trustee icon indicating copy to clipboard operation
trustee copied to clipboard

KBS: Be more tolerant to policy rego files

Open davidhadas opened this issue 10 months ago • 2 comments

KBC fails to set policy in KBS and AS unless the rego file ends with an empty line. Either make the code more tolerant or make it clear in docuemtation.

Example:

$ cat -n allow_all.rego
     1
     2	package policy
     3
     4	default allow = true

$ cat -n allow_all_modified.rego
     1
     2	package policy
     3
     4	default allow = true
     5

$ kbs-client --url "http://192.168.122.182:30713" config --auth-private-key ./privateKey set-resource-policy --policy-file allow_all.rego
Error: Request Failed, Response: "{\"type\":\"https://github.com/confidential-containers/kbs/errors/PolicyEndpoint\",\"detail\":\"Policy error: Set policy error Base64 decode OPA policy string failed: InvalidPadding\"}"

$ kbs-client --url "http://192.168.122.182:30713" config --auth-private-key ./privateKey set-resource-policy --policy-file allow_all_modified.rego
Set resource policy success
 policy: CnBhY2thZ2UgcG9saWN5CgpkZWZhdWx0IGFsbG93ID0gdHJ1ZQoK

same issue with set-attestation-policy

davidhadas avatar Apr 16 '24 10:04 davidhadas