From efae5d1b58a1f412c1624094bdf5551e1a7dcb9b Mon Sep 17 00:00:00 2001 From: Charlie Egan Date: Tue, 2 Dec 2025 11:06:38 +0000 Subject: [PATCH] Update a number of links to their new location (#8100) * Update a number of links to their new location https://github.com/open-policy-agent/opa/issues/8091 highlighted a number of 'broken' links that are just redirects. I have updated many of these in this PR. Hopefully next time, the broken link report will be easier to parse. Signed-off-by: Charlie Egan * Update docs/docs/policy-performance.md Co-authored-by: Stephan Renatus Signed-off-by: Charlie Egan --------- Signed-off-by: Charlie Egan Signed-off-by: Charlie Egan Co-authored-by: Stephan Renatus --- ADOPTERS.md | 32 +++++++++---------- COMMUNITY_GUIDELINES.md | 2 +- CONTRIBUTING.md | 2 +- docs/README.md | 2 +- docs/devel/DEVELOPMENT.md | 2 +- docs/devel/RELEASE.md | 2 +- docs/docs/aws-cloudformation-hooks.md | 12 +++---- docs/docs/configuration.md | 16 +++++----- docs/docs/contrib-code.md | 4 +-- docs/docs/contrib-development.md | 8 ++--- docs/docs/contrib-docs.md | 6 ++-- docs/docs/deploy/docker/index.md | 2 +- docs/docs/docker-authorization.md | 4 +-- docs/docs/envoy/debugging.md | 2 +- docs/docs/envoy/performance.md | 4 +-- docs/docs/envoy/tutorial-istio.md | 2 +- docs/docs/external-data/index.md | 2 +- docs/docs/graphql-api-authorization.md | 2 +- docs/docs/kafka-authorization.md | 10 +++--- docs/docs/kubernetes/index.md | 2 +- docs/docs/kubernetes/primer.md | 2 +- docs/docs/management-bundles/index.md | 14 ++++---- docs/docs/ocp/concepts.md | 2 +- docs/docs/ocp/index.md | 2 +- docs/docs/operations.md | 4 +-- docs/docs/policy-performance.md | 4 +-- .../policy-reference/builtins/tokensign.mdx | 4 +-- docs/docs/rest-api.md | 2 +- docs/docs/ssh-and-sudo-authorization.md | 2 +- docs/docs/terraform.md | 6 ++-- docs/docs/wasm.md | 2 +- docs/projects/regal/adopters.md | 6 ++-- docs/projects/regal/cli.md | 4 +-- .../regal/configuration/project-roots.md | 2 +- docs/projects/regal/custom-rules/roast.md | 2 +- docs/projects/regal/editor-support.md | 2 +- docs/projects/regal/index.md | 2 +- docs/projects/regal/opa-one-dot-zero.md | 4 +-- .../regal/rules/bugs/time-now-ns-twice.md | 4 +-- .../rules/testing/dubious-print-sprintf.md | 2 +- .../rules/testing/print-or-trace-call.md | 2 +- .../data/ecosystem/entries/apache-apisix.md | 4 +-- docs/src/data/ecosystem/entries/atmos.md | 2 +- .../entries/aws-cloudformation-hook.md | 2 +- docs/src/data/ecosystem/entries/ceph.md | 2 +- docs/src/data/ecosystem/entries/circleci.md | 2 +- .../ecosystem/entries/clair-datasource.md | 4 +-- .../ecosystem/entries/cloudflare-worker.md | 4 +-- .../{enterprise-contract.md => conforma.md} | 12 +++---- docs/src/data/ecosystem/entries/dapr.md | 2 +- docs/src/data/ecosystem/entries/easegress.md | 2 +- .../entries/elasticsearch-datafiltering.md | 4 +-- docs/src/data/ecosystem/entries/env0.md | 6 ++-- .../ecosystem/entries/envoy-authorization.md | 4 +-- .../data/ecosystem/entries/expressing-or.md | 6 ++-- .../ecosystem/entries/fairwinds-insights.md | 2 +- docs/src/data/ecosystem/entries/flipt.md | 8 ++--- docs/src/data/ecosystem/entries/gatekeeper.md | 2 +- .../entries/github-action-opa-rego-test.md | 2 +- .../data/ecosystem/entries/google-calendar.md | 2 +- docs/src/data/ecosystem/entries/graphql.md | 2 +- docs/src/data/ecosystem/entries/iptables.md | 4 +-- .../ecosystem/entries/kafka-authorization.md | 4 +-- .../ecosystem/entries/kong-authorization.md | 2 +- .../entries/kubernetes-authorization.md | 2 +- .../kubernetes-validating-admission.md | 2 +- docs/src/data/ecosystem/entries/kubescape.md | 2 +- docs/src/data/ecosystem/entries/kubeshield.md | 2 +- docs/src/data/ecosystem/entries/linux-pam.md | 2 +- docs/src/data/ecosystem/entries/oauth2.md | 4 +-- docs/src/data/ecosystem/entries/ocpr.md | 8 ++--- .../data/ecosystem/entries/opa-aspnetcore.md | 2 +- docs/src/data/ecosystem/entries/opa-csharp.md | 2 +- .../data/ecosystem/entries/opa-java-wasm.md | 4 +-- docs/src/data/ecosystem/entries/opa-java.md | 2 +- .../data/ecosystem/entries/opa-springboot.md | 2 +- docs/src/data/ecosystem/entries/opal.md | 6 ++-- docs/src/data/ecosystem/entries/optoggles.md | 2 +- .../ecosystem/entries/principled-evolution.md | 2 +- .../ecosystem/entries/rego-cheat-sheet.md | 8 ++--- docs/src/data/ecosystem/entries/rond.md | 2 +- docs/src/data/ecosystem/entries/scalr-iacp.md | 2 +- docs/src/data/ecosystem/entries/spacelift.md | 4 +-- .../ecosystem/entries/springsecurity-api.md | 4 +-- .../ecosystem/entries/sql-datafiltering.md | 2 +- docs/src/data/ecosystem/entries/swift-opa.md | 2 +- docs/src/data/ecosystem/entries/terraform.md | 8 ++--- docs/src/data/ecosystem/entries/waltid.md | 6 ++-- 88 files changed, 179 insertions(+), 179 deletions(-) rename docs/src/data/ecosystem/entries/{enterprise-contract.md => conforma.md} (64%) diff --git a/ADOPTERS.md b/ADOPTERS.md index 1601a77d76..bf1d2aee28 100644 --- a/ADOPTERS.md +++ b/ADOPTERS.md @@ -44,7 +44,7 @@ production users that have added themselves (in alphabetical order): information stored on namespaces. OPA is deployed on multiple clusters with ~100 nodes and ~300 namespaces total. -* [BNY Mellon](https://www.bnymellon.com/) uses OPA as a sidecar to enforce access +* [BNY Mellon](https://www.bny.com/corporate/global/en.html) uses OPA as a sidecar to enforce access control over applications based on external context coming from AD and other internal services. For more information see this talk from [QCon 2019](https://www.infoq.com/presentations/opa-spring-boot-hocon/). @@ -112,7 +112,7 @@ production users that have added themselves (in alphabetical order): [Config Controller](https://cloud.google.com/kubernetes-engine/enterprise/policy-controller), [GKE Policy Automation](https://github.com/google/gke-policy-automation) or [Config Validator](https://github.com/GoogleCloudPlatform/policy-library). See - [Creating policy-compliant Google Cloud resources article](https://cloud.google.com/kubernetes-engine/enterprise/policy-controller/docs/how-to/creating-policy-controller-constraints) + [Creating policy-compliant Google Cloud resources article](https://docs.cloud.google.com/kubernetes-engine/policy-controller/docs/how-to/creating-policy-controller-constraints) for example use cases. * [Infracost](https://www.infracost.io/) shows cloud cost estimates for Terraform. @@ -176,7 +176,7 @@ production users that have added themselves (in alphabetical order): * [Plex Systems](https://www.plex.com) uses OPA to enforce policy throughout their entire release process; from local development to continuous production - audits. The CI/CD pipelines at Plex leverage [conftest](https://github.com/instrumenta/conftest), + audits. The CI/CD pipelines at Plex leverage [conftest](https://github.com/open-policy-agent/conftest), a policy enforcement tool that relies on OPA, to automatically reject changes that do not adhere to defined policies. Plex also uses [Gatekeeper](https://github.com/open-policy-agent/gatekeeper), a Kubernetes policy controller, as @@ -196,25 +196,25 @@ production users that have added themselves (in alphabetical order): etc. SAP/Infrabox is used in production within SAP and has several external users. -* [Terminus Software](https://terminus.com/) uses OPA for microservice authorization. +* [Terminus Software](https://demandscience.com/?utm_campaign=terminus-redirect) uses OPA for microservice authorization. * [T-Mobile](https://www.t-mobile.com) uses OPA as a core component for their [MagTape](https://github.com/tmobile/magtape/) project that enforces best practices and secure configurations across their fleet of Kubernetes - clusters (more info in [this blog post](https://opensource.t-mobile.com/blog/posts/rolling-out-the-magenta-tape/)). + clusters (more info in [this blog post](https://www.t-mobile.com/)). T-Mobile also leverages OPA to enforce authorization workflows within their Corporate Delivery Platform (CI/CD). -* [Tremolo Security](https://www.tremolosecurity.com/) uses OPA at a +* [Tremolo Security](https://www.tremolo.io/) uses OPA at a London-based financial services company to inject annotations and volume mount parameters into Kubernetes Pods so that workloads can connect to off-cluster CIFS drives and SQL Server instances. Policies are based on external context sourced from OpenUnison. Ability to validate policies offline is a huge win because the clusters are air-gapped. For more information on how - Tremolo Security uses OPA see [this blog post](https://www.tremolosecurity.com/beyond-rbac-in-openshift-open-policy-agent/). + Tremolo Security uses OPA see [this blog post](https://www.tremolo.io/beyond-rbac-in-openshift-open-policy-agent/). -* [Tripadvisor](http://tripadvisor.com/) uses OPA to enforce +* [Tripadvisor](https://tripadvisor.com/) uses OPA to enforce admission control policies in Kubernetes. In the process of rolling out OPA, they created an integration testing framework that verifies clusters are accepting and rejecting the right objects when OPA is deployed. For more information see @@ -230,7 +230,7 @@ production users that have added themselves (in alphabetical order): have propagated. For more details on the VGS use case see this [blog post](https://www.verygoodsecurity.com/blog/posts/building-a-fine-grained-permission-system-in-a-distributed-environment). -* [VNG Cloud](https://www.vngcloud.vn/en/home) [Identity and Access Management (IAM)](https://iam.vngcloud.vn/) +* [VNG Cloud](https://www.vngcloud.vn/en/home) [Identity and Access Management (IAM)](https://iam.console.vngcloud.vn/) use OPA as a policy-based decision engine for authorization. IAM provides administrators with fine-grained access control to VNG Cloud resources and help centralize and manage permissions to access resources. Specifically, OPA is integrated to evaluate policies to make the decision about denying or allowing incoming requests. @@ -240,9 +240,9 @@ production users that have added themselves (in alphabetical order): automatically correlates the entire security stack to uncover the most pressing issues. Wiz policies leverage Open Policy Agent (OPA) for a unified framework across the cloud-native stack. Whether for configurations, compliance, IaC, and more, OPA enables - teams to move faster in the cloud. For more information on how Wiz uses OPA, [contact Wiz](https://www.wiz.io/contact/). + teams to move faster in the cloud. For more information on how Wiz uses OPA, [contact Wiz](https://www.wiz.io/contact). -* [Xenit AB](https://www.xenit.se/) uses OPA to implement fine-grained control +* [Xenit AB](https://xenit.se/) uses OPA to implement fine-grained control over resource formulation in its managed Kubernetes service as well as several customer-specific implementations. For more information, see the Kubernetes Terraform library [OPA Gatekeeper module](https://github.com/XenitAB/terraform-modules/tree/main/modules/kubernetes/gatekeeper) and @@ -270,7 +270,7 @@ pre-production (in alphabetical order): [OPA Runtime](https://github.com/aserto-dev/runtime) that make it easier for developers to incorporate OPA policies and the OPA engine into their applications. -* [Cyral](https://www.cyral.com/) is a venture-funded data security +* [Cyral](https://www.varonis.com/platform/database-activity-monitoring) is a venture-funded data security company. Still in stealth mode but using OPA to manage and enforce fine-grained authorization policies. @@ -284,7 +284,7 @@ pre-production (in alphabetical order): * [Scalr](https://scalr.com/) is a remote operations backend for Terraform that helps users scale their Terraform usage through automation and collaboration. - [Scalr uses OPA](https://docs.scalr.com/en/latest/opa.html) to validate Terraform + [Scalr uses OPA](https://docs.scalr.io/docs/introduction) to validate Terraform code against organization standards and allows for approvals prior to a Terraform apply. * [Spacelift](https://spacelift.io) is a specialized CI/CD platform @@ -303,9 +303,9 @@ testing include: * [Cisco](https://www.cisco.com/) * [Nefeli Networks](https://nefeli.io) * [SolarWinds](https://www.solarwinds.com/) via [Lee Calcote](https://github.com/leecalcote) -* [State Street Corporation](http://www.statestreet.com/) -* [PITS Global Data Recovery Services](https://www.pitsdatarecovery.net/) +* [State Street Corporation](https://www.statestreet.com/us/en) +* [PITS Global Data Recovery Services](https://www.pitsdatarecovery.com/) If you have adopted OPA and would like to be included in this list, feel free to submit a PR updating this file or -[open an issue](https://github.com/open-policy-agent/opa/issues/new?assignees=&labels=adopt-opa&template=adopt-opa.yaml&title=organization_name+has+adopted+OPA). +[open an issue](https://github.com/login?return_to=https%3A%2F%2Fgithub.com%2Fopen-policy-agent%2Fopa%2Fissues%2Fnew%3Fassignees%3D%26labels%3Dadopt-opa%26template%3Dadopt-opa.yaml%26title%3Dorganization_name%2Bhas%2Badopted%2BOPA). diff --git a/COMMUNITY_GUIDELINES.md b/COMMUNITY_GUIDELINES.md index 08f0155baf..714ca3b5a2 100644 --- a/COMMUNITY_GUIDELINES.md +++ b/COMMUNITY_GUIDELINES.md @@ -1,6 +1,6 @@ # OPA Community Guidelines v2.0 -The [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/master/code-of-conduct.md) is enforced in all areas of the OPA community, plus the following. +The [CNCF Code of Conduct](https://github.com/cncf/foundation/blob/main/code-of-conduct.md) is enforced in all areas of the OPA community, plus the following. ## Relevancy diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 45f46eb6c1..ee9665ede1 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -2,5 +2,5 @@ Thanks for your interest in contributing to the Open Policy Agent (OPA) project! -Please refer to [OPA's contribution guidelines](https://www.openpolicyagent.org/docs/latest/contributing/) +Please refer to [OPA's contribution guidelines](https://www.openpolicyagent.org/docs/contributing) to find out how you can help. diff --git a/docs/README.md b/docs/README.md index 3a47a39d6a..70b61f4c3c 100644 --- a/docs/README.md +++ b/docs/README.md @@ -1,6 +1,6 @@ # Documentation and Website Development Please see the -[contributing documentation](http://openpolicyagent.org/docs/contrib-docs) +[contributing documentation](https://www.openpolicyagent.org/docs/contrib-docs) for information about how to get started contributing to the OPA documentation and website. diff --git a/docs/devel/DEVELOPMENT.md b/docs/devel/DEVELOPMENT.md index 7e6efcc71b..47c67d4580 100644 --- a/docs/devel/DEVELOPMENT.md +++ b/docs/devel/DEVELOPMENT.md @@ -1,4 +1,4 @@ ## Development The development guide has become part of the Contributing documentation -and can be found [here](https://www.openpolicyagent.org/docs/contrib-development/). \ No newline at end of file +and can be found [here](https://www.openpolicyagent.org/docs/contrib-development). \ No newline at end of file diff --git a/docs/devel/RELEASE.md b/docs/devel/RELEASE.md index 8a8ce9f90d..7b6ac4c65b 100644 --- a/docs/devel/RELEASE.md +++ b/docs/devel/RELEASE.md @@ -57,7 +57,7 @@ standard GitHub fork workflow. See [OPA Dev Instructions](DEVELOPMENT.md) git checkout -b release-v origin/main ``` -1. Create a [personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/creating-a-personal-access-token) +1. Create a [personal access token](https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/managing-your-personal-access-tokens) for GitHub with the 'read:org' scope. Export it to the `GITHUB_TOKEN` environment variable. 1. Execute the release-patch target to generate boilerplate patch. Give the semantic version of the release: diff --git a/docs/docs/aws-cloudformation-hooks.md b/docs/docs/aws-cloudformation-hooks.md index 85e66a1fa1..42a5e3d382 100644 --- a/docs/docs/aws-cloudformation-hooks.md +++ b/docs/docs/aws-cloudformation-hooks.md @@ -2,7 +2,7 @@ title: AWS CloudFormation Hooks --- -[AWS CloudFormation Hooks](https://docs.aws.amazon.com/cloudformation-cli/latest/userguide/hooks.html) allows users to +[AWS CloudFormation Hooks](https://docs.aws.amazon.com/cloudformation-cli/latest/hooks-userguide/what-is-cloudformation-hooks.html) allows users to verify AWS infrastructure components defined in AWS CloudFormation [templates](https://aws.amazon.com/cloudformation/resources/templates/), like S3 Buckets or EC2 instances, prior to deployment. This is done via **hooks**. Hooks are composed of custom code running in an AWS Lambda function, which is @@ -12,8 +12,8 @@ AWS currently supports hooks written in either Java or Python, and provides a [sample repository](https://github.com/aws-cloudformation/aws-cloudformation-samples), which includes example hooks written in both languages. Since we'd rather use OPA for this purpose, we'd need some code to process the requests handled by the hook and send them forward to OPA for policy decisions via its -[REST API](https://www.openpolicyagent.org/docs/latest/rest-api/) using -the [OPA AWS CloudFormation Hook](https://github.com/StyraInc/opa-aws-cloudformation-hook). +[REST API](https://www.openpolicyagent.org/docs/rest-api) using +the [OPA AWS CloudFormation Hook](https://github.com/StyraOSS/opa-aws-cloudformation-hook). ## Goals @@ -35,7 +35,7 @@ In order to complete this tutorial, the following prerequisites needs to be met: - Docker - OPA server running at an endpoint reachable by the AWS Lambda function, either within the same AWS environment, or elsewhere. While developing your CloudFormation policies, a good option is to run OPA locally, but exposed to the - public via a service like [tunnelmole](https://tunnelmole.com/docs), an open source tunneling tool or [ngrok](https://ngrok.com/), + public via a service like [tunnelmole](https://tunnelmole.com/docs/), an open source tunneling tool or [ngrok](https://ngrok.com/), a popular closed source tunneling tool. ## Steps @@ -45,7 +45,7 @@ In order to complete this tutorial, the following prerequisites needs to be met: To start out, clone the OPA AWS CloudFormation Hook repository: ```shell -git clone https://github.com/StyraInc/opa-aws-cloudformation-hook.git +git clone https://github.com/StyraOSS/opa-aws-cloudformation-hook.git cd opa-aws-cloudformation-hook ``` @@ -447,7 +447,7 @@ bucket_is_private if { Note how we no longer need the `bucket_create_or_update` rule, as that is already asserted by the main policy. Quite an improvement in terms of readability, and a good foundation for further policy authoring. If you'd like to see more examples of policy utilizing this pattern, check out the -[policy directory](https://github.com/StyraInc/opa-aws-cloudformation-hook/tree/main/examples/policy) in the OPA AWS +[policy directory](https://github.com/StyraOSS/opa-aws-cloudformation-hook/tree/main/examples/policy) in the OPA AWS CloudFormation Hook repo. ### OPA Authentication via AWS Secrets diff --git a/docs/docs/configuration.md b/docs/docs/configuration.md index 4383484c7a..852217ea74 100644 --- a/docs/docs/configuration.md +++ b/docs/docs/configuration.md @@ -361,7 +361,7 @@ Following successful authentication at the token endpoint the returned token wil Two claims will always be included in the issued JWT: `iat` and `exp`. Any other claims will be populated from the `additional_claims` map. -The following is an example of using a [Google Cloud Storage](https://cloud.google.com/storage/) bucket as a bundle service backend +The following is an example of using a [Google Cloud Storage](https://cloud.google.com/storage) bucket as a bundle service backend from outside the cloud account (for access from inside the account, see the [GCP Metadata Token](#gcp-metadata-token) section). ```yaml @@ -399,7 +399,7 @@ Consider requiring authentication in order to prevent unauthorized read access t ### AWS Signature -OPA will authenticate with an [AWS Version 4](https://docs.aws.amazon.com/general/latest/gr/sigv4_signing.html) or version 4A signature. While version 4 is the default, version 4A must be used when making requests that might be handled by more than one region, such as an [S3 Multi-Region Access Point](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPoints.html). You must use version 4A for this or requests will fail when routed to a different region than the one indicated in a version 4 signature. Furthermore, using version 4a also requires that temporary credentials are retrieved from a [regional AWS STS endpoint](https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html), rather than the global STS endpoint. +OPA will authenticate with an [AWS Version 4](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_sigv-create-signed-request.html) or version 4A signature. While version 4 is the default, version 4A must be used when making requests that might be handled by more than one region, such as an [S3 Multi-Region Access Point](https://docs.aws.amazon.com/AmazonS3/latest/userguide/MultiRegionAccessPoints.html). You must use version 4A for this or requests will fail when routed to a different region than the one indicated in a version 4 signature. Furthermore, using version 4a also requires that temporary credentials are retrieved from a [regional AWS STS endpoint](https://docs.aws.amazon.com/sdkref/latest/guide/feature-sts-regionalized-endpoints.html), rather than the global STS endpoint. Several methods of obtaining the necessary credentials are available; exactly one must be specified to use the AWS signature authentication method. @@ -427,7 +427,7 @@ Please note that if you are using temporary IAM credentials (e.g. assumed IAM ro #### Using Named Profile Credentials If specifying `profile_credentials`, OPA will expect to find the `access key id`, `secret access key` and -`session token` from the [named profiles](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-profiles.html) +`session token` from the [named profiles](https://docs.aws.amazon.com/cli/latest/userguide/cli-configure-files.html) stored in the [credentials](https://docs.aws.amazon.com/sdkref/latest/guide/file-format.html) file on disk. On each request OPA will re-read the credentials from the file and use them for authentication. @@ -452,7 +452,7 @@ On each request, Opa will try to use cached token acquired credentials using the #### Using EC2 Metadata Credentials If specifying `metadata_credentials`, OPA will use the AWS metadata services for [EC2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/iam-roles-for-amazon-ec2.html) -or [ECS](https://docs.aws.amazon.com/AmazonECS/latest/userguide/task-iam-roles.html) +or [ECS](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html) to obtain the necessary credentials when running within a supported virtual machine/container. To use the EC2 metadata service, the IAM role to use and the AWS region for the resource must both @@ -527,7 +527,7 @@ If specifying `web_identity_credentials`, OPA will expect to find environment va ### GCP Metadata Token -OPA will authenticate with a GCP [access token](https://cloud.google.com/run/docs/securing/service-identity#access_tokens) or [identity token](https://cloud.google.com/run/docs/securing/service-identity) fetched from the [Compute Metadata Server](https://cloud.google.com/compute/docs/storing-retrieving-metadata). When one or more `scopes` is provided an access token is fetched. When a non-empty `audience` is provided an identity token is fetched. An audience or `scopes` array is required. +OPA will authenticate with a GCP [access token](https://cloud.google.com/run/docs/securing/service-identity#access_tokens) or [identity token](https://cloud.google.com/run/docs/securing/service-identity) fetched from the [Compute Metadata Server](https://docs.cloud.google.com/compute/docs/metadata/overview). When one or more `scopes` is provided an access token is fetched. When a non-empty `audience` is provided an identity token is fetched. An audience or `scopes` array is required. When authenticating to native GCP services such as [Google Cloud Storage](https://cloud.google.com/storage) an access token should be used with the appropriate set of scopes required by the target resource. When authenticating to a third party application such as an application hosted on Google Cloud Run an identity token should be used. @@ -586,7 +586,7 @@ When the given resource (the object in the GCS bucket) contains slashes (/) or o ### Azure Managed Identities Token -OPA will authenticate with an [Azure managed identities](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) token. +OPA will authenticate with an [Azure managed identities](https://learn.microsoft.com/en-us/entra/identity/managed-identities-azure-resources/overview) token. The [token request](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/how-to-use-vm-token#get-a-token-using-http) can be configured via the plugin to customize the base URL, API version, and resource. Specific managed identity IDs can be optionally provided as well. (The token request for [Azure App Service](https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=portal%2Chttp#connect-to-azure-services-in-app-code) or @@ -602,7 +602,7 @@ but the endpoint and the header are different. Please see the individual documen | `services[_].credentials.azure_managed_identity.client_id` | `string` | No | Optional client ID of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities. | | `services[_].credentials.azure_managed_identity.mi_res_id` | `string` | No | Optional Azure Resource ID of the managed identity you would like the token for. Required, if your VM has multiple user-assigned managed identities. | -The following is an example of how to use an [Azure storage account](https://docs.microsoft.com/en-us/azure/storage/common/storage-account-overview) +The following is an example of how to use an [Azure storage account](https://learn.microsoft.com/en-us/azure/storage/common/storage-account-overview) as a bundle service backend. > Note that the `x-ms-version` header must be specified for the storage account @@ -833,7 +833,7 @@ included in the actual bundle gzipped tarball. | `decision_logs.service` | `string` | No | Name of the service to use to contact remote server. If no `plugin` is specified, and `console` logging is disabled, this will default to the first `service` name defined in the Services configuration. | | `decision_logs.partition_name` | `string` | No | Deprecated: Use `resource` instead. Path segment to include in status updates. | | `decision_logs.resource` | `string` | No (default: `/logs`) | Full path to use for sending decision logs to a remote server. | -| `decision_logs.reporting.buffer_type` | `string` | No (default: `size`) | Toggles the type of buffer to use. The two available options are "size" or "event". Refer to the [Decision Log Plugin README](https://github.com/open-policy-agent/opa/tree/main/v1/plugins/logs/README.md) for for a detailed comparison. | +| `decision_logs.reporting.buffer_type` | `string` | No (default: `size`) | Toggles the type of buffer to use. The two available options are "size" or "event". Refer to the [Decision Log Plugin README](https://github.com/open-policy-agent/opa/blob/main/v1/plugins/logs/README.md) for for a detailed comparison. | | `decision_logs.reporting.buffer_size_limit_events` | `int64` | No (default: `10000`) | Decision log buffer size limit by events. OPA will drop old events from the log if this limit is exceeded. By default, 100 events are held. This number has to be greater than zero. Only works with "event" buffer type. | | `decision_logs.reporting.buffer_size_limit_bytes` | `int64` | No (default: `unlimited`) | Decision log buffer size limit in bytes. OPA will drop old events from the log if this limit is exceeded. By default, no limit is set. Only one of `buffer_size_limit_bytes`, `max_decisions_per_second` may be set. Only works with "size" buffer type. | | `decision_logs.reporting.max_decisions_per_second` | `float64` | No | Maximum number of decision log events to buffer per second. OPA will drop events if the rate limit is exceeded. Only one of `buffer_size_limit_bytes`, `max_decisions_per_second` may be set. | diff --git a/docs/docs/contrib-code.md b/docs/docs/contrib-code.md index cc3b77213a..1eba868b9f 100644 --- a/docs/docs/contrib-code.md +++ b/docs/docs/contrib-code.md @@ -160,8 +160,8 @@ On each Pull Request, a series of tests will be run to ensure that the code is up to standard. Part of this process is also to run vulnerability scanning on the code and on the generated container image. -[Trivy](https://aquasecurity.github.io/trivy/) is used to run the aforementioned -vulnerability scanning. To install, follow the [installation instructions](https://aquasecurity.github.io/trivy/v0.29.2/getting-started/installation/). +[Trivy](http://trivy.dev/) is used to run the aforementioned +vulnerability scanning. To install, follow the [installation instructions](http://trivy.dev/v0.29.2/getting-started/installation/). To run the vulnerability scanning, on the code-base, run the following command: diff --git a/docs/docs/contrib-development.md b/docs/docs/contrib-development.md index 91df0aa8b9..7c45bac557 100644 --- a/docs/docs/contrib-development.md +++ b/docs/docs/contrib-development.md @@ -8,7 +8,7 @@ the [Contributing to OPA](./contrib-code) page first. OPA is written in the [Go](https://golang.org) programming language. If you are new to Go, consider reading -[Effective Go](https://golang.org/doc/effective_go.html), +[Effective Go](https://go.dev/doc/effective_go.html), [Go Code Review Comments](https://go.dev/wiki/CodeReviewComments) or [How to Write Go Code](https://go.dev/doc/code) for guidance on writing idiomatic Go code. @@ -23,7 +23,7 @@ Requirements: ## Getting Started -After forking the repository and creating a [clone from your fork](https://docs.github.com/en/get-started/quickstart/contributing-to-projects), +After forking the repository and creating a [clone from your fork](https://docs.github.com/en/get-started/exploring-projects-on-github/contributing-to-a-project), just run `make`. This will: - Build the OPA binary. @@ -98,7 +98,7 @@ git push origin somefeature > Make sure to use a [good commit message](./contrib-code/#commit-messages). Now, submit a Pull Request from your fork. -See the official [GitHub Documentation](https://help.github.com/en/github/collaborating-with-issues-and-pull-requests/creating-a-pull-request-from-a-fork) +See the official [GitHub Documentation](https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/proposing-changes-to-your-work-with-pull-requests/creating-a-pull-request-from-a-fork) for instructions to create the request. > Hint: You should be prompted to with a "Compare and Pull Request" button @@ -108,7 +108,7 @@ Once your Pull Request has been reviewed and signed off please squash your commits. If you have a specific reason to leave multiple commits in the Pull Request, please mention it in the discussion. -> If you are not familiar with squashing commits, see [the following blog post for a good overview](http://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html). +> If you are not familiar with squashing commits, see [the following blog post for a good overview](https://gitready.com/advanced/2009/02/10/squashing-commits-with-rebase.html). ## Benchmarks diff --git a/docs/docs/contrib-docs.md b/docs/docs/contrib-docs.md index a6d7e98df1..4efb3dcd8e 100644 --- a/docs/docs/contrib-docs.md +++ b/docs/docs/contrib-docs.md @@ -88,7 +88,7 @@ if you need some help setting this up. ## Updating Existing Documentation Navigate to the -[docs](https://github.com/open-policy-agent/opa/blob/main/docs/docs) +[docs](https://github.com/open-policy-agent/opa/tree/main/docs/docs) folder in your local environment. Each top level item in the documentation nav will have an associated markdown file in the documentation folder. Locate the file you wish to update and confirm the title in the YAML frontmatter matches. Once @@ -138,8 +138,8 @@ The [OPA Ecosystem](/ecosystem/) is a showcase of projects that are built with or integrated with OPA. If you have a project that you would like to showcase, please open a PR with two files: -- A markdown file in [docs/src/data/ecosystem/entries](https://github.com/open-policy-agent/opa/blob/main/docs/src/data/ecosystem/entries) -- An icon file in [docs/static/img/ecosystem-entry-logos](https://github.com/open-policy-agent/opa/blob/main/docs/static/img/ecosystem-entry-logos) +- A markdown file in [docs/src/data/ecosystem/entries](https://github.com/open-policy-agent/opa/tree/main/docs/src/data/ecosystem/entries) +- An icon file in [docs/static/img/ecosystem-entry-logos](https://github.com/open-policy-agent/opa/tree/main/docs/static/img/ecosystem-entry-logos) Both files should have the same 'id', e.g. if your project is called `foobar`, then the markdown file should be named `foobar.md` and the icon file diff --git a/docs/docs/deploy/docker/index.md b/docs/docs/deploy/docker/index.md index f73d70b5b9..35c0588fa4 100644 --- a/docs/docs/deploy/docker/index.md +++ b/docs/docs/deploy/docker/index.md @@ -267,7 +267,7 @@ OPA will respond with the greeting from the policy (the pod hostname will differ ### Readiness and Liveness Probes OPA exposes a `/health` API endpoint that you can configure Kubernetes -[Readiness and Liveness Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/) +[Readiness and Liveness Probes](https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-startup-probes/) to call. For example: diff --git a/docs/docs/docker-authorization.md b/docs/docs/docker-authorization.md index 384083295c..31a27e4f20 100644 --- a/docs/docs/docker-authorization.md +++ b/docs/docs/docker-authorization.md @@ -38,7 +38,7 @@ This tutorial requires: - Docker Engine 18.06.0-ce or newer - Docker API version 1.38 or newer - `root` or `sudo` access -- Nginx, or any capable [bundle](https://www.openpolicyagent.org/docs/latest/management-bundles/) server +- Nginx, or any capable [bundle](https://www.openpolicyagent.org/docs/management-bundles) server The tutorial has been tested on the following platforms: @@ -69,7 +69,7 @@ the policy. ### 2. Create policy bundle and OPA configuration. -For the purpose of this example, we are going to use [Nginx](https://www.openpolicyagent.org/docs/latest/management-bundles/#nginx) +For the purpose of this example, we are going to use [Nginx](https://www.openpolicyagent.org/docs/management-bundles#nginx) to serve bundles from the same machine Docker is running on. With nginx running, simply build the policy bundle placed into the nginx web root directory. diff --git a/docs/docs/envoy/debugging.md b/docs/docs/envoy/debugging.md index ccd92efccf..6ba2555597 100644 --- a/docs/docs/envoy/debugging.md +++ b/docs/docs/envoy/debugging.md @@ -12,7 +12,7 @@ OPA-Envoy plugin. If none of these tips work, feel free to join ### Benchmarking Queries The `opa bench` command evaluates a Rego query multiple times and reports metrics. You can also profile your polices using -`opa eval` to understand expression evaluation time. More information on improving policy performance can be found [here](https://www.openpolicyagent.org/docs/latest/policy-performance/). +`opa eval` to understand expression evaluation time. More information on improving policy performance can be found [here](https://www.openpolicyagent.org/docs/policy-performance). ### Analyzing Decision Logs diff --git a/docs/docs/envoy/performance.md b/docs/docs/envoy/performance.md index 0cc7d2e2db..d5f84d48d4 100644 --- a/docs/docs/envoy/performance.md +++ b/docs/docs/envoy/performance.md @@ -145,7 +145,7 @@ containers: > 💡 Consider specifying CPU and memory resource requests and limits for the OPA and other containers to prevent > deployments from resource starvation. -> You can also start OPA with the [`GOMAXPROCS`](https://golang.org/pkg/runtime)environment variable to limit the number of +> You can also start OPA with the [`GOMAXPROCS`](https://pkg.go.dev/runtime)environment variable to limit the number of > cores that OPA can consume. > > 💡 The OPA-Envoy plugin can be configured to listen on a UNIX Domain Socket. A complete example of such a setup @@ -254,7 +254,7 @@ CPU and memory consumed as well as latency added. ### Features -The sample OPA-Envoy deployment described [previously](#opa-envoy-plugin), does not utilize OPA's [decision logs](https://www.openpolicyagent.org/docs/latest/management-decision-logs/) +The sample OPA-Envoy deployment described [previously](#opa-envoy-plugin), does not utilize OPA's [decision logs](https://www.openpolicyagent.org/docs/management-decision-logs) management API that enables periodic reporting of decision logs to remote HTTP servers or local console. Decision logging can be enabled by updating the OPA-Envoy configuration, and the guidance provided on this page can be used to gather benchmark results. diff --git a/docs/docs/envoy/tutorial-istio.md b/docs/docs/envoy/tutorial-istio.md index 11af132522..387b906cec 100644 --- a/docs/docs/envoy/tutorial-istio.md +++ b/docs/docs/envoy/tutorial-istio.md @@ -12,7 +12,7 @@ This tutorial shows how Istio's AuthorizationPolicy can be configured to delegat ## Prerequisites This tutorial requires Kubernetes 1.20 or later. To run the tutorial locally ensure you start a cluster with Kubernetes -version 1.20+, we recommend using [minikube](https://kubernetes.io/docs/getting-started-guides/minikube) or +version 1.20+, we recommend using [minikube](https://kubernetes.io/docs/setup/) or [KIND](https://kind.sigs.k8s.io/). The tutorial also requires Istio v1.19.0 or later. It assumes you have Istio deployed on top of Kubernetes. diff --git a/docs/docs/external-data/index.md b/docs/docs/external-data/index.md index 0edeafa82b..75caeb2685 100644 --- a/docs/docs/external-data/index.md +++ b/docs/docs/external-data/index.md @@ -9,7 +9,7 @@ This document describes options for replicating data into OPA. The content of th ## Option 1: JWT Tokens -[JSON Web Tokens (JWTs)](https://tools.ietf.org/html/rfc7519) allow you to securely transmit JSON data between software systems and are usually produced during the authentication process. You can set up authentication so that when the user logs in you create a JWT with that user's attributes (or any other data as far as OPA is concerned). Then you hand that JWT to OPA and use OPA's specialized support for JWTs to extract the information you need to make a policy decision. +[JSON Web Tokens (JWTs)](https://datatracker.ietf.org/doc/html/rfc7519) allow you to securely transmit JSON data between software systems and are usually produced during the authentication process. You can set up authentication so that when the user logs in you create a JWT with that user's attributes (or any other data as far as OPA is concerned). Then you hand that JWT to OPA and use OPA's specialized support for JWTs to extract the information you need to make a policy decision. ### Flow diff --git a/docs/docs/graphql-api-authorization.md b/docs/docs/graphql-api-authorization.md index 3bee268047..e61b1c26ef 100644 --- a/docs/docs/graphql-api-authorization.md +++ b/docs/docs/graphql-api-authorization.md @@ -213,7 +213,7 @@ docker-compose -f docker-compose.yaml up Every time the demo GraphQL server receives an HTTP request, it asks OPA to decide whether an GraphQL query is authorized or not using a single RESTful API call. An example codebase is [here][graphql-example-repo], but the crux of the (JavaScript, Apollo framework) code is shown below. -[graphql-example-repo]: https://github.com/StyraInc/graphql-apollo-example +[graphql-example-repo]: https://github.com/StyraOSS/graphql-apollo-example ```javascript // we assume user is passed in as part of the request context. diff --git a/docs/docs/kafka-authorization.md b/docs/docs/kafka-authorization.md index 627bf6afec..5e80b691ba 100644 --- a/docs/docs/kafka-authorization.md +++ b/docs/docs/kafka-authorization.md @@ -57,8 +57,8 @@ opa build --bundle policies/ --output bundles/bundle.tar.gz #### Kafka Authorizer JAR File -Next, download the latest version of the [Open Policy Agent plugin for Kafka authorization](https://github.com/StyraInc/opa-kafka-plugin) -plugin from the projects [release pages](https://github.com/StyraInc/opa-kafka-plugin/releases). +Next, download the latest version of the [Open Policy Agent plugin for Kafka authorization](https://github.com/StyraOSS/opa-kafka-plugin) +plugin from the projects [release pages](https://github.com/StyraOSS/opa-kafka-plugin/releases). Store the plugin in the `plugin` directory (replace `${version}` with the version number of the plugin just downloaded): @@ -66,7 +66,7 @@ Store the plugin in the `plugin` directory (replace `${version}` with the versio mv opa-authorizer-${version}-all.jar plugin/ ``` -For more information on how to configure the OPA plugin for Kafka, see the plugin [repository](https://github.com/StyraInc/opa-kafka-plugin). +For more information on how to configure the OPA plugin for Kafka, see the plugin [repository](https://github.com/StyraOSS/opa-kafka-plugin). Next, create a `docker-compose.yaml` file that runs OPA, Nginx, ZooKeeper, and Kafka. @@ -189,7 +189,7 @@ This field can be used inside the policy. A detailed rundown of generating SSL certificates and JKS files required for SSL client authentication is outside the scope of this tutorial, but the plugin -repository provides an [example script](https://github.com/StyraInc/opa-kafka-plugin/tree/main/example/opa_tutorial/create_cert.sh) +repository provides an [example script](https://github.com/StyraOSS/opa-kafka-plugin/tree/main/example/opa_tutorial/create_cert.sh) that demonstrates the creation of client certificates for the four different users used in this tutorial: @@ -522,5 +522,5 @@ policy. If you want to use the Kafka Authorizer plugin that integrates Kafka with OPA, see the build and install instructions in the -[opa-kafka-plugin](https://github.com/StyraInc/opa-kafka-plugin) +[opa-kafka-plugin](https://github.com/StyraOSS/opa-kafka-plugin) repository. diff --git a/docs/docs/kubernetes/index.md b/docs/docs/kubernetes/index.md index 5f8cf8451b..f00451be95 100644 --- a/docs/docs/kubernetes/index.md +++ b/docs/docs/kubernetes/index.md @@ -31,7 +31,7 @@ Kubernetes clusters for security, cost, and availability reasons. [OPA Gatekeeper](https://open-policy-agent.github.io/gatekeeper) is a specialized project providing first-class integration between OPA and Kubernetes. For -background information see this [blog post](https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-policy-and-governance-for-kubernetes) +background information see this [blog post](https://kubernetes.io/blog/2019/08/06/opa-gatekeeper-policy-and-governance-for-kubernetes/) on kubernetes.io. OPA Gatekeeper adds the following on top of plain OPA: diff --git a/docs/docs/kubernetes/primer.md b/docs/docs/kubernetes/primer.md index fcb6afb5c3..728075d855 100644 --- a/docs/docs/kubernetes/primer.md +++ b/docs/docs/kubernetes/primer.md @@ -4,7 +4,7 @@ title: Policy Primer via Examples Read this page if you are new to Kubernetes admission control with OPA and want to learn how to write policies for Kubernetes. It covers the version -that uses kube-mgmt. The [OPA Gatekeeper version](https://open-policy-agent.github.io/gatekeeper) +that uses kube-mgmt. The [OPA Gatekeeper version](https://open-policy-agent.github.io/gatekeeper/) has its own docs. ## Writing Policies diff --git a/docs/docs/management-bundles/index.md b/docs/docs/management-bundles/index.md index 96c52a0b4a..db37c9f651 100644 --- a/docs/docs/management-bundles/index.md +++ b/docs/docs/management-bundles/index.md @@ -645,7 +645,7 @@ An empty list of operations in a _delta_ bundle `patch.json` will remove all the } ``` -If there are no operations to apply to the data, the bundle server should return the same [`Etag`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag) value as the last update. OPA will send the last `Etag` value in the [`If-None-Match`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/If-None-Match) Header. +If there are no operations to apply to the data, the bundle server should return the same [`Etag`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/ETag) value as the last update. OPA will send the last `Etag` value in the [`If-None-Match`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/If-None-Match) Header. ::: #### Delta Bundle Patch Operations @@ -705,7 +705,7 @@ bundle would erase and overwrite policy and data under the manifest `roots`. The Bundle API is simple. Most HTTP servers capable of serving static files will do. While not strictly required in all deployments, it is also good if the implementation supports: -- HTTP caching using the [ETag header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag). This keeps OPA from having to download a bundle unless the bundle's content have changes. +- HTTP caching using the [ETag header](https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/ETag). This keeps OPA from having to download a bundle unless the bundle's content have changes. - Authentication. When exposing a bundle at a remote endpoint, it is often desirable to protect the data by requiring all requests to the endpoint to be authenticated. This document lists some of the more common HTTP servers suitable as bundle servers, along with instructions for how to set them up as such. @@ -1022,7 +1022,7 @@ The easiest way of testing GCP metadata token or JWT bearer grant type authentic #### Upload Bundle -Uploading a bundle is trivial with the `gsutil` command included with the [Google Cloud SDK](https://cloud.google.com/sdk/docs/quickstart). +Uploading a bundle is trivial with the `gsutil` command included with the [Google Cloud SDK](https://docs.cloud.google.com/sdk/docs/install-sdk). ```shell gsutil cp bundle.tar.gz gs:/// @@ -1089,7 +1089,7 @@ keys: | Caching headers | Yes | | Authentication methods | [OAuth2 Client Credentials](https://www.openpolicyagent.org/docs/latest/configuration/#oauth2-client-credentials),
[OAuth2 Client Credentials JWT authentication](https://www.openpolicyagent.org/docs/latest/configuration/#oauth2-client-credentials-jwt-authentication) | -Note that for the time being, the [Shared Key or Shared Access Signature (SAS)](https://docs.microsoft.com/en-us/rest/api/storageservices/authorize-requests-to-azure-storage) options are [not supported](https://github.com/open-policy-agent/opa/issues/2964). +Note that for the time being, the [Shared Key or Shared Access Signature (SAS)](https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-requests-to-azure-storage) options are [not supported](https://github.com/open-policy-agent/opa/issues/2964). #### Setup Instructions @@ -1124,9 +1124,9 @@ curl --silent \ #### Upload Bundle -Uploading bundles to Azure Blob storage is easily done using the [azcopy](https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10) tool. Make sure to first properly [authorize](https://docs.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-azure-active-directory) the user to be able to upload to Blob storage. +Uploading bundles to Azure Blob storage is easily done using the [azcopy](https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-v10) tool. Make sure to first properly [authorize](https://learn.microsoft.com/en-us/azure/storage/common/storage-use-azcopy-authorize-user-identity) the user to be able to upload to Blob storage. -By now you should be able to login interactively using `azcopy login --tenant-id `. Since you'll most likely will want to log in from scripts (to upload bundles programmatically), you should however create an Azure AD application, and a [service principal](https://docs.microsoft.com/en-us/azure/active-directory/develop/howto-create-service-principal-portal) to do so. Good news! If you've followed the Authentication steps above, you already have one. +By now you should be able to login interactively using `azcopy login --tenant-id `. Since you'll most likely will want to log in from scripts (to upload bundles programmatically), you should however create an Azure AD application, and a [service principal](https://learn.microsoft.com/en-us/entra/identity-platform/howto-create-service-principal-portal) to do so. Good news! If you've followed the Authentication steps above, you already have one. **Uploading bundle using client secret authentication** @@ -1242,7 +1242,7 @@ Nginx offers a simple but competent bundle server for those who prefer to host t #### Upload Bundle -Either use the [nginx-upload-module](https://www.nginx.com/resources/wiki/modules/upload/) or upload bundles out-of-band with SSH or similar. +Either use the [nginx-upload-module](https://docs.nginx.com/) or upload bundles out-of-band with SSH or similar. #### Example OPA Configuration diff --git a/docs/docs/ocp/concepts.md b/docs/docs/ocp/concepts.md index 0ade07f4ef..5952771fba 100644 --- a/docs/docs/ocp/concepts.md +++ b/docs/docs/ocp/concepts.md @@ -7,7 +7,7 @@ title: Concepts Bundles are the primary packaging and distribution unit in OCP. Each bundle contains Rego policies, data files, and is intended to be consumed by any number of OPA instances. The OCP configuration for the bundle specifies a set of **requirements** that list the sources (Rego, data, etc.) to include in the bundle. -OCP builds [OPA Bundles](https://openpolicyagent.org/docs/management-bundles) and pushes them to external object storage systems (e.g., S3, GCS, Azure Cloud Storage, File System). OPA instances are configured to download bundles directly from these storage systems. See the [OPA Configuration](https://www.openpolicyagent.org/docs/latest/configuration/) documentation for more information how to configure authentication and bundle downloads for different cloud providers +OCP builds [OPA Bundles](https://www.openpolicyagent.org/docs/management-bundles) and pushes them to external object storage systems (e.g., S3, GCS, Azure Cloud Storage, File System). OPA instances are configured to download bundles directly from these storage systems. See the [OPA Configuration](https://www.openpolicyagent.org/docs/configuration) documentation for more information how to configure authentication and bundle downloads for different cloud providers ### Namespacing diff --git a/docs/docs/ocp/index.md b/docs/docs/ocp/index.md index b7b8143317..f001210fa5 100644 --- a/docs/docs/ocp/index.md +++ b/docs/docs/ocp/index.md @@ -28,7 +28,7 @@ receive the policies and data they need to make decisions. OCP provides: - [Configuration](./configuration.md) - Learn how to configure the server - [API Reference](./api-reference.md) - Learn about the OCP REST API - [Authentication](./authentication.md) - Learn how to secure the server API -- [OCP on GitHub](http://github.com/open-policy-agent/opa-control-plane) - +- [OCP on GitHub](https://github.com/open-policy-agent/opa-control-plane) - explore OCP the code, contribute and file issues. ## Kick the tires diff --git a/docs/docs/operations.md b/docs/docs/operations.md index 0eb8e52ee0..f35fcf807a 100644 --- a/docs/docs/operations.md +++ b/docs/docs/operations.md @@ -9,7 +9,7 @@ general notes about operating OPA in such cases. ## HTTP Proxies -OPA uses the standard Go [net/http](https://golang.org/pkg/net/http/) package +OPA uses the standard Go [net/http](https://pkg.go.dev/net/http) package for outbound HTTP requests that download bundles, upload decision logs, etc. In environments where an HTTP proxy is required, you can configure OPA using the pseudo-standard `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment @@ -146,7 +146,7 @@ When passing a capabilities definition file via `--capabilities`, one can restri Not providing a capabilities file, or providing a file without an `allow_net` key, will permit fetching remote schemas from any host. -Note that the metaschemas [http://json-schema.org/draft-04/schema](http://json-schema.org/draft-04/schema), [http://json-schema.org/draft-06/schema](http://json-schema.org/draft-06/schema), and [http://json-schema.org/draft-07/schema](http://json-schema.org/draft-07/schema), are always available, even without network access. +Note that the metaschemas [https://json-schema.org/draft-04/schema](https://json-schema.org/draft-04/schema), [https://json-schema.org/draft-06/schema](https://json-schema.org/draft-06/schema), and [https://json-schema.org/draft-07/schema](https://json-schema.org/draft-07/schema), are always available, even without network access. Similarly, the `allow_net` capability restricts what hosts the `http.send` built-in function may send requests to, and what hosts the `net.lookup_ip_addr` built-in function may resolve IP addresses for. diff --git a/docs/docs/policy-performance.md b/docs/docs/policy-performance.md index 5875dd0c77..c13d33ec39 100644 --- a/docs/docs/policy-performance.md +++ b/docs/docs/policy-performance.md @@ -806,7 +806,7 @@ PASS: 2/2 The benchmark output formats default to `pretty`, but support a `gobench` format which complies with the [Golang Benchmark Data Format](https://go.googlesource.com/proposal/+/master/design/14313-benchmark-format.md). -This allows for usage of tools like [benchstat](https://godoc.org/golang.org/x/perf/cmd/benchstat) to gain additional +This allows for usage of tools like [benchstat](https://pkg.go.dev/golang.org/x/perf/cmd/benchstat?utm_source=godoc) to gain additional insight into the benchmark results and to diff between benchmark results. Example: @@ -893,7 +893,7 @@ DataRbacTestUserHasRoleNegative 235 ± 0% This gives clear feedback that the evaluations have slowed down considerably by looking at the `delta` -> Note that for [benchstat](https://godoc.org/golang.org/x/perf/cmd/benchstat) you will want to run with `--count` to +> Note that for [benchstat](https://pkg.go.dev/golang.org/x/perf/cmd/benchstat) you will want to run with `--count` to > repeat the benchmarks a number of times (5-10 is usually enough). The tool requires several data points else the `p` > value will not show meaningful changes and the `delta` will be `~`. diff --git a/docs/docs/policy-reference/builtins/tokensign.mdx b/docs/docs/policy-reference/builtins/tokensign.mdx index 142c1a35b7..a9be0edb73 100644 --- a/docs/docs/policy-reference/builtins/tokensign.mdx +++ b/docs/docs/policy-reference/builtins/tokensign.mdx @@ -2,7 +2,7 @@ title: Token Signing --- -OPA provides two builtins that implement JSON Web Signature [RFC7515](https://tools.ietf.org/html/rfc7515) functionality. +OPA provides two builtins that implement JSON Web Signature [RFC7515](https://datatracker.ietf.org/doc/html/rfc7515) functionality. `io.jwt.encode_sign_raw()` takes three JSON Objects (strings) as parameters and returns their JWS Compact Serialization. This builtin should be used by those that want maximum control over the signing and serialization procedure. It is @@ -35,7 +35,7 @@ The following algorithms are supported: - `RS512`: RSASSA-PKCS-v1.5 using SHA-512 :::info -Note that the key's provided should be base64 URL encoded (without padding) as per the specification ([RFC7517](https://tools.ietf.org/html/rfc7517)). +Note that the key's provided should be base64 URL encoded (without padding) as per the specification ([RFC7517](https://datatracker.ietf.org/doc/html/rfc7517)). This differs from the plain text secrets provided with the algorithm specific verify built-ins described below. ::: diff --git a/docs/docs/rest-api.md b/docs/docs/rest-api.md index d9eace22d1..8971899d46 100644 --- a/docs/docs/rest-api.md +++ b/docs/docs/rest-api.md @@ -1115,7 +1115,7 @@ Content-Type: application/json-patch+json Update a document. -The server accepts updates encoded as JSON Patch operations. The message body of the request should contain a JSON encoded array containing one or more JSON Patch operations. Each operation specifies the operation type, path, and an optional value. For more information on JSON Patch, see [RFC 6902](https://tools.ietf.org/html/rfc6902). +The server accepts updates encoded as JSON Patch operations. The message body of the request should contain a JSON encoded array containing one or more JSON Patch operations. Each operation specifies the operation type, path, and an optional value. For more information on JSON Patch, see [RFC 6902](https://datatracker.ietf.org/doc/html/rfc6902). The effective path of the JSON Patch operation is obtained by joining the path portion of the URL with the path value from the operation(s) contained in the message body. In all cases, the parent of the effective path MUST refer to an existing document, otherwise the server returns 404. In the case of **remove** and **replace** operations, the effective path MUST refer to an existing document, otherwise the server returns 404. diff --git a/docs/docs/ssh-and-sudo-authorization.md b/docs/docs/ssh-and-sudo-authorization.md index 19d7287e43..815ad5d578 100644 --- a/docs/docs/ssh-and-sudo-authorization.md +++ b/docs/docs/ssh-and-sudo-authorization.md @@ -3,7 +3,7 @@ title: SSH and sudo --- Host-level access controls are an important part of every organization's -security strategy. Using [Linux-PAM](http://tldp.org/HOWTO/User-Authentication-HOWTO/x115.html) and OPA +security strategy. Using [Linux-PAM](https://tldp.org/HOWTO/User-Authentication-HOWTO/x115.html) and OPA we can extend policy-based access control to SSH and sudo. ## Goals diff --git a/docs/docs/terraform.md b/docs/docs/terraform.md index fe42e30418..94323a7d36 100644 --- a/docs/docs/terraform.md +++ b/docs/docs/terraform.md @@ -42,7 +42,7 @@ This tutorial requires - [OPA](https://github.com/open-policy-agent/opa/releases) (This tutorial _should_ also work with the -[latest version of Terraform](https://www.terraform.io/downloads.html), but +[latest version of Terraform](https://developer.hashicorp.com/terraform), but it is untested. Contributions welcome!) # Getting Started @@ -51,7 +51,7 @@ it is untested. Contributions welcome!) ### 1. Create and save a Terraform plan -Create a [Terraform](https://www.terraform.io/docs/index.html) file that includes an +Create a [Terraform](https://developer.hashicorp.com/terraform/docs) file that includes an auto-scaling group and a server on AWS. (You will need to modify the `shared_credentials_file` to point to your AWS credentials.) @@ -92,7 +92,7 @@ terraform plan --out tfplan.binary ### 2. Convert the Terraform plan into JSON -Use the command [terraform show](https://www.terraform.io/docs/commands/show.html) to convert the Terraform plan into +Use the command [terraform show](https://developer.hashicorp.com/terraform/cli/commands/show) to convert the Terraform plan into JSON so that OPA can read the plan. ```shell diff --git a/docs/docs/wasm.md b/docs/docs/wasm.md index daba23d775..dd1d6ad8db 100644 --- a/docs/docs/wasm.md +++ b/docs/docs/wasm.md @@ -82,7 +82,7 @@ evaluating compiled policies. If you want to evaluate Rego policies inside JavaScript we recommend you use the [Javascript SDK](https://github.com/open-policy-agent/npm-opa-wasm). There is also an -[example NodeJS application](https://github.com/open-policy-agent/npm-opa-wasm/tree/master/examples/nodejs-app) +[example NodeJS application](https://github.com/open-policy-agent/npm-opa-wasm/tree/main/examples/nodejs-app) provided for reference. ### Other Languages diff --git a/docs/projects/regal/adopters.md b/docs/projects/regal/adopters.md index 42167bbfed..bf18b96cac 100644 --- a/docs/projects/regal/adopters.md +++ b/docs/projects/regal/adopters.md @@ -21,13 +21,13 @@ Public open source projects integrating Regal for linting in their CI/CD pipelin - [Brainiac](https://github.com/carbonetes/brainiac) - [Cloudbeat](https://github.com/elastic/cloudbeat) - [Conftest](https://github.com/open-policy-agent/conftest) -- [CVAT](https://github.com/opencv/cvat) +- [CVAT](https://github.com/cvat-ai/cvat) - [GKE Policy Automation](https://github.com/google/gke-policy-automation) - [Konstraint](https://github.com/plexsystems/konstraint) - [Kubescape](https://github.com/kubescape/regolibrary) - [Legitify](https://github.com/Legit-Labs/legitify) - [Matrix Authentication Service](https://github.com/element-hq/matrix-authentication-service/) -- [Minder](https://github.com/stacklok/minder) +- [Minder](https://github.com/mindersec/minder) - [Modernisation Platform](https://github.com/ministryofjustice/modernisation-platform) - [OPA Library](https://github.com/open-policy-agent/library) - [Red Hat COP](https://github.com/redhat-cop/rego-policies) @@ -47,7 +47,7 @@ Projects and products that integrate Regal into their offerings. - [Dependency Management Data](https://gitlab.com/tanna.dev/dependency-management-data) - [Enterprise OPA](https://github.com/styrainc/enterprise-opa) - [The Rego Playground](https://play.openpolicyagent.org) -- [Trunk Check](https://trunk.io/check) +- [Trunk Check](https://trunk.io/) - [reviewdog/action-regal](https://github.com/reviewdog/action-regal) diff --git a/docs/projects/regal/cli.md b/docs/projects/regal/cli.md index ff84920fc5..c24afc7a0f 100644 --- a/docs/projects/regal/cli.md +++ b/docs/projects/regal/cli.md @@ -21,9 +21,9 @@ are: - `pretty` (default) - Human-readable table-like output where each violation is printed with a detailed explanation - `compact` - Human-readable output where each violation is printed on a single line - `json` - JSON output, suitable for programmatic consumption -- `github` - GitHub [workflow command](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions) +- `github` - GitHub [workflow command](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands) output, ideal for use in GitHub Actions. Annotates PRs and creates a - [job summary](https://docs.github.com/en/actions/using-workflows/workflow-commands-for-github-actions#adding-a-job-summary) + [job summary](https://docs.github.com/en/actions/reference/workflows-and-actions/workflow-commands#adding-a-job-summary) from the linter report - `sarif` - [SARIF](https://sarifweb.azurewebsites.net/) JSON output, for consumption by tools processing code analysis reports diff --git a/docs/projects/regal/configuration/project-roots.md b/docs/projects/regal/configuration/project-roots.md index 1388bf80fa..f47fc515a0 100644 --- a/docs/projects/regal/configuration/project-roots.md +++ b/docs/projects/regal/configuration/project-roots.md @@ -11,7 +11,7 @@ sidebar_label: Project Roots While many projects consider the project's root directory (in editors often referred to as **workspace**) their "main" directory for policies, some projects may contain code from other languages, policy "subprojects", or multiple -[bundles](https://www.openpolicyagent.org/docs/management-bundles/). While most of Regal's features work +[bundles](https://www.openpolicyagent.org/docs/management-bundles). While most of Regal's features work independently of this — linting, for example, doesn't consider where in a workspace policies are located as long as those locations aren't [ignored](./ignore-rules) — some features, like automatically [fixing](https://www.openpolicyagent.org/projects/regal/fixing) violations, benefit from knowing when a project contains multiple roots. diff --git a/docs/projects/regal/custom-rules/roast.md b/docs/projects/regal/custom-rules/roast.md index c40338739b..0fbd14dbbf 100644 --- a/docs/projects/regal/custom-rules/roast.md +++ b/docs/projects/regal/custom-rules/roast.md @@ -9,7 +9,7 @@ sidebar_label: Roast # Roast (Regal's Optimized AST) -Roast is an optimized JSON format for [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/) ASTs, as well +Roast is an optimized JSON format for [Rego](https://www.openpolicyagent.org/docs/policy-language) ASTs, as well as common utilities for working with both the Roast format and OPA's AST APIs. Roast is used by [Regal](https://www.openpolicyagent.org/projects/regal), where the JSON representation of Rego's AST is used input for diff --git a/docs/projects/regal/editor-support.md b/docs/projects/regal/editor-support.md index acaf9009e4..ea8a8742df 100644 --- a/docs/projects/regal/editor-support.md +++ b/docs/projects/regal/editor-support.md @@ -49,7 +49,7 @@ by Regal. [Neovim](https://neovim.io/) supports both the Language Server Protocol and the Debug Adapter Protocol. Generally, the Regal binary should be [installed](https://www.openpolicyagent.org/projects/regal#getting-started) -first. [`mason.vim`](https://github.com/williamboman/mason.nvim) users can install the +first. [`mason.vim`](https://github.com/mason-org/mason.nvim) users can install the Regal binary with `:MasonInstall regal` ([package definition](https://github.com/mason-org/mason-registry/blob/2024-07-23-asian-hate/packages/regal/package.yaml)). diff --git a/docs/projects/regal/index.md b/docs/projects/regal/index.md index 448b155674..ab41515774 100644 --- a/docs/projects/regal/index.md +++ b/docs/projects/regal/index.md @@ -19,7 +19,7 @@ import Intro from '@site/src/components/projects/regal/Intro'; # Regal Regal is a linter and language server for -[Rego](https://www.openpolicyagent.org/docs/policy-language/), making +[Rego](https://www.openpolicyagent.org/docs/policy-language), making your Rego magnificent, and you the ruler of rules! With its extensive set of linter rules, documentation and editor integrations, diff --git a/docs/projects/regal/opa-one-dot-zero.md b/docs/projects/regal/opa-one-dot-zero.md index 601330434a..71f1537900 100644 --- a/docs/projects/regal/opa-one-dot-zero.md +++ b/docs/projects/regal/opa-one-dot-zero.md @@ -73,8 +73,8 @@ effort. ## Related Resources -- OPA Docs: [Upgrading to v1.0](https://www.openpolicyagent.org/docs/v0-upgrade/) -- OPA Docs: [v0 Backwards Compatibility](https://www.openpolicyagent.org/docs/v0-compatibility/) +- OPA Docs: [Upgrading to v1.0](https://www.openpolicyagent.org/docs/v0-upgrade) +- OPA Docs: [v0 Backwards Compatibility](https://www.openpolicyagent.org/docs/v0-compatibility) - Styra Blog: [Renovating Rego](https://www.styra.com/blog/renovating-rego/) - OPA Blog: [OPA 1.0 Is Coming, Here's What You Need to Know](https://blog.openpolicyagent.org/opa-1-0-is-coming-heres-what-you-need-to-know-c8fb0d258368) - OPA Blog: [Announcing OPA 1.0: A New Standard for Policy as Code](https://blog.openpolicyagent.org/announcing-opa-1-0-a-new-standard-for-policy-as-code-a6d8427ee828) diff --git a/docs/projects/regal/rules/bugs/time-now-ns-twice.md b/docs/projects/regal/rules/bugs/time-now-ns-twice.md index 128e528aa9..ab4c553826 100644 --- a/docs/projects/regal/rules/bugs/time-now-ns-twice.md +++ b/docs/projects/regal/rules/bugs/time-now-ns-twice.md @@ -43,7 +43,7 @@ same way they'd normally do it using a traditional programming language (that is work, OPA provides several tools to help measure performance, and learning how to use them well is the best way to understand the performance characteristics of policy evaluation. -See the [performance](https://www.openpolicyagent.org/docs/policy-performance/) section of the OPA docs for an +See the [performance](https://www.openpolicyagent.org/docs/policy-performance) section of the OPA docs for an introduction to these tools, as well as advice on how to write performant policies. ## Configuration Options @@ -61,4 +61,4 @@ rules: ## Related Resources - OPA Docs: [time.now_ns](https://www.openpolicyagent.org/docs/policy-reference/#builtin-time-timenow_ns) -- OPA Docs: [Policy Performance](https://www.openpolicyagent.org/docs/policy-performance/) +- OPA Docs: [Policy Performance](https://www.openpolicyagent.org/docs/policy-performance) diff --git a/docs/projects/regal/rules/testing/dubious-print-sprintf.md b/docs/projects/regal/rules/testing/dubious-print-sprintf.md index 41727259e4..682e608982 100644 --- a/docs/projects/regal/rules/testing/dubious-print-sprintf.md +++ b/docs/projects/regal/rules/testing/dubious-print-sprintf.md @@ -56,5 +56,5 @@ rules: ## Related Resources - Regal Docs: [Call to `print` or `trace` function](https://www.openpolicyagent.org/projects/regal/rules/testing/print-or-trace-call) -- OPA Docs: [Policy Testing](https://www.openpolicyagent.org/docs/policy-testing/) +- OPA Docs: [Policy Testing](https://www.openpolicyagent.org/docs/policy-testing) - GitHub: [Source Code](https://github.com/open-policy-agent/regal/blob/main/bundle/regal/rules/testing/dubious-print-sprintf/dubious_print_sprintf.rego) diff --git a/docs/projects/regal/rules/testing/print-or-trace-call.md b/docs/projects/regal/rules/testing/print-or-trace-call.md index 1f7bfcd083..78fc09a7b5 100644 --- a/docs/projects/regal/rules/testing/print-or-trace-call.md +++ b/docs/projects/regal/rules/testing/print-or-trace-call.md @@ -41,5 +41,5 @@ rules: - OPA Blog: [Introducing the OPA print function](https://blog.openpolicyagent.org/introducing-the-opa-print-function-809da6a13aee) - OPA Docs: [Policy Reference: Debugging](https://www.openpolicyagent.org/docs/policy-reference/#debugging) -- OPA Docs: [Decision Logs](https://www.openpolicyagent.org/docs/management-decision-logs/) +- OPA Docs: [Decision Logs](https://www.openpolicyagent.org/docs/management-decision-logs) - GitHub: [Source Code](https://github.com/open-policy-agent/regal/blob/main/bundle/regal/rules/testing/print-or-trace-call/print_or_trace_call.rego) diff --git a/docs/src/data/ecosystem/entries/apache-apisix.md b/docs/src/data/ecosystem/entries/apache-apisix.md index 54328872ef..78e7283d4d 100644 --- a/docs/src/data/ecosystem/entries/apache-apisix.md +++ b/docs/src/data/ecosystem/entries/apache-apisix.md @@ -8,14 +8,14 @@ labels: code: - https://github.com/apache/apisix blogs: -- https://apisix.apache.org/blog/2021/12/24/open-policy-agent +- https://apisix.apache.org/blog/2021/12/24/open-policy-agent/ - https://medium.com/@ApacheAPISIX/apache-apisix-integrates-with-open-policy-agent-to-enrich-its-ecosystem-15569fe3ab9c docs_features: rest-api-integration: note: | Apache APISIX routes can be configured to call an OPA instance over the REST API. - [This blog post](https://apisix.apache.org/blog/2021/12/24/open-policy-agent/) + [This blog post](https://apisix.apache.org/blog/2021/12/24/open-policy-agent//) explains how such a configuration can be achieved. --- Apache APISIX provides a plugin for delegating fine-grained authorization decisions to OPA. diff --git a/docs/src/data/ecosystem/entries/atmos.md b/docs/src/data/ecosystem/entries/atmos.md index e9235ffd6f..9706af2c1b 100644 --- a/docs/src/data/ecosystem/entries/atmos.md +++ b/docs/src/data/ecosystem/entries/atmos.md @@ -19,7 +19,7 @@ docs_features: note: | Atmos can validate Terraform stack before applying them. This is done using the `validate component` command - [documented here](https://atmos.tools/cli/commands/validate/component). + [documented here](https://atmos.tools/cli/commands/validate/component/). --- Workflow automation tool for DevOps. Keep configuration DRY with hierarchical imports of configurations, inheritance, and WAY more. diff --git a/docs/src/data/ecosystem/entries/aws-cloudformation-hook.md b/docs/src/data/ecosystem/entries/aws-cloudformation-hook.md index 4d58db9215..2aadc74934 100644 --- a/docs/src/data/ecosystem/entries/aws-cloudformation-hook.md +++ b/docs/src/data/ecosystem/entries/aws-cloudformation-hook.md @@ -10,7 +10,7 @@ tutorials: code: - https://github.com/StyraInc/opa-aws-cloudformation-hook blogs: -- https://www.styra.com/blog/the-opa-aws-cloudformation-hook +- https://www.styra.com/blog/the-opa-aws-cloudformation-hook/ inventors: - styra docs_features: diff --git a/docs/src/data/ecosystem/entries/ceph.md b/docs/src/data/ecosystem/entries/ceph.md index 0588e67aaf..49a8b83b42 100644 --- a/docs/src/data/ecosystem/entries/ceph.md +++ b/docs/src/data/ecosystem/entries/ceph.md @@ -6,7 +6,7 @@ labels: category: object layer: data tutorials: -- https://docs.ceph.com/docs/master/radosgw/opa/ +- https://docs.ceph.com/en/latest/radosgw/opa/ inventors: - styra - redhat diff --git a/docs/src/data/ecosystem/entries/circleci.md b/docs/src/data/ecosystem/entries/circleci.md index e1c6d9285b..711bab16a2 100644 --- a/docs/src/data/ecosystem/entries/circleci.md +++ b/docs/src/data/ecosystem/entries/circleci.md @@ -5,7 +5,7 @@ labels: layer: cicd type: poweredbyopa tutorials: -- https://circleci.com/docs/config-policy-management-overview/ +- https://circleci.com/docs/guides/config-policies/config-policy-management-overview/ inventors: - circleci --- diff --git a/docs/src/data/ecosystem/entries/clair-datasource.md b/docs/src/data/ecosystem/entries/clair-datasource.md index 2510512299..9b5311acf3 100644 --- a/docs/src/data/ecosystem/entries/clair-datasource.md +++ b/docs/src/data/ecosystem/entries/clair-datasource.md @@ -8,9 +8,9 @@ labels: category: containers datasource: clair code: -- https://github.com/open-policy-agent/contrib/tree/master/image_enforcer +- https://github.com/open-policy-agent/contrib/tree/main/image_enforcer tutorials: -- https://github.com/open-policy-agent/contrib/blob/master/image_enforcer/README.md +- https://github.com/open-policy-agent/contrib/blob/main/image_enforcer/README.md docs_features: rest-api-integration: note: | diff --git a/docs/src/data/ecosystem/entries/cloudflare-worker.md b/docs/src/data/ecosystem/entries/cloudflare-worker.md index 40deb933e6..de8f89468a 100644 --- a/docs/src/data/ecosystem/entries/cloudflare-worker.md +++ b/docs/src/data/ecosystem/entries/cloudflare-worker.md @@ -6,9 +6,9 @@ labels: layer: application category: serverless code: -- https://github.com/open-policy-agent/contrib/tree/master/wasm/cloudflare-worker +- https://github.com/open-policy-agent/contrib/tree/main/wasm/cloudflare-worker tutorials: -- https://github.com/open-policy-agent/contrib/blob/master/wasm/cloudflare-worker/README.md +- https://github.com/open-policy-agent/contrib/blob/main/wasm/cloudflare-worker/README.md docs_features: wasm-integration: note: | diff --git a/docs/src/data/ecosystem/entries/enterprise-contract.md b/docs/src/data/ecosystem/entries/conforma.md similarity index 64% rename from docs/src/data/ecosystem/entries/enterprise-contract.md rename to docs/src/data/ecosystem/entries/conforma.md index 804d1deb59..22b9eed139 100644 --- a/docs/src/data/ecosystem/entries/enterprise-contract.md +++ b/docs/src/data/ecosystem/entries/conforma.md @@ -1,20 +1,20 @@ --- -title: Enterprise Contract +title: Conforma software: -- enterprise-contract +- conforma inventors: -- enterprise-contract +- conforma labels: category: security layer: application code: -- https://github.com/enterprise-contract/ec-cli +- https://github.com/conforma/cli blogs: -- https://enterprisecontract.dev/posts/ +- https://conforma.dev/posts/ docs_features: go-integration: note: | - The [Enterprise Contract](https://enterprisecontract.dev/) uses the OPA go + [Conforma](https://conforma.dev/) uses the OPA go library to process rego policies when validating the signatures and attestations of container images and other software artifacts. --- diff --git a/docs/src/data/ecosystem/entries/dapr.md b/docs/src/data/ecosystem/entries/dapr.md index cceefe0f8c..8100cf505e 100644 --- a/docs/src/data/ecosystem/entries/dapr.md +++ b/docs/src/data/ecosystem/entries/dapr.md @@ -9,7 +9,7 @@ tutorials: - https://docs.dapr.io/reference/components-reference/supported-middleware/middleware-opa/ code: - https://github.com/dapr/dapr -- https://github.com/dapr/components-contrib/blob/master/middleware/http/opa/middleware.go +- https://github.com/dapr/components-contrib/blob/main/middleware/http/opa/middleware.go docs_features: go-integration: note: | diff --git a/docs/src/data/ecosystem/entries/easegress.md b/docs/src/data/ecosystem/entries/easegress.md index ccf226226c..89d56a36cc 100644 --- a/docs/src/data/ecosystem/entries/easegress.md +++ b/docs/src/data/ecosystem/entries/easegress.md @@ -4,7 +4,7 @@ labels: category: gateway layer: network code: -- https://github.com/megaease/easegress +- https://github.com/easegress-io/easegress inventors: - megaease --- diff --git a/docs/src/data/ecosystem/entries/elasticsearch-datafiltering.md b/docs/src/data/ecosystem/entries/elasticsearch-datafiltering.md index 4c32eb10be..3b7cecfeab 100644 --- a/docs/src/data/ecosystem/entries/elasticsearch-datafiltering.md +++ b/docs/src/data/ecosystem/entries/elasticsearch-datafiltering.md @@ -6,9 +6,9 @@ labels: software: - elasticsearch code: -- https://github.com/open-policy-agent/contrib/tree/master/data_filter_elasticsearch +- https://github.com/open-policy-agent/contrib/tree/main/data_filter_elasticsearch tutorials: -- https://github.com/open-policy-agent/contrib/blob/master/data_filter_elasticsearch/README.md +- https://github.com/open-policy-agent/contrib/blob/main/data_filter_elasticsearch/README.md inventors: - styra --- diff --git a/docs/src/data/ecosystem/entries/env0.md b/docs/src/data/ecosystem/entries/env0.md index 2cda430bee..0e17f1acfb 100644 --- a/docs/src/data/ecosystem/entries/env0.md +++ b/docs/src/data/ecosystem/entries/env0.md @@ -15,8 +15,8 @@ software: inventors: - env0 tutorials: -- https://docs.env0.com/docs/opa-plugin -- https://docs.env0.com/docs/policies +- https://docs.envzero.com/guides/integrations/plugins/opa-plugin +- https://docs.envzero.com/guides/policies-governance/policies code: - https://github.com/env0/approval-policies blogs: @@ -34,7 +34,7 @@ docs_features: note: | env0 is a Terraform automation platform that allows you to manage your infrastructure as code (IaC) at scale. It has a built-in integration with - OPA. See docs [here](https://docs.env0.com/docs/opa-plugin). + OPA. See docs [here](https://docs.envzero.com/guides/integrations/plugins/opa-plugin). --- env0 is the best way to deploy and manage IaC - Terraform, OpenTofu, CloudFormation, Pulumi, Kubernetes, and more. Our platform integrates with OPA to allow its users to streamline cloud governance, automate policy enforcement, and maintain control over cloud deployments while enabling managed self-service. diff --git a/docs/src/data/ecosystem/entries/envoy-authorization.md b/docs/src/data/ecosystem/entries/envoy-authorization.md index eef359b723..a3966ef8a8 100644 --- a/docs/src/data/ecosystem/entries/envoy-authorization.md +++ b/docs/src/data/ecosystem/entries/envoy-authorization.md @@ -8,7 +8,7 @@ software: - envoy tutorials: - https://github.com/tsandall/minimal-opa-envoy-example/blob/master/README.md -- https://www.openpolicyagent.org/docs/latest/envoy-introduction/ +- https://www.openpolicyagent.org/docs/envoy code: - https://github.com/open-policy-agent/opa-envoy-plugin - https://github.com/tsandall/minimal-opa-envoy-example @@ -53,6 +53,6 @@ docs_features: project uses the REST API to allow and deny requests routed via an Envoy proxy. Read about this integration in the - [OPA Docs](https://www.openpolicyagent.org/docs/latest/envoy-introduction/). + [OPA Docs](https://www.openpolicyagent.org/docs/envoy). --- Envoy is a networking abstraction for cloud-native applications. OPA hooks into Envoy’s external authorization filter to provide fine-grained, context-aware authorization for network or HTTP requests. diff --git a/docs/src/data/ecosystem/entries/expressing-or.md b/docs/src/data/ecosystem/entries/expressing-or.md index edd8b1b2a3..e09f61f470 100644 --- a/docs/src/data/ecosystem/entries/expressing-or.md +++ b/docs/src/data/ecosystem/entries/expressing-or.md @@ -7,13 +7,13 @@ labels: inventors: - styra blogs: -- http://styra.com/blog/how-to-express-or-in-rego +- https://www.styra.com/blog/how-to-express-or-in-rego/ docs_features: learning-rego: note: | - This [learning material](http://styra.com/blog/how-to-express-or-in-rego) + This [learning material](https://www.styra.com/blog/how-to-express-or-in-rego/) is a great way to learn how to migrate logic from other languages to Rego. --- -This [learning material](http://styra.com/blog/how-to-express-or-in-rego) +This [learning material](https://www.styra.com/blog/how-to-express-or-in-rego/) is a great way to learn how to migrate logic from other languages to Rego. diff --git a/docs/src/data/ecosystem/entries/fairwinds-insights.md b/docs/src/data/ecosystem/entries/fairwinds-insights.md index a4e095f834..0ee10ad70d 100644 --- a/docs/src/data/ecosystem/entries/fairwinds-insights.md +++ b/docs/src/data/ecosystem/entries/fairwinds-insights.md @@ -11,7 +11,7 @@ software: - helm tutorials: - https://insights.docs.fairwinds.com/features/admission-controller/ -- https://insights.docs.fairwinds.com/features/insights-cli +- https://insights.docs.fairwinds.com/features/insights-cli/ blogs: - https://www.fairwinds.com/blog/managing-opa-policies-with-fairwinds-insights - https://www.fairwinds.com/blog/manage-open-policy-agent-opa-consistently diff --git a/docs/src/data/ecosystem/entries/flipt.md b/docs/src/data/ecosystem/entries/flipt.md index 53c028bc5a..26744874f8 100644 --- a/docs/src/data/ecosystem/entries/flipt.md +++ b/docs/src/data/ecosystem/entries/flipt.md @@ -14,14 +14,14 @@ blogs: code: - https://github.com/flipt-io/flipt tutorials: -- https://docs.flipt.io/authorization/overview -- https://docs.flipt.io/guides/operation/authorization/rbac-with-keycloak -- https://docs.flipt.io/configuration/authorization +- https://docs.flipt.io/v1/authorization/overview +- https://docs.flipt.io/v1/guides/operation/authorization/rbac-with-keycloak +- https://docs.flipt.io/v1/configuration/authorization docs_features: go-integration: note: | Flipt's authorization feature uses the Go API to embed Open Policy Agent and evaluate authorization policies. - [These docs](https://docs.flipt.io/authorization/overview) + [These docs](https://docs.flipt.io/v1/authorization/overview) explain how it works. --- Flipt is an open-source, Enterprise-ready, GitOps enabled, CloudNative feature management solution. diff --git a/docs/src/data/ecosystem/entries/gatekeeper.md b/docs/src/data/ecosystem/entries/gatekeeper.md index abbbb78ced..7ce0663b77 100644 --- a/docs/src/data/ecosystem/entries/gatekeeper.md +++ b/docs/src/data/ecosystem/entries/gatekeeper.md @@ -9,7 +9,7 @@ code: software: - kubernetes tutorials: -- https://open-policy-agent.github.io/gatekeeper/website/docs/howto +- https://open-policy-agent.github.io/gatekeeper/website/docs/howto/ videos: - https://youtu.be/RMiovzGGCfI?t=1049 - https://youtu.be/6RNp3m_THw4?t=864 diff --git a/docs/src/data/ecosystem/entries/github-action-opa-rego-test.md b/docs/src/data/ecosystem/entries/github-action-opa-rego-test.md index b320ea21c7..4e880f1eeb 100644 --- a/docs/src/data/ecosystem/entries/github-action-opa-rego-test.md +++ b/docs/src/data/ecosystem/entries/github-action-opa-rego-test.md @@ -18,4 +18,4 @@ docs_features: [GitHub Action for OPA Rego Policy Tests](docs/website/content/integrations/rego-test-assertions.md) by [Masterpoint](https://masterpoint.io/) is used to automate testing for your OPA (Open Policy Agent) Rego policies, generates a report with coverage information, and posts the test results as a comment on your pull requests, making it easy for your team to review and approve policies. -Use this to test your OPA Rego files for [Spacelift policies](https://docs.spacelift.io/concepts/policy), [Kubernetes Admission Controller policies](https://www.openpolicyagent.org/docs/latest/kubernetes-introduction/), [Docker authorization policies](https://www.openpolicyagent.org/docs/latest/docker-authorization/), or any other use case that uses [Open Policy Agent's policy language Rego](https://www.openpolicyagent.org/docs/latest/). This Action also updates PR comments with the test results in place to prevent duplication. +Use this to test your OPA Rego files for [Spacelift policies](https://docs.spacelift.io/concepts/policy), [Kubernetes Admission Controller policies](https://www.openpolicyagent.org/docs/kubernetes), [Docker authorization policies](https://www.openpolicyagent.org/docs/docker-authorization), or any other use case that uses [Open Policy Agent's policy language Rego](https://www.openpolicyagent.org/docs/latest/). This Action also updates PR comments with the test results in place to prevent duplication. diff --git a/docs/src/data/ecosystem/entries/google-calendar.md b/docs/src/data/ecosystem/entries/google-calendar.md index d1de1dcfa5..ec061fc04a 100644 --- a/docs/src/data/ecosystem/entries/google-calendar.md +++ b/docs/src/data/ecosystem/entries/google-calendar.md @@ -10,6 +10,6 @@ inventors: code: - https://github.com/anderseknert/opa-google-calendar blogs: -- https://www.styra.com/blog/the-power-of-data-calendar-based-policy-enforcement +- https://www.styra.com/blog/the-power-of-data-calendar-based-policy-enforcement/ --- Using the Google Calendar API with OPA for calendar powered policy decisions diff --git a/docs/src/data/ecosystem/entries/graphql.md b/docs/src/data/ecosystem/entries/graphql.md index f5c18d2d0f..878a982d9b 100644 --- a/docs/src/data/ecosystem/entries/graphql.md +++ b/docs/src/data/ecosystem/entries/graphql.md @@ -8,7 +8,7 @@ software: code: - https://github.com/StyraInc/graphql-apollo-example tutorials: -- https://www.openpolicyagent.org/docs/graphql-api-authorization/ +- https://www.openpolicyagent.org/docs/graphql-api-authorization --- GraphQL is a query language for APIs and a runtime for fulfilling those queries with your existing data. diff --git a/docs/src/data/ecosystem/entries/iptables.md b/docs/src/data/ecosystem/entries/iptables.md index fea2c7dfb3..f51ae526e3 100644 --- a/docs/src/data/ecosystem/entries/iptables.md +++ b/docs/src/data/ecosystem/entries/iptables.md @@ -6,9 +6,9 @@ labels: software: - linux tutorials: -- https://github.com/open-policy-agent/contrib/blob/master/opa-iptables/docs/tutorial.md +- https://github.com/open-policy-agent/contrib/blob/main/opa-iptables/docs/tutorial.md code: -- https://github.com/open-policy-agent/contrib/tree/master/opa-iptables +- https://github.com/open-policy-agent/contrib/tree/main/opa-iptables inventors: - gsoc - cisco diff --git a/docs/src/data/ecosystem/entries/kafka-authorization.md b/docs/src/data/ecosystem/entries/kafka-authorization.md index 25387625ad..30240311de 100644 --- a/docs/src/data/ecosystem/entries/kafka-authorization.md +++ b/docs/src/data/ecosystem/entries/kafka-authorization.md @@ -7,9 +7,9 @@ labels: category: streaming layer: data blogs: -- https://opencredo.com/blogs/controlling-kafka-data-flows-using-open-policy-agent/ +- https://www.opencredo.com/blogs/controlling-kafka-data-flows-using-open-policy-agent tutorials: -- https://www.openpolicyagent.org/docs/latest/kafka-authorization/ +- https://www.openpolicyagent.org/docs/kafka-authorization code: - https://github.com/StyraInc/opa-kafka-plugin - https://github.com/llofberg/kafka-authorizer-opa diff --git a/docs/src/data/ecosystem/entries/kong-authorization.md b/docs/src/data/ecosystem/entries/kong-authorization.md index 74a9720d25..5d79c0f495 100644 --- a/docs/src/data/ecosystem/entries/kong-authorization.md +++ b/docs/src/data/ecosystem/entries/kong-authorization.md @@ -6,7 +6,7 @@ labels: software: - kong code: -- https://github.com/open-policy-agent/contrib/tree/master/kong_api_authz +- https://github.com/open-policy-agent/contrib/tree/main/kong_api_authz inventors: - wada-ama --- diff --git a/docs/src/data/ecosystem/entries/kubernetes-authorization.md b/docs/src/data/ecosystem/entries/kubernetes-authorization.md index 73edbf1c8f..2fb97d3e60 100644 --- a/docs/src/data/ecosystem/entries/kubernetes-authorization.md +++ b/docs/src/data/ecosystem/entries/kubernetes-authorization.md @@ -3,7 +3,7 @@ title: Kubernetes Authorization code: - https://github.com/open-policy-agent/contrib/tree/main/k8s_authorization blogs: -- https://www.styra.com/blog/kubernetes-authorization-webhook +- https://www.styra.com/blog/kubernetes-authorization-webhook/ - https://itnext.io/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb - https://itnext.io/optimizing-open-policy-agent-based-kubernetes-authorization-via-go-execution-tracer-7b439bb5dc5b inventors: diff --git a/docs/src/data/ecosystem/entries/kubernetes-validating-admission.md b/docs/src/data/ecosystem/entries/kubernetes-validating-admission.md index 91eb78fb7d..bb804cbdca 100644 --- a/docs/src/data/ecosystem/entries/kubernetes-validating-admission.md +++ b/docs/src/data/ecosystem/entries/kubernetes-validating-admission.md @@ -81,7 +81,7 @@ blogs: - https://blog.openpolicyagent.org/securing-the-kubernetes-api-with-open-policy-agent-ce93af0552c3 - https://itnext.io/kubernetes-authorization-via-open-policy-agent-a9455d9d5ceb - https://medium.com/capital-one-tech/policy-enabled-kubernetes-with-open-policy-agent-3b612b3f0203 -- https://blog.openshift.com/fine-grained-policy-enforcement-in-openshift-with-open-policy-agent/ +- https://www.redhat.com/en/blog/fine-grained-policy-enforcement-in-openshift-with-open-policy-agent docs_features: rest-api-integration: note: | diff --git a/docs/src/data/ecosystem/entries/kubescape.md b/docs/src/data/ecosystem/entries/kubescape.md index 8031327533..95551aafd7 100644 --- a/docs/src/data/ecosystem/entries/kubescape.md +++ b/docs/src/data/ecosystem/entries/kubescape.md @@ -12,7 +12,7 @@ code: inventors: - armo tutorials: -- https://hub.armosec.io/docs +- https://hub.armosec.io/docs/armo-platform docs_features: go-integration: note: | diff --git a/docs/src/data/ecosystem/entries/kubeshield.md b/docs/src/data/ecosystem/entries/kubeshield.md index 2a107668be..7dde7c3d72 100644 --- a/docs/src/data/ecosystem/entries/kubeshield.md +++ b/docs/src/data/ecosystem/entries/kubeshield.md @@ -11,7 +11,7 @@ labels: code: - https://github.com/kubeshield/bpf-opa-demo blogs: -- https://blog.byte.builders/post/bpf-opa/ +- https://appscode.com/blog/post/bpf-opa/ docs_features: kubernetes: note: | diff --git a/docs/src/data/ecosystem/entries/linux-pam.md b/docs/src/data/ecosystem/entries/linux-pam.md index a97be8e4c7..e8ac8076a3 100644 --- a/docs/src/data/ecosystem/entries/linux-pam.md +++ b/docs/src/data/ecosystem/entries/linux-pam.md @@ -7,7 +7,7 @@ labels: tutorials: - https://www.openpolicyagent.org/docs/ssh-and-sudo-authorization.html code: -- https://github.com/open-policy-agent/contrib/tree/master/pam_opa +- https://github.com/open-policy-agent/contrib/tree/main/pam_opa inventors: - styra --- diff --git a/docs/src/data/ecosystem/entries/oauth2.md b/docs/src/data/ecosystem/entries/oauth2.md index b8fcf1dcab..27a674a068 100644 --- a/docs/src/data/ecosystem/entries/oauth2.md +++ b/docs/src/data/ecosystem/entries/oauth2.md @@ -5,8 +5,8 @@ software: labels: category: security tutorials: -- https://www.openpolicyagent.org/docs/latest/oauth-oidc/ +- https://www.openpolicyagent.org/docs/oauth-oidc blogs: -- https://www.styra.com/blog/integrating-identity-oauth2-and-openid-connect-in-open-policy-agent +- https://www.styra.com/blog/integrating-identity-oauth2-and-openid-connect-in-open-policy-agent/ --- Integrating OAuth2 with Open Policy Agent diff --git a/docs/src/data/ecosystem/entries/ocpr.md b/docs/src/data/ecosystem/entries/ocpr.md index 7b4e29fee4..befcd7f88e 100644 --- a/docs/src/data/ecosystem/entries/ocpr.md +++ b/docs/src/data/ecosystem/entries/ocpr.md @@ -9,7 +9,7 @@ inventors: code: - https://github.com/opcr-io/policy tutorials: -- https://openpolicycontainers.com/docs/tutorial +- https://openpolicycontainers.com/docs/tutorial/ docs_features: go-integration: note: | @@ -20,18 +20,18 @@ docs_features: note: | OPCR policy images can be loaded in over the Bundle API. The feature it documented in the - [OPCR docs](https://openpolicycontainers.com/docs/opa). + [OPCR docs](https://openpolicycontainers.com/docs/opa/). opa-bundles-discovery: note: | OPCR images can be loaded in over the Bundle API and contain discovery bundles. The feature it documented in the - [OPCR docs](https://openpolicycontainers.com/docs/opa). + [OPCR docs](https://openpolicycontainers.com/docs/opa/). external-data: note: | OPCR policy images can contain data as well as policy. If you need to distribute data to OPA from an OCI registry, OPCR can build and push such images. See the docs for - [building images here](https://openpolicycontainers.com/docs/cli/build). + [building images here](https://openpolicycontainers.com/docs/cli/build/). --- The Open Policy Registry project provides a docker-style workflow for OPA diff --git a/docs/src/data/ecosystem/entries/opa-aspnetcore.md b/docs/src/data/ecosystem/entries/opa-aspnetcore.md index 18e852b699..91b8b0bac5 100644 --- a/docs/src/data/ecosystem/entries/opa-aspnetcore.md +++ b/docs/src/data/ecosystem/entries/opa-aspnetcore.md @@ -5,7 +5,7 @@ labels: category: application layer: network code: -- https://github.com/StyraInc/opa-aspnetcore +- https://github.com/open-policy-agent/opa-aspnetcore - https://www.nuget.org/packages/Styra.Opa.AspNetCore tutorials: - https://open-policy-agent.github.io/opa-aspnetcore/ diff --git a/docs/src/data/ecosystem/entries/opa-csharp.md b/docs/src/data/ecosystem/entries/opa-csharp.md index fce7fb444e..2cc13b7e93 100644 --- a/docs/src/data/ecosystem/entries/opa-csharp.md +++ b/docs/src/data/ecosystem/entries/opa-csharp.md @@ -5,7 +5,7 @@ labels: category: application layer: network code: -- https://github.com/StyraInc/opa-csharp +- https://github.com/open-policy-agent/opa-csharp - https://www.nuget.org/packages/Styra.Opa tutorials: - https://open-policy-agent.github.io/opa-csharp/ diff --git a/docs/src/data/ecosystem/entries/opa-java-wasm.md b/docs/src/data/ecosystem/entries/opa-java-wasm.md index e61b5b1eec..baa599774f 100644 --- a/docs/src/data/ecosystem/entries/opa-java-wasm.md +++ b/docs/src/data/ecosystem/entries/opa-java-wasm.md @@ -7,10 +7,10 @@ labels: category: wasm type: poweredbyopa code: -- https://github.com/StyraInc/opa-java-wasm +- https://github.com/StyraOSS/opa-java-wasm - https://central.sonatype.com/artifact/com.styra.opa/opa-java-wasm tutorials: -- https://github.com/StyraInc/opa-java-wasm?tab=readme-ov-file#getting-started +- https://github.com/StyraOSS/opa-java-wasm?tab=readme-ov-file#getting-started inventors: - andreatp --- diff --git a/docs/src/data/ecosystem/entries/opa-java.md b/docs/src/data/ecosystem/entries/opa-java.md index 232d94e611..79b2c27eb9 100644 --- a/docs/src/data/ecosystem/entries/opa-java.md +++ b/docs/src/data/ecosystem/entries/opa-java.md @@ -7,7 +7,7 @@ labels: software: - java code: -- https://github.com/StyraInc/opa-java +- https://github.com/open-policy-agent/opa-java - https://central.sonatype.com/artifact/com.styra/opa tutorials: - https://open-policy-agent.github.io/opa-java/javadoc/ diff --git a/docs/src/data/ecosystem/entries/opa-springboot.md b/docs/src/data/ecosystem/entries/opa-springboot.md index 326dc712f3..ddf8933f22 100644 --- a/docs/src/data/ecosystem/entries/opa-springboot.md +++ b/docs/src/data/ecosystem/entries/opa-springboot.md @@ -7,7 +7,7 @@ labels: software: - java code: -- "https://github.com/StyraInc/opa-springboot" +- "https://github.com/open-policy-agent/opa-springboot" - "https://central.sonatype.com/artifact/com.styra.opa/springboot" inventors: - styra diff --git a/docs/src/data/ecosystem/entries/opal.md b/docs/src/data/ecosystem/entries/opal.md index a5be6f22ec..e9474a17c0 100644 --- a/docs/src/data/ecosystem/entries/opal.md +++ b/docs/src/data/ecosystem/entries/opal.md @@ -19,17 +19,17 @@ docs_features: note: | OPAL uses the OPA REST API to update the policy and data pushed down from the OPAL server. - See [how this works](https://docs.opal.ac/overview/architecture). + See [how this works](https://docs.opal.ac/overview/architecture/). external-data: note: | The OPAL Client uses the OPA REST API to update the state pushed down from the OPAL server. - See [how this works](https://docs.opal.ac/overview/architecture). + See [how this works](https://docs.opal.ac/overview/architecture/). external-data-realtime-push: note: | OPAL is able to deliver real-time data updates to OPA instances. See - [how this works](https://docs.opal.ac/getting-started/quickstart/opal-playground/publishing-data-update) + [how this works](https://docs.opal.ac/getting-started/quickstart/opal-playground/publishing-data-update/) in the OPAL docs. --- OPAL is an administration layer for Open Policy Agent (OPA), detecting changes in realtime to both policy and policy data and pushing live updates to your agents. diff --git a/docs/src/data/ecosystem/entries/optoggles.md b/docs/src/data/ecosystem/entries/optoggles.md index a9c56c2ceb..94235ec519 100644 --- a/docs/src/data/ecosystem/entries/optoggles.md +++ b/docs/src/data/ecosystem/entries/optoggles.md @@ -8,7 +8,7 @@ inventors: code: - https://github.com/permitio/OPToggles tutorials: -- https://optoggles.opal.ac/tutorials/demo +- https://optoggles.opal.ac/tutorials/demo/ --- OPToggles uses OPA and OPAL to sync open-policy to your frontend with the help of feature flag solutions. OPToggles creates user-targeted feature flags based on the policy rules you defined in OPA and keeps the users updated in real-time with OPAL's real-time policy and policy-data change detection. diff --git a/docs/src/data/ecosystem/entries/principled-evolution.md b/docs/src/data/ecosystem/entries/principled-evolution.md index bc278b5445..ad91631621 100644 --- a/docs/src/data/ecosystem/entries/principled-evolution.md +++ b/docs/src/data/ecosystem/entries/principled-evolution.md @@ -9,7 +9,7 @@ code: - https://github.com/principled-evolution/gopal - https://github.com/principled-evolution/aicertify blogs: -- https://principledevolution.ai/blog/governance-policy-as-code-opa-trust-ai +- https://principledevolution.ai/blog/governance-policy-as-code-opa-trust-ai/ # tutorials: # Optional: Add if specific tutorials exist --- diff --git a/docs/src/data/ecosystem/entries/rego-cheat-sheet.md b/docs/src/data/ecosystem/entries/rego-cheat-sheet.md index 18d0251782..b6e08db378 100644 --- a/docs/src/data/ecosystem/entries/rego-cheat-sheet.md +++ b/docs/src/data/ecosystem/entries/rego-cheat-sheet.md @@ -6,17 +6,17 @@ labels: code: - https://github.com/open-policy-agent/rego-cheat-sheet tutorials: -- https://openpolicyagent.org/docs/cheatsheet +- https://www.openpolicyagent.org/docs/cheatsheet docs_features: learning-rego: note: | - The [Rego Cheat Sheet](https://openpolicyagent.org/docs/cheatsheet) + The [Rego Cheat Sheet](https://www.openpolicyagent.org/docs/cheatsheet) was designed as a language reference, featuring common contact points, with Rego learners in mind. --- -The [Rego Cheat Sheet](https://openpolicyagent.org/docs/cheatsheet) has been +The [Rego Cheat Sheet](https://www.openpolicyagent.org/docs/cheatsheet) has been designed to be a reference for Rego learners and users documenting the common contact points with the language. There is also a -[PDF version](https://openpolicyagent.org/cheatsheet.pdf) for those looking for +[PDF version](https://www.openpolicyagent.org/cheatsheet.pdf) for those looking for a printable reference. diff --git a/docs/src/data/ecosystem/entries/rond.md b/docs/src/data/ecosystem/entries/rond.md index 8c77825015..a3268ca609 100644 --- a/docs/src/data/ecosystem/entries/rond.md +++ b/docs/src/data/ecosystem/entries/rond.md @@ -21,7 +21,7 @@ inventors: blogs: - https://mia-platform.eu/blog/rond-open-source-api-enforcement/ - https://mia-platform.eu/blog/role-based-access-control-rbac/ -- https://resources.mia-platform.eu/en/white-paper-rbac-platform-engineering +- https://mia-platform.eu/library/rbac-implementation-platform-engineering/ docs_features: go-integration: note: | diff --git a/docs/src/data/ecosystem/entries/scalr-iacp.md b/docs/src/data/ecosystem/entries/scalr-iacp.md index ef5a5b9d46..44d39dfcb5 100644 --- a/docs/src/data/ecosystem/entries/scalr-iacp.md +++ b/docs/src/data/ecosystem/entries/scalr-iacp.md @@ -13,7 +13,7 @@ code: inventors: - scalr blogs: -- https://www.scalr.com/blog/opa-is-to-policy-automation-as-terraform-is-to-iac/ +- https://scalr.com/blog/opa-is-to-policy-automation-as-terraform-is-to-iac docs_features: cli-integration: note: | diff --git a/docs/src/data/ecosystem/entries/spacelift.md b/docs/src/data/ecosystem/entries/spacelift.md index e9fb53dabc..70fca15ac5 100644 --- a/docs/src/data/ecosystem/entries/spacelift.md +++ b/docs/src/data/ecosystem/entries/spacelift.md @@ -25,7 +25,7 @@ docs_features: note: | Spacelift supports Rego as a language to describe policies for IaC resources. View the docs on - [creating Rego policies](https://docs.spacelift.io/concepts/policy/). + [creating Rego policies](https://docs.spacelift.io/concepts/policy). terraform: note: | Spacelift supports Rego as a language to describe policies for Terraform @@ -36,7 +36,7 @@ docs_features: note: | Spacelift supports Rego as a language to describe policies for various resource types, including Kubernetes. View the - [policy documentation](https://docs.spacelift.io/concepts/policy/) for + [policy documentation](https://docs.spacelift.io/concepts/policy) for more information. --- Spacelift is a sophisticated CI/CD platform for Infrastructure as Code including Terraform, Pulumi, CloudFormation, Kubernetes, and Ansible. Spacelift utilizes Open Policy Agent to support a variety of policy types within the platform and Policy as Code for secure and compliance Infrastructure as Code. diff --git a/docs/src/data/ecosystem/entries/springsecurity-api.md b/docs/src/data/ecosystem/entries/springsecurity-api.md index a2ab6362ea..32c2608886 100644 --- a/docs/src/data/ecosystem/entries/springsecurity-api.md +++ b/docs/src/data/ecosystem/entries/springsecurity-api.md @@ -8,12 +8,12 @@ labels: software: - java code: -- https://github.com/open-policy-agent/contrib/tree/master/spring_authz +- https://github.com/open-policy-agent/contrib/tree/main/spring_authz - https://github.com/Bisnode/opa-spring-security - https://github.com/massenz/jwt-opa - https://github.com/eugenp/tutorials/tree/master/spring-security-modules/spring-security-opa tutorials: -- https://github.com/open-policy-agent/contrib/blob/master/spring_authz/README.md +- https://github.com/open-policy-agent/contrib/blob/main/spring_authz/README.md - https://github.com/massenz/jwt-opa#web-server-demo-app - https://www.baeldung.com/spring-security-authorization-opa inventors: diff --git a/docs/src/data/ecosystem/entries/sql-datafiltering.md b/docs/src/data/ecosystem/entries/sql-datafiltering.md index ebf1ebdf2a..6a708cbc3e 100644 --- a/docs/src/data/ecosystem/entries/sql-datafiltering.md +++ b/docs/src/data/ecosystem/entries/sql-datafiltering.md @@ -6,7 +6,7 @@ labels: software: - sqlite code: -- https://github.com/open-policy-agent/contrib/tree/master/data_filter_example +- https://github.com/open-policy-agent/contrib/tree/main/data_filter_example blogs: - https://blog.openpolicyagent.org/write-policy-in-opa-enforce-policy-in-sql-d9d24db93bf4 inventors: diff --git a/docs/src/data/ecosystem/entries/swift-opa.md b/docs/src/data/ecosystem/entries/swift-opa.md index 2fb23c2a59..95b32a318c 100644 --- a/docs/src/data/ecosystem/entries/swift-opa.md +++ b/docs/src/data/ecosystem/entries/swift-opa.md @@ -16,6 +16,6 @@ tutorials: --- Swift-OPA is a Swift package for evaluating -[OPA IR Plans](https://www.openpolicyagent.org/docs/latest/ir/) compiled from +[OPA IR Plans](https://www.openpolicyagent.org/docs/ir) compiled from [Rego](https://www.openpolicyagent.org/docs/latest/policy-language/#what-is-rego) declarative policy. diff --git a/docs/src/data/ecosystem/entries/terraform.md b/docs/src/data/ecosystem/entries/terraform.md index 30edd2c9c1..d298119237 100644 --- a/docs/src/data/ecosystem/entries/terraform.md +++ b/docs/src/data/ecosystem/entries/terraform.md @@ -11,17 +11,17 @@ labels: layer: orchestration tutorials: - https://www.openpolicyagent.org/docs/terraform.html -- https://github.com/instrumenta/conftest/blob/master/README.md +- https://github.com/open-policy-agent/conftest/blob/master/README.md code: - https://github.com/instrumenta/conftest - https://github.com/fugue/regula -- https://github.com/accurics/terrascan +- https://github.com/tenable/terrascan - https://github.com/Checkmarx/kics - https://github.com/open-policy-agent/library/tree/master/terraform -- https://github.com/accurics/terrascan/tree/master/pkg/policies/opa/rego +- https://github.com/tenable/terrascan/tree/master/pkg/policies/opa/rego - https://github.com/Checkmarx/kics/tree/master/assets/queries/terraform blogs: -- https://www.styra.com/blog/policy-based-infrastructure-guardrails-with-terraform-and-opa +- https://www.styra.com/blog/policy-based-infrastructure-guardrails-with-terraform-and-opa/ inventors: - fugue - accurics diff --git a/docs/src/data/ecosystem/entries/waltid.md b/docs/src/data/ecosystem/entries/waltid.md index e9c20b934a..b42d97bbc4 100644 --- a/docs/src/data/ecosystem/entries/waltid.md +++ b/docs/src/data/ecosystem/entries/waltid.md @@ -14,8 +14,8 @@ software: code: - https://github.com/walt-id/waltid-ssikit tutorials: -- https://docs.walt.id/v/ssikit/ssi-kit/open-policy-agent -- https://docs.walt.id/v/ssikit/concepts/verification-policies/dynamic-policies +- https://docs-old.walt.id/ssikit/concepts/open-policy-agent +- https://docs-old.walt.id/ssikit/concepts/verification-policies/dynamic-policies videos: - title: Verifying W3C Verifiable Credentials with the SSI Kit using OPA (Open Policy Agent) @@ -28,7 +28,7 @@ docs_features: note: | SSI Kit's CLI exposes policy management commands which update a local OPA instance. The feature is - [documented in the walt.id docs](https://docs.walt.id/v/ssikit/concepts/open-policy-agent). + [documented in the walt.id docs](https://docs-old.walt.id/ssikit/concepts/open-policy-agent). --- Verifying W3C Verifiable Credentials for building SSI (Self-Sovereign Identity) use cases.