http.send() issue

[andrepcb]

I am currently trying to write a rego policy to stop "kubectl scale" when CPU utilization is too high. The code seems to be fine when using "opa eval..." but is bypassed in reality. Is it maybe an issue with my admission controller?

Note "Deployment" has same issue"

`package kubernetes.admission

operations := {"CREATE", "UPDATE"}

getCPUtilization = response {
response := http.send({
"method": "GET",
"url": "http:example.com",
})
}

deny[msg] {
input.request.kind.kind = "Scale"
operations[input.request.operation]
cpu_util := getCPUtilization.body
cpu_util > 10
msg = sprintf("denied: %v", [cpu_util])
}
`

[anderseknert]

In order to understand exactly what your OPA instance receives, I'd suggest enabling decision logging.
The decision logger can log to console, or to remote endpoints, but regardless of where its sending its logs, it'll always inclide the input as provided to your policy. I've not worked with Kubernetes for some time, but I suspect there's no distinct kind for the deployments/scale subresource?

[andrepcb]

How would I turn on the decision logger? I got scale to work following this here

[anderseknert]

Ah, all good then 👍 Decision logging is described in the OPA docs. If you're using gatekeeper though, I don't think they use that but the Kubernetes audit logging feature. You'll have to refer to their docs, as I'm not sure how that works myself.

[andrepcb]

After messing around and finding out a bit more, It seems that http.send() and partial eval don't get along so I'll look at different ways of using it.