Sharing functions between constraint templates

[hamza3202]

Is there some way to share some basic functions between constraintTemplates? e.g a method to get nested field or even simple checks to identify the kind of a resource?

[brycecr]

There is a static linking option available on constraintTemplates via the libs field:
https://github.com/open-policy-agent/frameworks/tree/master/constraint#what-is-a-constraint-template

That's all that is supported for now. Dynamic linking can result in dependency version conflicts so we have avoided a provision for those.

[hamza3202]

libs defined by one constraintTemplates can be accessed by that constraintTemplates only or are they shared between constraint templates?

[maxsmythe]

They can only be accessed by the one constraint template.

Shared libraries have a number of issues:

• Dependency version conflicts
• Eventual consistency -- what if the template is ingested before the shared library is available?
• Non-hermeticity -- you now need to install two objects to get a given constraint template to work
• Non-isolation -- users may overload the library functions either intentionally (and maliciously) or on accident because a name is common (think import aliasing in golang)

The goal of "libs" was to make it a bit easier to leverage the developer advantages that shared libraries have while avoiding the operational liabilities by providing an easy way to "statically link" code (borrowing this term from C)

[hamza3202]

@maxsmythe thanks for the information. I guess I will just work with that for now.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed in 14 days if no further activity occurs. Thank you for your contributions.