title: Isolation between kubernetes.admission policies in OPA
body: <p>I use the vanilla Open Policy Agent as a deployment on Kubernetes for handling admission webhooks.</p>
  <p>The behavior of multiple policies evaluation is not clear to me, see this example:</p>
  <pre><code>## policy-1.rego
  
  package kubernetes.admission
  
  check_namespace {
     # evaluate to true
     namespaces := {&quot;namespace1&quot;}
     namespaces[input.request.namespace]
  }
  
  check_user {
      # evaluate to false
      users := {&quot;user1&quot;}
      users[input.request.userInfo.username]
  }
  
  allow[&quot;yes - user1 and namespace1&quot;] {
    check_namespace
    check_user
  }
  </code></pre>
  <p>.</p>
  <pre><code>## policy-2.rego
  
  package kubernetes.admission
  
  check_namespace {
     # evaluate to false
     namespaces := {&quot;namespace2&quot;}
     namespaces[input.request.namespace]
  }
  
  check_user {
      # evaluate to true
      users := {&quot;user2&quot;}
      users[input.request.userInfo.username]
  }
  
  allow[&quot;yes - user2 and namespace12] {
    check_namespace
    check_user
  }
  </code></pre>
  <p>.</p>
  <pre><code>## main.rego
  
  package system
  
  import data.kubernetes.admission
  
  main = {
    &quot;apiVersion&quot;: &quot;admission.k8s.io/v1&quot;,
    &quot;kind&quot;: &quot;AdmissionReview&quot;,
    &quot;response&quot;: response,
  }
  
  default uid = &quot;&quot;
  
  uid = input.request.uid
  
  response = {
      &quot;allowed&quot;: true,
      &quot;uid&quot;: uid,
  } {
      reason = concat(&quot;, &quot;, admission.allow)
      reason != &quot;&quot;
  }
  else = {&quot;allowed&quot;: false, &quot;uid&quot;: uid}
  </code></pre>
  <p>.</p>
  <pre><code> ## example input
  {
    &quot;apiVersion&quot;: &quot;admission.k8s.io/v1beta1&quot;,
    &quot;kind&quot;: &quot;AdmissionReview&quot;,
    &quot;request&quot;: {
      &quot;namespace&quot;: &quot;namespace1&quot;,
      &quot;userInfo&quot;: {
          &quot;username&quot;: &quot;user2&quot;
      }
    }
  }
  </code></pre>
  <p>.</p>
  <pre><code>## Results
  
  &quot;allow&quot;: [
      &quot;yes - user1 and namespace1&quot;,
      &quot;yes - user2 and namespace2&quot;
  ]
  </code></pre>
  <p>It seems that all of my policies are being evaluated as just one flat file, but i would expect that each policy will be evaluated independently from the others</p>
  <p>What am I missing here?</p>