Add support for accessing environment vars in queries #420
Comments
tsandall
added a commit
to tsandall/opa
that referenced
this issue
Oct 16, 2018
These changes add support for accessing runtime information inside of policies. In some cases, policies need to access environment variables or configuration that OPA was booted with. These changes add a built-in function that allows policies to gain access to this information. The built-in function itself is relatively trivial. Most of the required changes were plumbing the runtime information from the entrypoint down into the evaluation engine. The alternative would have been to introduce a global variable containing this information however that would be have been harder to reason about in library integrations. Fixes open-policy-agent#420 Signed-off-by: Torin Sandall <[email protected]>
tsandall
added a commit
that referenced
this issue
Oct 16, 2018
These changes add support for accessing runtime information inside of policies. In some cases, policies need to access environment variables or configuration that OPA was booted with. These changes add a built-in function that allows policies to gain access to this information. The built-in function itself is relatively trivial. Most of the required changes were plumbing the runtime information from the entrypoint down into the evaluation engine. The alternative would have been to introduce a global variable containing this information however that would be have been harder to reason about in library integrations. Fixes #420 Signed-off-by: Torin Sandall <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
In cases like #417 it would be useful if queries could refer to the environment vars that OPA (or the process embedding OPA) was started with.
E.g., this would allow secret values to be safely referred to in policies without worrying (as much) about leaking them via the Data API.
There are a few ways we could add support for accessing environment variables. The simplest approach would probably be to include a new built-in function like
os.env(output)that returns a JSON object mapping environment variables to values.The text was updated successfully, but these errors were encountered: