can someone explain whats happening here

[ramprasadgk]

I have this rego code , and yaml file , this seems to work however fail to understand what is happening here, how is missing is assigned label which is not in required labels . can someone explain what is happening

package main

import rego.v1

missing_pipeline_labels[missing] if {

    
	required_labels := {
		"automation.abc/pa",
		"automation.abc/pn",
	}
    
	input.metadata.labels[la]
    
	required_labels[la]
    print(required_labels)
    
	missing := la
    
        
    
}

deny[msg] if {
	input.kind == "Pipeline"
    
    
	missing_pipeline_labels[missing]
    print(missing_pipeline_labels)
    

	msg = sprintf("%s pipeline does not specify the required label %s", [input.metadata.name, missing])
}

and this input

{
  "apiVersion": "tekton.dev/v1beta1",
  "kind": "Pipeline",
  "metadata": {
    
    "labels": {
      "automation.abc/pa": "ok",
      "automation.abc/pv": "v1"
    },
    "name": "test"
  },
  "spec": {
    "description": "tesr.",
    "params": [
      {
        "description": "What is the GitHub owner name? (usually org or username)",
        "name": "ownerName",
        "type": "string"
      }
    ]
  }
}

[johanfylling]

Is your policy really producing the expected result? Running it against your input: we get "test pipeline does not specify the required label automation.abc/pa". However, automation.abc/pa is a member of required_labels.

If you update missing_pipeline_labels to the following:

missing_pipeline_labels contains missing if {
	required_labels := {
		"automation.abc/pa",
		"automation.abc/pn",
	}
    
	required_labels[la]           # enumerate all labels 'la' in 'required_labels'
    
	not input.metadata.labels[la] # for each 'la' not in 'input'
    
	missing := la                 # report it as missing
}

then we'll get the deny reason: "test pipeline does not specify the required label automation.abc/pn"; which I believe should be the expected one.