<p>We have OPA installed in our Kubernetes cluster. Not Gatekeeper. The &quot;original&quot; OPA...</p>
<p><strong>I don't understand how I can look at what OPA is receiving as input request from the API-server ?</strong><br />
=&gt; If I knew exactly what the payload looks like then writing the Rego would be simple.</p>
<p>I tried to use <code>-v=8</code> option in <code>kubectl</code> to see the request and response from api-server like so:</p>
<pre><code>$ kubectl get pod -v=8
...
GET https://xxxx.k8s.ovh.net/api/v1/namespaces/default/pods?limit=500
...
Request Headers: Accept: application/json;as=Table;v=v1;g=meta.k8s.io,application/json;as=Table;v=v1beta1;g=meta.k8s.io,application/json
...
Response Body: {&quot;kind&quot;:&quot;Table&quot;,&quot;apiVersion&quot;:&quot;meta.k8s.io/v1&quot;,&quot;metadata&quot;:{&quot;resourceVersion&quot;:&quot;37801112226&quot;},&quot;columnDefinitions&quot;:[{&quot;name&quot;:&quot;Name&quot;,&quot;type&quot;:&quot;string&quot;,&quot;format&quot;:&quot;name&quot;,&quot;description&quot;:&quot;Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: http://kubernetes.io/docs/user-guide/identifiers#names&quot;,&quot;priority&quot;:0},{&quot;name&quot;:&quot;Ready&quot;,&quot;type&quot;:&quot;string&quot;,&quot;format&quot;:&quot;&quot;,&quot;description&quot;:&quot;The aggregate readiness state of this pod for accepting traffic.&quot;,&quot;priority&quot;:0},{&quot;name&quot;:&quot;Status&quot;,&quot;type&quot;:&quot;string&quot;,&quot;format&quot;:&quot;&quot;,&quot;description&quot;:&quot;The aggregate status of the containers in this pod.&quot;,&quot;priority&quot;:0},{&quot;name&quot;:&quot;Restarts&quot;,&quot;type&quot;:&quot;string&quot;,&quot;format&quot;:&quot;&quot;,&quot;description&quot;:&quot;The number of times the containers in this pod have been restarted and when the last container in this pod has restarted.&quot;,&quot;priority&quot;:0},{&quot;name&quot;:&quot;Age&quot;,&quot;type [truncated 4024 chars]
</code></pre>
<p>Unfortunatly the above JSON payload doesn't match what I see in the different tutorials.</p>
<p><em>How is anybody able to write OPA rules for Kubernetes ???</em><br />
Thx</p>

<p>You have two options:</p>
<ul>
<li><p>Run the OPA server with debug level logging:</p>
<p><code>opa run --server --log-level debug ...</code></p>
<p>This is obviously very noisy, so beware.</p>
</li>
<li><p>Run the server with <a href="https://www.openpolicyagent.org/docs/latest/management-decision-logs/" rel="nofollow noreferrer">decision logging</a> enabled. This is almost always preferable, and allows you to either dump decisions (including input data) to console, or for production deployments, to a remote server aggregating the logs. The decision logging system is really the native way of doing this, and comes with a bunch of features, like masking of sensitive data, etc.. but if you just want something printed to the console, you can run OPA like:</p>
<p><code>opa run --server --set decision_logs.console=true ...</code></p>
</li>
</ul>
