OPA/Rego 对数组的每个元素执行函数

Question

我是 OPA/Rego 的新手，我正在尝试编写一个策略来检查 Azure 网络安全组是否包含我在阵列上定义的所有规则

package sample
default compliant = false
toSet(arr) = {x | x := arr[_]}
checkProperty(rule, index, propertySingular, propertyPlural) = true
{
    object.get(input.properties.securityRules[index].properties, propertySingular, "") == object.get(rule, propertySingular, "")
    count(toSet(object.get(input.properties.securityRules[index].properties, propertyPlural, [])) - toSet(object.get(rule, propertyPlural, []))) == 0
}
existRule(rule) = true
{
    input.properties.securityRules[i].name == rule.name
    input.properties.securityRules[i].properties.provisioningState == rule.provisioningState
    input.properties.securityRules[i].properties.description == rule.description
    input.properties.securityRules[i].properties.protocol == rule.protocol
    checkProperty(rule, i, "sourcePortRange", "sourcePortRanges")
    checkProperty(rule, i, "destinationPortRange", "destinationPortRanges")
    checkProperty(rule, i, "sourceAddressPrefix", "sourceAddressPrefixes")
    checkProperty(rule, i, "destinationAddressPrefix", "destinationAddressPrefixes")
    input.properties.securityRules[i].properties.access == rule.access
    input.properties.securityRules[i].properties.priority == rule.priority
    input.properties.securityRules[i].properties.direction == rule.direction
}
compliant
{
    rules := [
            {
                "name": "name1",
                "provisioningState": "Succeeded",
                "description": "description1",
                "protocol": "*",
                "sourcePortRange": "*",
                "destinationPortRange": "53",
                "destinationAddressPrefix": "*",
                "access": "Allow",
                "priority": 1,
                "direction": "Inbound",
                "sourceAddressPrefixes":
                [
                    "xx.xx.xx.xx",
                    "xx.xx.xx.xx",
                    "xx.xx.xx.xx"
                ],
            },
            {
                "name": "name2",
                "provisioningState": "Succeeded",
                "description": "description2",
                "protocol": "*",
                "sourcePortRange": "*",
                "destinationPortRange": "54",
                "sourceAddressPrefix": "*",
                "access": "Allow",
                "priority": 2,
                "direction": "Outbound",
                "destinationAddressPrefixes":
                [
                    "xx.xx.xx.xx",
                    "xx.xx.xx.xx",
                    "xx.xx.xx.xx"
                ]
            }
        ]
    #checks
    existRule(rules[i])
}

问题似乎是，当执行时existRule(rules[i])，如果其中一个规则匹配，它会返回 true，如果其他规则不匹配，也没关系。如果我existRule(rules[i])用existRule(rules[0])or替换existRule(rules[1])，它会返回 true 或 false，具体取决于该位置上的规则是否匹配。

existRule(rules[i])有没有办法获取数组所有元素的执行结果？

我已经尝试过了result := [existRule(rules[i])]，但它只返回一个 true 元素

Answer 1

当然！使用列表理解并调用其中的函数，然后将结果的大小与之前的大小进行比较。鉴于您的示例，您将替换existRule(rules[i])为如下内容：

compliantRules := [rule | rule := rules[_]
                          existRule(rule)]
                              
count(compliantRules) == count(rules)