open-policy-agent/opa

PE: allow adjusting which non-deterministic builtins are to be evaluated

Opened this issue · 1 comments

What is the underlying problem you're trying to solve?

Some use case require that a subset of even the non-deterministic builtin functions are evaluated at the partial eval time. Currently, all non-deterministic builtin calls are saved, i.e. kept in the partially-evaluated rego code as calls to happen at the later, non-partial, eval time.

Describe the ideal solution

There's already a notion of

There are different entry points for PE:

  • HTTP: Compile API
  • Rego package
  • SDK package
  • CLI arguments to opa eval --partial
  • CLI arguments to opa build when using optimizations

Those will need consideration. I think the list here is roughly ordered by importance, but feel free to chime in.

Describe a "Good Enough" solution

There's no real work around here, short of supplying the information out of band; perhaps through a "complete" eval of some helper module, whose results would then be fed into the partial eval as known values.

Additional Context

Replaces #6486.

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days. Although currently inactive, the issue could still be considered and actively worked on in the future. More details about the use-case this issue attempts to address, the value provided by completing it or possible solutions to resolve it would help to prioritize the issue.