemented for gatekeeper's internals: https://open-policy-agent.github.io/gatekeeper/website/docs/externaldata/#motivation. Similar to external_data's functionality in gatekeeper, we could lean on OPA's http.send in Conftest and manually download/upload artifacts using http calls (it'd be supported by default, as long as it's not restricted via capabilities)

Nevertheless, if it's a must/nice-to-have requirement, then we could consider either adding this to Conftest built-ins: https://github.com/open-policy-agent/conftest/tree/master/builtins OR sending the built-in from gatekeeper to OPA upstream in a way Conftest could inherit as well

[pedroapero]

Hi, thanks for the hint @boranx. I stumbled upon the same with is_exempt() (part of each lib_exclude_update.rego file in the gatekeeper library).