Parameter abstraction causes constraint validation errors about konstraint

[jalseth]

@dulltz If you don't use the parameters functionality, you can just remove it from your lib.core so it won't be included in the generated templates. Otherwise, you can open an issue in the upstream project to remove that hardcoded value.

[jalseth]

This appears to be a case of two somewhat opinionated tools disagreeing. Konstraint and its libraries were built explicitly to allow for creating policies that could be tested locally with Conftest and then deployed to Gatekeeper without any changes. In order to emulate Gatekeeper's parameters functionality with Conftest, we must set core.parameters to data.parameters when the policy is evaluated outside of Gatekeeper. Of course, when running in Gatekeeper data.parameters is never actually referenced.

That validation tool appears to perform static analysis for validation and then attempts to output the Gatekeeper resources. However, when it attempts to create the ConstraintTemplate, its upstream parsing logic is hardcoded to only allow references that start with data.lib. This restriction does not make sense in the context of Konstraint, so these two tools are incompatible in some scenarios, at least until that restriction is lifted on their end.

[dippynark]

Awesome cheers! Happy this isn't a Konstraint issue (after understand Rego a bit better now and with that explanation) -- I have worked around this for now by using the commit of Konstraint just before #80 but hopefully that hardcoded restriction can be removed from OPA at some point

[dulltz]

@dippynark @jalseth
After all, how do you work around this issue?
I would like to know if there is a better solution than manually removing the data.parameters from the generated ConstraintTemplate.

Now I make the following changes every time after running konstraint create.

$ git diff
diff --git a/constraints/overlays/staging/template_ApplicationTenant.yaml b/constraints/overlays/staging/template_ApplicationTenant.yaml
index d01f144..be187cc 100755
--- a/constraints/overlays/staging/template_ApplicationTenant.yaml
+++ b/constraints/overlays/staging/template_ApplicationTenant.yaml
@@ -57,10 +57,6 @@ spec:
           is_gatekeeper
       }

-      parameters = data.parameters {
-         not is_gatekeeper
-      }
-
       has_field(obj, field) {
           not object.get(obj, field, "N_DEFINED") == "N_DEFINED"
       }