Using opa check with extensions

[fitzthum]

I am working on a project that has opa check in the CI to make sure the policies don't break. We want to add an extension to one of our policies. We've added support for the extension in the source, but opa check doesn't know about this and complains about an unidentified function.

Is there a way to tell opa check to ignore this symbol? Is there a way to tell it about the extension? Unfortunately, we use this extension many times, so the compiler error limit is reached. Otherwise we could just filter out these messages with grep. Is there any way to increase the error limit?

[anderseknert]

Hi there!

Yes, tell OPA check about your builtin function (assuming that’s what you mean by extension) via the capabilities flag.

I’m on my phone but you should find that format covered by the OPA docs.

[fitzthum]

Thanks for the example. I had a suspicion that capabilities could help, but wasn't sure what should be added.

When I set capabilities from the CLI I get an error. Error: invalid argument "capabilities.json" for "--capabilities" flag: no such file or capabilities version found: capabilities.json. Obviously the file does exist and contains valid JSON. This is probably some user error, but I'm not sure what yet.

[charlieegan3]

Hey, good question. https://github.com/open-policy-agent/opa/tree/main/capabilities contains a list of caps.json files for past versions of OPA. You will likely want to take of one these and add your new function to it. See head capabilities.json in the above example, it has a custom_function and the args expected in the defn

[anderseknert]

You can use the opa capabilities command for this, either for --current version or any provided semver string.

[fitzthum]

Yeah getting the existing capabilities is no problem, but I didn't see any docs about adding extensions to capabilities. I probably should have realized that if you just add them to the built-in section opa won't know the difference. Anyway, I still can't get the CLI to take a capabilities JSON file. It understands a version string, but it can't seem to read in any file regardless of location, relative path, or whatever. Let me try updating.

[anderseknert]

I probably should have realized that if you just add them to the built-in section opa won't know the difference

That's what you want :) OPA makes no difference between built-in functions or custom functions in the capabilities.

If it helps, you could check how that looks in Regal, where a custom capabilities adding some custom functions can be found. You can then run e.g. opa check --capabilities build/capabilities.json bundle