Commit Graph

6 Commits

Author SHA1 Message Date
Stephan Renatus 137d7b6f72 storage/inmem: Allow disabling util.Roundtrip on Write (#5015)
Add option to inmem.store which allows disabling the round-tripping
through JSON when adding data to the store.

This option is intended for callers who can guarantee the objects they
pass to Write are JSON objects, and have properly ensured the object
will be only be accessed by store once added.

Fixes #4708.

This is continuance of https://github.com/open-policy-agent/opa/pull/4709,
adding these bits:

* storage/inmem: backwards-compat nitpicks, test adaptations

  I might have overshot here, but adding variable-length function parameters
  is not a backwards-compatible move. Concretely, if you had been using code like

      var x func() storage.Store = inmem.New

  going from New() to New(...Opts) would break it.

* storage/inmem: use it where possible without roundtrip

* storage/inmem: deal with nil map

  It looks like this is something the roundtrip had guarded us from.
  Now, we'll explicitly check this.

  This came up when running the bundle tests with roundtripping disabled.

* loader: add StoreWithOpts convenience method

Co-authored-by: Will Beason <willbeason@google.com>
Co-authored-by: Philip Conrad <conradp@chariot-chaser.net>
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
2022-08-18 08:38:21 +02:00
Torin Sandall 0b7a2c38af Add support for manual plugin triggers
This commit introduces the idea of manual triggers to trigger
plugins. Currently plugins such as discovery, bundle, decision log etc.
perform their functions in a timer-based loop. For example, the bundle
plugin periodically checks for new bundles by polling a remote server.

This change adds the ability to trigger a plugin thereby allowing callers
to control when a bundle download happens, when a decision log is
uploaded etc. The periodic mode is still the default for the plugins.

This feature allows callers to trigger individual plugins. Plugins perform
their functions and then report back to the caller when done.

Co-authored-by: Torin Sandall <torinsandall@gmail.com>
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
2021-08-26 09:35:02 -07:00
Rafael Fernández López 581ba9c456 documentation: fix uid and message returned to the Kubernetes apiserver (#3730)
* documentation: always return the `uid` to the Kubernetes apiserver

The Kubernetes API server will reject the answer from any webhook that
does not contain the `uid` present in the request [1]. Failing to do
so will not only result in a warning, but in the answer from the
webhook being ignored, and the request rejected [2].

[1] https://github.com/kubernetes/apiserver/blob/464eee4062a8f21f785e657b32b83f19d693af8d/pkg/admission/plugin/webhook/request/admissionreview.go#L52-L55
[2] https://github.com/kubernetes/apiserver/blob/464eee4062a8f21f785e657b32b83f19d693af8d/pkg/admission/plugin/webhook/validating/dispatcher.go#L236-L239

* documentation: rename `reason` to `message` on certain objects

When the object refers to an `AdmissionReview` from Kubernetes, what
OPA calls the `reason` is the `message` field.

* documentation: create `opa-server` secret in the `opa` namspace

Signed-off-by: Rafael Fernández López <rfernandezlopez@suse.com>
2021-08-20 09:51:19 +02:00
Will Beason 3be1d08b87 Change check-lint to use golangci-lint (#3465)
golint is deprecated. The author of the code no longer supports the
codebase. golangci-lint is faster than golint, and is in use by other
opa repositories (e.g. Gatekeeper).

This commit changes tools.go to reference golangci (so it ends up in
vendor) and modifies check-lint to use golangci instead.

Breaking API Changes:

- plugins/rest/rest.go: Fix typo "AllowInsureTLS" -> "AllowInsecureTLS"
- storage/errors.go: Removed unused IndexingNotSupportedErr

Signed-off-by: Will Beason <willbeason@google.com>
2021-05-19 07:52:02 +02:00
Patrick East 739777cfff plugins/logs: Add custom EventV1 -> AST helper
This pretty substantially improves performance by avoiding to do a
JSON round trip and then converting into AST types.

There are a couple of fields left that require the round trip, we can
iterate on this as needed to supply better options for the results
and metrics.

This custom ASTer leaves out the rule counts, which also helps to
improve the performance.

On my local machine the numbers look like:

```
name                              old time/op    new time/op    delta
MaskingNop-8                         129µs ± 1%     110µs ± 1%  -15.19%  (p=0.000 n=7+10)
MaskingRuleCountsNop/1Rules-8        138µs ± 1%     111µs ± 1%  -19.34%  (p=0.000 n=10+10)
MaskingRuleCountsNop/10Rules-8       180µs ± 1%     116µs ± 4%  -35.70%  (p=0.000 n=10+10)
MaskingRuleCountsNop/100Rules-8      614µs ± 1%     113µs ± 1%  -81.66%  (p=0.000 n=10+8)
MaskingRuleCountsNop/1000Rules-8    5.16ms ± 2%    0.11ms ± 1%  -97.79%  (p=0.000 n=10+10)
MaskingErase-8                       148µs ± 2%     129µs ± 0%  -12.65%  (p=0.000 n=10+10)

name                              old alloc/op   new alloc/op   delta
MaskingNop-8                        56.7kB ± 0%    48.0kB ± 0%  -15.43%  (p=0.000 n=10+10)
MaskingRuleCountsNop/1Rules-8       59.5kB ± 0%    48.0kB ± 0%  -19.41%  (p=0.000 n=10+10)
MaskingRuleCountsNop/10Rules-8      84.9kB ± 0%    48.0kB ± 0%  -43.47%  (p=0.000 n=10+10)
MaskingRuleCountsNop/100Rules-8      362kB ± 0%      48kB ± 0%  -86.73%  (p=0.000 n=9+10)
MaskingRuleCountsNop/1000Rules-8    3.26MB ± 1%    0.05MB ± 0%  -98.52%  (p=0.000 n=10+10)
MaskingErase-8                      65.7kB ± 0%    57.0kB ± 0%  -13.33%  (p=0.000 n=10+10)

name                              old allocs/op  new allocs/op  delta
MaskingNop-8                         1.23k ± 0%     1.12k ± 0%   -8.46%  (p=0.000 n=10+10)
MaskingRuleCountsNop/1Rules-8        1.31k ± 0%     1.12k ± 0%  -14.32%  (p=0.000 n=10+10)
MaskingRuleCountsNop/10Rules-8       1.98k ± 0%     1.12k ± 0%  -43.30%  (p=0.000 n=10+10)
MaskingRuleCountsNop/100Rules-8      8.74k ± 0%     1.12k ± 0%  -87.13%  (p=0.000 n=10+10)
MaskingRuleCountsNop/1000Rules-8     76.3k ± 0%      1.1k ± 0%  -98.52%  (p=0.000 n=10+10)
MaskingErase-8                       1.33k ± 0%     1.22k ± 0%   -7.84%  (p=0.000 n=10+10)
```

So the performance no longer scales with the number of rules hit, and
overall the base cost is almost 20% faster. This time directly impacts
round trip latency for OPA REST clients performing evaluations.

Signed-off-by: Patrick East <east.patrick@gmail.com>
2020-07-15 12:01:12 -07:00
Patrick East f3a9657920 plugins/logs: Move benchmarks into separate file
Just refactoring, no code changes.

Signed-off-by: Patrick East <east.patrick@gmail.com>
2020-07-15 12:01:12 -07:00