OPA/Rego 对数组的每个元素执行函数

Question

我是 OPA/Rego 的新人，我正在尝试编写一个策略来检查 Azure 网络安全组是否包含我在数组上定义的所有规则

package sample
default compliant = false
toSet(arr) = {x | x := arr[_]}
checkProperty(rule, index, propertySingular, propertyPlural) = true
{
    object.get(input.properties.securityRules[index].properties, propertySingular, "") == object.get(rule, propertySingular, "")
    count(toSet(object.get(input.properties.securityRules[index].properties, propertyPlural, [])) - toSet(object.get(rule, propertyPlural, []))) == 0
}
existRule(rule) = true
{
    input.properties.securityRules[i].name == rule.name
    input.properties.securityRules[i].properties.provisioningState == rule.provisioningState
    input.properties.securityRules[i].properties.description == rule.description
    input.properties.securityRules[i].properties.protocol == rule.protocol
    checkProperty(rule, i, "sourcePortRange", "sourcePortRanges")
    checkProperty(rule, i, "destinationPortRange", "destinationPortRanges")
    checkProperty(rule, i, "sourceAddressPrefix", "sourceAddressPrefixes")
    checkProperty(rule, i, "destinationAddressPrefix", "destinationAddressPrefixes")
    input.properties.securityRules[i].properties.access == rule.access
    input.properties.securityRules[i].properties.priority == rule.priority
    input.properties.securityRules[i].properties.direction == rule.direction
}
compliant
{
    rules := [
            {
                "name": "name1",
                "provisioningState": "Succeeded",
                "description": "description1",
                "protocol": "*",
                "sourcePortRange": "*",
                "destinationPortRange": "53",
                "destinationAddressPrefix": "*",
                "access": "Allow",
                "priority": 1,
                "direction": "Inbound",
                "sourceAddressPrefixes":
                [
                    "xx.xx.xx.xx",
                    "xx.xx.xx.xx",
                    "xx.xx.xx.xx"
                ],
            },
            {
                "name": "name2",
                "provisioningState": "Succeeded",
                "description": "description2",
                "protocol": "*",
                "sourcePortRange": "*",
                "destinationPortRange": "54",
                "sourceAddressPrefix": "*",
                "access": "Allow",
                "priority": 2,
                "direction": "Outbound",
                "destinationAddressPrefixes":
                [
                    "xx.xx.xx.xx",
                    "xx.xx.xx.xx",
                    "xx.xx.xx.xx"
                ]
            }
        ]
    #checks
    existRule(rules[i])
}

问题似乎是当执行 existRule(rules[i]) 时，如果其中一条规则匹配 returns true，如果其他规则不匹配则不要理会如果我将 existRule(rules[i]) 替换为 existRule(rules[0]) 或 existRule(rules[1])，它会 return true 或 false 取决于该位置上的规则是否匹配。

有什么办法可以得到数组所有元素执行existRule(rules[i])的结果吗？

我已经试过了 result := [existRule(rules[i])] 但它只有 return 一个元素为 true

Answer 1

好的！使用列表理解并调用其中的函数，然后将结果的大小与之前的大小进行比较。根据您的示例，您可以将 existRule(rules[i]) 替换为如下内容：

compliantRules := [rule | rule := rules[_]
                          existRule(rule)]
                              
count(compliantRules) == count(rules)

OPA/Rego 对数组的每个元素执行函数

OPA/Rego execute function for each element of an array

open-policy-agent

rego