doesn't work with List openshift object about rego-policies

[garethahealy]

@mbilel are you using the helper bats functions that this repo uses? or just the raw policies

[garethahealy]

cool.

[mbilel]

no I can't install bats in my environment, I a m using just the raw policies

[garethahealy]

ok, that explains why. all of these policies are aimed to work on and off cluster (i.e.: conftest and gatekeeper). to do that, they target a single resource, i.e.: Deployment. so to get that to work, we pre-process k8s lists/ocp templates/helm charts to be a list of yaml resources.

by doing this, it simplifies how the policies work and makes testing both scenarios exactly the same.

so the long and short of it; if you want to use these policies as part of a CI/CD pipeline, you need to pre-process. if you want o use them via gatekeeper, they'll work as-is.

[garethahealy]

also, your comment about not being able to install bats. the bats lib is just a bash file, so if you can:

• git clone
• source bashfile

then you can use the code which pre-processes the resources. see:

• https://github.com/redhat-cop/rego-policies/blob/master/_test/gatekeeper-integrationtests.sh#L41
• https://github.com/redhat-cop/bats-library/blob/master/src/yaml-json-manipulation.bash#L15

[mbilel]

@garethahealy , Thank you for your responses,
Yes I want to include SAST controle in CI/CD pipelines.
I used yq to do the staff:

oc process -f ocp_template.yaml --param-file env.properties | yq eval -P '.items[] | splitDoc' - > splited_ocp_objects.yml
then
conftest test split_ocp_objects.yml --all-namespaces