Skip to main content

Array Built-ins

FunctionDescriptionOPAWasmSwiftJava
array.concat​

z := array.concat(x, y)

Concatenates two arrays.

Arguments:
x (array[any])

the first array

y (array[any])

the second array

Returns:
z (array[any])

the concatenation of x and y

v0.17.0✓0.0.10.1.0
array.flatten​

flattened := array.flatten(arr)

Non-recursively unpacks array items in arr into the flattened array. Other types are appended as-is.

Arguments:
arr (array[any])

the array to be flattened

Returns:
flattened (array[any])

array flattened one level

v1.13.0✓✗0.3.0
array.reverse​

rev := array.reverse(arr)

Returns the reverse of a given array.

Arguments:
arr (array[any])

the array to be reversed

Returns:
rev (array[any])

an array containing the elements of arr in reverse order

v0.36.0✓0.0.10.1.0
array.slice​

slice := array.slice(arr, start, stop)

Returns a slice of a given array. If start is greater or equal than stop, slice is [].

Arguments:
arr (array[any])

the array to be sliced

start (number)

the start index of the returned slice; if less than zero, it's clamped to 0

stop (number)

the stop index of the returned slice; if larger than count(arr), it's clamped to count(arr)

Returns:
slice (array[any])

the subslice of array, from start to end, including arr[start], but excluding arr[end]

v0.17.0✓0.0.10.1.0

Examples​

array.concat​

array.concat returns a new array with the elements of the second array appended to the first. Policies use it to extend a base list — for example default registries or hosts — with extra values from input or data.

Merging a base allowlist with extra entries

array.concat appends one array to another. Policies often keep a fixed base list (for example default registries) and extend it with values from input or data for a particular tenant or environment.

policy.rego
package play

allowed_registries := array.concat(data.base_registries, input.extra_registries)

default allow := false

allow if {
	some registry in allowed_registries
	startswith(input.image, sprintf("%s/", [registry]))
}

deny contains msg if {
	not allow
	msg := sprintf(
		"image %q is not from an allowed registry: %v",
		[input.image, allowed_registries],
	)
}
Output
{
  "allow": false,
  "allowed_registries": [
    "registry.internal/prod",
    "ghcr.io/example",
    "registry.internal/staging"
  ],
  "deny": [
    "image \"docker.io/library/nginx:1.27\" is not from an allowed registry: [\"registry.internal/prod\", \"ghcr.io/example\", \"registry.internal/staging\"]"
  ]
}
Loading...
input.json
{
  "extra_registries": [
    "registry.internal/staging"
  ],
  "image": "docker.io/library/nginx:1.27"
}
data.json
{
  "base_registries": [
    "registry.internal/prod",
    "ghcr.io/example"
  ]
}

Open in OPA Playground