Skip to content

feat(misconf): Add support for configurable Rego error limit #9657

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+32 −0
Open

feat(misconf): Add support for configurable Rego error limit #9657

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions docs/docs/advanced/telemetry-flags.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,6 +24,7 @@
--pkg-types
--quiet
--redis-tls
--rego-error-limit
--removed-pkgs
--report
--scanners
Expand Down
1 change: 1 addition & 0 deletions docs/docs/references/configuration/cli/trivy_config.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,6 +58,7 @@ trivy config [flags] DIR
--redis-key string redis key file location, if using redis as cache backend
--redis-tls enable redis TLS with public certificates, if using redis as cache backend
--registry-token string registry token
--rego-error-limit int maximum number of compile errors allowed during Rego policy evaluation (default 10)
--render-cause strings specify configuration types for which the rendered causes will be shown in the table report (allowed values: terraform)
--report string specify a compliance report format for the output (allowed values: all,summary) (default "all")
-s, --severity strings severities of security issues to be displayed
Expand Down
1 change: 1 addition & 0 deletions docs/docs/references/configuration/cli/trivy_filesystem.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,7 @@ trivy filesystem [flags] PATH
--redis-key string redis key file location, if using redis as cache backend
--redis-tls enable redis TLS with public certificates, if using redis as cache backend
--registry-token string registry token
--rego-error-limit int maximum number of compile errors allowed during Rego policy evaluation (default 10)
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
--render-cause strings specify configuration types for which the rendered causes will be shown in the table report (allowed values: terraform)
--report string specify a compliance report format for the output (allowed values: all,summary) (default "all")
Expand Down
1 change: 1 addition & 0 deletions docs/docs/references/configuration/cli/trivy_image.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -127,6 +127,7 @@ trivy image [flags] IMAGE_NAME
--redis-key string redis key file location, if using redis as cache backend
--redis-tls enable redis TLS with public certificates, if using redis as cache backend
--registry-token string registry token
--rego-error-limit int maximum number of compile errors allowed during Rego policy evaluation (default 10)
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
--removed-pkgs detect vulnerabilities of removed packages (only for Alpine)
--render-cause strings specify configuration types for which the rendered causes will be shown in the table report (allowed values: terraform)
Expand Down
1 change: 1 addition & 0 deletions docs/docs/references/configuration/cli/trivy_kubernetes.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,6 +118,7 @@ trivy kubernetes [flags] [CONTEXT]
--redis-key string redis key file location, if using redis as cache backend
--redis-tls enable redis TLS with public certificates, if using redis as cache backend
--registry-token string registry token
--rego-error-limit int maximum number of compile errors allowed during Rego policy evaluation (default 10)
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
--render-cause strings specify configuration types for which the rendered causes will be shown in the table report (allowed values: terraform)
--report string specify a report format for the output (allowed values: all,summary) (default "all")
Expand Down
1 change: 1 addition & 0 deletions docs/docs/references/configuration/cli/trivy_repository.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -105,6 +105,7 @@ trivy repository [flags] (REPO_PATH | REPO_URL)
--redis-key string redis key file location, if using redis as cache backend
--redis-tls enable redis TLS with public certificates, if using redis as cache backend
--registry-token string registry token
--rego-error-limit int maximum number of compile errors allowed during Rego policy evaluation (default 10)
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
--render-cause strings specify configuration types for which the rendered causes will be shown in the table report (allowed values: terraform)
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (allowed values: oci,rekor)
Expand Down
1 change: 1 addition & 0 deletions docs/docs/references/configuration/cli/trivy_rootfs.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,7 @@ trivy rootfs [flags] ROOTDIR
--redis-key string redis key file location, if using redis as cache backend
--redis-tls enable redis TLS with public certificates, if using redis as cache backend
--registry-token string registry token
--rego-error-limit int maximum number of compile errors allowed during Rego policy evaluation (default 10)
--rekor-url string [EXPERIMENTAL] address of rekor STL server (default "https://rekor.sigstore.dev")
--render-cause strings specify configuration types for which the rendered causes will be shown in the table report (allowed values: terraform)
--sbom-sources strings [EXPERIMENTAL] try to retrieve SBOM from the specified sources (allowed values: oci,rekor)
Expand Down
3 changes: 3 additions & 0 deletions docs/docs/references/configuration/config-file.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -495,6 +495,9 @@ rego:
# Same as '--config-data'
data: []

# Same as '--rego-error-limit'
error-limit: 10

# Same as '--include-deprecated-checks'
include-deprecated-checks: false

Expand Down
1 change: 1 addition & 0 deletions pkg/commands/artifact/run.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -742,6 +742,7 @@ func initMisconfScannerOption(ctx context.Context, opts flag.Options) (misconf.S
DisableEmbeddedPolicies: disableEmbedded,
DisableEmbeddedLibraries: disableEmbedded,
IncludeDeprecatedChecks: opts.IncludeDeprecatedChecks,
RegoErrorLimit: opts.RegoOptions.ErrorLimit,
TfExcludeDownloaded: opts.TfExcludeDownloaded,
RawConfigScanners: opts.RawConfigScanners,
FilePatterns: opts.FilePatterns,
Expand Down
14 changes: 14 additions & 0 deletions pkg/flag/rego_flags.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,7 @@
package flag

import "github.com/open-policy-agent/opa/ast"

// e.g. config yaml:
//
// rego:
Expand Down Expand Up @@ -74,6 +76,13 @@ var (
},
},
}
RegoErrorLimitFlag = Flag[int]{
Name: "rego-error-limit",
ConfigName: "rego.error-limit",
Usage: "maximum number of compile errors allowed during Rego policy evaluation",
TelemetrySafe: true,
Default: ast.CompileErrorLimitDefault,
Copy link
Member Author

@simar7 simar7 Oct 14, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nikpivkin Should we set this to a high amount? Default is 10 by OPA. Some thoughts below.

Pros: If we set this to a higher amount most users won't need to change anything in case they are using a older trivy version with a newer checks bundle.

Cons: It will silently hide any errors and may have unforeseen side effects post compilation. We do remove uncompilable checks prior to evaluation but since we are overriding the compilation to go through without any error limits, we may end up in an unexpected state.

It will also let users use older versions for a longer period of time by simply them not noticing any breakage due to a higher allowable error limit. This may make them comfortable using older trivy versions for even longer as they may have no desire to update, for instance to get new checks.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Setting it to 10 seems fine — it preserves OPA’s default behavior, avoids silently hiding too many errors, and reduces the risk of unforeseen issues while still being reasonable for most users.

}
)

// RegoFlagGroup composes common printer flag structs used for commands providing misconfinguration scanning.
Expand All @@ -84,6 +93,7 @@ type RegoFlagGroup struct {
CheckPaths *Flag[[]string]
DataPaths *Flag[[]string]
CheckNamespaces *Flag[[]string]
ErrorLimit *Flag[int]
}

type RegoOptions struct {
Expand All @@ -93,6 +103,7 @@ type RegoOptions struct {
CheckPaths []string
DataPaths []string
CheckNamespaces []string
ErrorLimit int
}

func NewRegoFlagGroup() *RegoFlagGroup {
Expand All @@ -103,6 +114,7 @@ func NewRegoFlagGroup() *RegoFlagGroup {
CheckPaths: ConfigCheckFlag.Clone(),
DataPaths: ConfigDataFlag.Clone(),
CheckNamespaces: CheckNamespaceFlag.Clone(),
ErrorLimit: RegoErrorLimitFlag.Clone(),
}
}

Expand All @@ -118,6 +130,7 @@ func (f *RegoFlagGroup) Flags() []Flagger {
f.CheckPaths,
f.DataPaths,
f.CheckNamespaces,
f.ErrorLimit,
}
}

Expand All @@ -129,6 +142,7 @@ func (f *RegoFlagGroup) ToOptions(opts *Options) error {
CheckPaths: f.CheckPaths.Value(),
DataPaths: f.DataPaths.Value(),
CheckNamespaces: f.CheckNamespaces.Value(),
ErrorLimit: f.ErrorLimit.Value(),
}
return nil
}
1 change: 1 addition & 0 deletions pkg/iac/rego/embed.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,6 +41,7 @@ func RegisterRegoRules(modules map[string]*ast.Module) {
WithCapabilities(nil).
WithUseTypeCheckAnnotations(true)

compiler.SetErrorLimit(ast.CompileErrorLimitDefault)
compiler.Compile(modules)
if compiler.Failed() {
// we should panic as the embedded rego policies are syntactically incorrect...
Expand Down
1 change: 1 addition & 0 deletions pkg/iac/rego/load.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -247,6 +247,7 @@ func (s *Scanner) compilePolicies(srcFS fs.FS, paths []string) error {
WithCapabilities(ast.CapabilitiesForThisVersion()).
WithSchemas(schemaSet)

compiler.SetErrorLimit(s.regoErrorLimit)
compiler.Compile(s.policies)
if compiler.Failed() {
s.fallbackChecks(compiler)
Expand Down
5 changes: 5 additions & 0 deletions pkg/misconf/scanner.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,7 @@ type ScannerOption struct {
DisableEmbeddedPolicies bool
DisableEmbeddedLibraries bool
IncludeDeprecatedChecks bool
RegoErrorLimit int

HelmValues []string
HelmValueFiles []string
Expand Down Expand Up @@ -236,6 +237,10 @@ func initRegoOptions(opt ScannerOption) ([]options.ScannerOption, error) {
rego.WithTrivyVersion(app.Version()),
}

if opt.RegoErrorLimit > 0 {
opts = append(opts, rego.WithRegoErrorLimits(opt.RegoErrorLimit))
}
Comment on lines +240 to +242
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Does it make sense to allow setting an error limit equal to 0 for strictness?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Oh you mean the comparison should be >=0 if no errors are allowable? If so, I think that's a fair point and I can change it.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, that's what I meant.


policyFS, policyPaths, err := CreatePolicyFS(opt.PolicyPaths)
if err != nil {
return nil, err
Expand Down
Loading