Evaluate multiple rules in the same REST call

[cmorinupgrade]

Good day everyone,

I have been implementing Rego policies for a little while now, and I have a question with regards to the OPA REST API.

I am using OPA as a policy evaluation tool to determine mergeability for a specific PR state. I am working on a golang application that interacts with a Kubernetes hosted OPA server in the following way:

1. determine what policies apply (along with their applicable rules). This is done through the /data/system/main endpoint, which gives me all the policies that apply to a PR. Each policy has applicable rules.
2. evaluate all applicable rules and determine mergeability. This is the step I am currently working right now, and that's where I'd use a little guidance from you guys please. 🙏

Let's say I got the following rego files:

core-rules.rego (policy)
rule1 (rule)
rule2 (rule)
rule3 (rule)

policy1.rego (policy)
is_applicable (rule)
core.rule1 (applicable core rule)

policy2.rego (policy)
is_applicable (rule)
core.rule1 (applicable core rule)
core.rule2 (applicable core rule)

The response from step 1 above is a custom object, which looks like so:

{
    "result": [
        {
            "policies": [
                {
                    "name": "policy1",
                    "rules": [
                        "core.rule1"
                    ]
                },
                {
                    "name": "policy2",
                    "rules": [
                        "core.rule1",
                        "core.rule2"
                    ]
                }
            ]
        }
    ]
}

With the opa eval command, I can easily eval all the rules I want in one shot. However, with the REST API, I'm having a hard time figuring out what endpoint to use and determine if I could evaluate all rules against a specific input (payload) in a single REST call.

I assume the API would be the Query API (v1/query, https://www.openpolicyagent.org/docs/latest/rest-api/#execute-an-ad-hoc-query). However, the query language documentation is pretty light so I'm having a hard time figuring out the right combination.

Thank you in advance for help and guidance.

[anderseknert]

Hi there Charles! 👋 The pattern you are describing sounds like dynamic policy composition, where you commonly have a main module, or "router", that helps evaluate any policy relevant to the request based on input or other contextual parameters. Let me know if that article is helpful — I'd be happy to expand on anything you might want to know more about. Have a good weekend! 🙂