Go 1.23 is no longer supported as per Go release policy.
Changes:
- Use Go v1.24.6 as the project SDK requirement
- Apply lint fixes for Go 1.24
- Fix "non-constant format string in call" issues as seen in CI.
Signed-off-by: Ville Vesilehto <ville@vesilehto.fi>
A tiny first step to have more tooling correctly report
virtual and base document conflicts, as detailed in #7694.
This PR fixes the `opa check` command to report conflicts
of this type when the `-b`/`--bundle` flag is provided. The
bundle flag is required as without that, `opa check` should
only verify policies and not load data at all.
While I was in the `cmd` directory, I got annoyed with how
many of these commands store the same constants for their
`--format` flag, so I decided to fix that too, even if it
wasn't related to what I originally planned to do. I hope
it's not too distracting.
Signed-off-by: Anders Eknert <anders@styra.com>
Brace yourselves! For there are many touched files here. No changes
in semantics however.
Spent a long time trying out the various optional rules gocritic
provides, and settled for a few of them. There are more I really
like, but that would take many hours to address across the codebase.
Perhaps others find gocritic too pedantic? If so, we can merge the
fixes without enabling the rule.
Signed-off-by: Anders Eknert <anders@styra.com>
And update code to conform to the rule.
- Replace unnecessary fmt.Sprintf with string concatenation
- Replace fmt.Sprint with more efficient strconv.Itoa
- Replace static fmt.Errorf calls with more efficient errors.New
Thanks @srenatus for pushing me down this rabbit hole!
Signed-off-by: Anders Eknert <anders@styra.com>
To make OPA behave as v0.x post v1.0 release.
If used simultaneously with `--v1-compatible` flag, the `--v0-compatible` flag takes precedence.
Also, future-proofing `cmd` package tests for 1.0.
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
This was never supported, and the flag is thus confusing. Since the
only supported format is "json" (the default), the flag is redundant
now. However, I've kept it so if someone uses `opa exec --format=json`
somewhere, their calls won't become invalid.
If someone had been using `opa exec --format=pretty`, they will now
see an error, but I think that's less confusing: pretty formatting
is just not supported for 'opa exec'.
Signed-off-by: Stephan Renatus <stephan@styra.com>
This commit adds a `--timeout` duration flag to the `opa exec` CLI command.
This flag helps out in use cases such as CI, where stalling indefinitely
is undesirable behavior.
Fixes: #6613
Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
In addition to those commands already supported:
* build
* check
* eval
* fmt
* test
support has been added to the following commands:
* `bench`
* `deps`
* `exec`
* `inspect`
* `parse`
* `run` (command `server` and `REPL`)
Fixes: #6520
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
All published OPA images now run with a non-root uid/gid.
The uid:gid is set to 1000:1000 for all images. As a result
there is no longer a need for the --rootless image variant
hence it will not be published as part of future releases.
This change is in line with container security best practices.
OPA can still be run with root privileges by explicitly setting the user,
either with the --user argument for docker run, or by specifying
the securityContext in the Kubernetes Pod specification.
Fixes: #4295
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
I have added a system for showing fatal and non-fatal deprecation warnings. It's configurable by command and environment.
If we merge this PR, running a rootless image with any OPA command other than `opa run` will result in a fatal error and exit code 1.
It's possible for users to continue to use the image by unsetting: OPA_DOCKER_IMAGE_TAG=rootless.
`opa run` will show the message, but it's not fatal for this command. This is intended to avoid production disruption.
Signed-off-by: Charlie Egan <charlie@styra.com>
Adds the ability to exit with a non-zero exit code for 'opa exec' by adding the
--fail and --fail-defined flags matching their respective behaviors in 'opa eval':
- Setting the --fail-defined flag allows exit of opa exec with a zero code if all
results are undefined and there are no errors, or a non-zero code in the
event of any defined results and/or errors.
On non-zero exits the error message includes the number of failures/errors
as well as a reference to the --fail-defined flag being set.
- The --fail flag behaves as the inverse of --fail-defined.
Fixes: #5007
Signed-off-by: Byron Lagrone <byron.lagrone@seqster.com>
With this, we allow the user to configure the logger's timestamp format by:
* cli argument `log-timestamp-format`
* environment variable `OPA_LOG_TIMESTAMP_FORMAT`
Fixes#2413.
Signed-off-by: Sergey Vilgelm <sergey@vilgelm.com>
This is just a skeleton but the basic functionality is there: run OPA
in a "one shot" mode against a set of input files and print the
results for each.
Fixes#3525
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Ville Vesilehto