can we use terraform validator policy code in OPA policy testing

[rakesh0022]

Hi All,

I am looking here to check, if we can use the same policy which we were using with terraform validator (are written in rego), however it saved as .yaml extension with OPA policy

we are trying to migrate from terraform validator to opa, and we already have all the policy in written in rego with terraform validator and want to check if all the same policy can be used with OPA. or we will need to write all the policy from scratch for opa

Thanks

[philipaconrad]

To clarify, @rakesh0022 , you have a terraform-validator Rego policy, which reads a YAML file, and validates it?

[rakesh0022]

Yes, and Terraform validator policy is saved as .yaml(i.e enforce_label.yaml) now I want to convert that into .rego (i.e enforce_label.rego) so can how can we use that will that logic work with opa

In Terraform validator we use two file
1- constraints/enforce_label.yaml
2- templates/enforce_labele.yaml
For policy evaluation

Now I want to use the same thing with opa using the same policy so is it possible to do ?

[anderseknert]

If you want to evaluate those policies using only OPA, you'll need to get the Rego bits out of the YAML files first. You could even do so using OPA itself :)

opa eval -f raw -d policy.yaml 'data.spec.targets["validation.gcp.forsetisecurity.org"].rego'

But.. you'd still need to provide the parameters from the template as part of the input when evaluating that policy.