This commit moves an accidental package-level definition of the `opa
parse` CLI subcommand to a local variable inside the `initParse`
function, similar to how we do command initialization for all other OPA
CLI subcommands.
Before this change, it was possible to see panics from the package
variable `cobra.Command` in `parse.go` having some of its flags redefined.
This fix makes it possible for `make generate-cli-docs` to run without
error again.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
(cherry picked from commit 47e2b74dda)
This commit fixes an issue when upgrading codebases to OPA v1.7.0.
In PR #7797, we introduced the ability to provide "branding"
information in OPA commands and help messages, which would
allow easier customized OPA distributions in the future.
However, this changeset removed the public symbol `cmd.RootCommand`,
and required refactoring to use `cmd.Command`, which breaks automated
upgrades, such as those done by Dependabot.
This PR adds back the missing symbol, with the original/default "OPA"
branding provided. This should allow existing codebases to upgrade
without requiring any code changes.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
- added link to playground
- removed some examples I felt were redundant
- made the constants example relevant to the example domain
- minor wording changes and fixes
Signed-off-by: Charlie Egan <charlie@styra.com>
Rationale is that if the user has passed a store into the SDK, it
probably has something in it already, like data and policies.
Signed-off-by: Stephan Renatus <stephan@styra.com>
Funnily, this started out as an attempt to look into issues reported
with compiling large policy sets... before I realized that it isn't
likely *this* compiler that has perf issues, but the one that "compiles"
bundles as part of activation. So while these fixes likely does little
to address that, there are still some rather nice improvements here, where
the big ones as ususal are mostly just wins from avoiding work where it's
possible.
For benchmarking I've used Regal's embedded bundle, which isn't great to
use over time, as it's a moving target. But since it's a pretty extensive
bundle and one that covers most features of OPA, it's at least good for
1:1 comparisons when testing perf improvements.
```
// 66555594 ns/op 50239492 B/op 1083664 allocs/op - main
// 62569440 ns/op 38723015 B/op 944277 allocs/op - compiler-optimizations pr
```
The B/op / alloc_space improvement is particularly nice here. What's noteworthy
is how relatively little impact that has on performance in this case. That may
be surprising but aligns pretty well with my previous experience of Go code where
a lot of time is spend in recursive walks — that simply takes time, no matter how
much you optimize. Oh well, less memory allocated for this is more memory to spend
elsewhere.
(I'm adding the benchmark used below to Regal in a parallel PR)
Signed-off-by: Anders Eknert <anders@styra.com>
This change allows users that build their own executable or "spin" of
OPA to give it a name, and have it reference itself properly in help
texts.
It's a vanity thing, but I think some people would appreciate it, hat
tip to the international association of pedants.
Signed-off-by: Stephan Renatus <stephan@styra.com>
Co-authored-by: kevinstyra <83973046+kevinstyra@users.noreply.github.com>
This commit adds an experimental "intermediate results" field to
decision logs, and provides some basic plumbing in the server package
for attaching the intermediate results of an eval to the request
context.
Co-authored-by: Teemu Koponen <koponen@styra.com>
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
This provides the means to inject modules _for all invocations of the
ast package in an executable_. It's handy if you want to include your
own set of base modules, with helper functions.
Since the module loader can be provided via other means, we need to
check both possibilities:
1. If there hasn't been a module loader set up before, just use
the default module loader.
2. If there had been one set up before, run that first, then run
the default one, and merge the results. This can be iterated,
of course, if need be -- and should reach a fix point given
that the individual loaders do.
Signed-off-by: Stephan Renatus <stephan@styra.com>
This commit provides an extension mechanism for the server authorizer,
allowing plugins and other server extensions to inform the authorizer
about the methods and paths where it should expect and parse request
bodies.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
This commit adds a new field to Decision Log entries, allowing batches
of decisions to be correlated together later.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
Before we had introduced `http.ServeMux` as "the router", we had been
using github.com/gorilla/mux. Using the latter, it was possible to
inject middlewares using the mux's `.Use()` method. This mechanism
allowed global middlewares to be injected from `runtime.Params`, for
example.
With `http.ServeMux`, that's no longer possible. However, it was never
an intentionally supported feature in the first place.
So this commit introduces HTTP handler middlewares as extension points.
It's modelled after `(*plugins.Manager).ExtraRoute()`.
Signed-off-by: Stephan Renatus <stephan@styra.com>
`os.Exit` immediately exits the program and doesn't run defer functions.
This can be problematic as any command.OnFinalize routines and any logic
after the command.Execute won't be run.
Also suppress all RunE cobra error and usage messages. These would be
printed twice otherwise.
Signed-off-by: Stephan Renatus <stephan@styra.com>
Co-authored-by: Kevin St. Pierre <kevin@styra.com>
This allows simple setups -- those feeding the OPA discovery plugin with
a static JSON file -- to still do env variable replacements.
This should be possible already, by using a policy to construct the
disco config, but it becomes easier now.
Co-authored-by: Teemu Koponen <koponen@styra.com>
Signed-off-by: Stephan Renatus <stephan@styra.com>
This commit adds support for changing out how bundle storage and
activation work. To allow swapping out bundle activation, two new
`bundle` package functions are provided:
- `RegisterActivator`: Registers a bundle.Activator with a string ID.
- `RegisterDefaultBundleActivator`: Sets the default bundle.Activator to
use by ID.
Behind the scenes, a few new `bundle` package variables are used to
track what bundle activators are available, and which is the preferred
default.
This system allows registering many activators, and allows choosing the
bundle activator to use at activation time. The activator to use is
decided in the following order:
- `(bundle.ActivateOpts).Plugin` is used when non-nil.
- `bundle.bundleExtActivator` is used when an ID was set with
`RegisterDefaultBundleActivator`.
- The default/original bundle activator is used if no other selection
was made.
To support swapping out bundle storage (useful when testing new bundle
designs), a new `bundle` package function is provided:
- `RegisterStoreFunc`: Sets the function to use for creating bundle
storage.
These two features together allow swapping out most of the bundle
activation flow, without requiring deep modification of the `bundle`
package. Lazy bundle loading mode is also enabled across many CLI
commands and other bundle loading points now when a non-default bundle
activator is set.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
Co-authored-by: Ashutosh Narkar <anarkar4387@gmail.com>
* storage: allow overriding NonEmpty
Custom store implementations can now bring their own NonEmpty() methods,
which may be more efficient than what the generic method does.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* runtime: allow passing in custom store builder
Signed-off-by: Stephan Renatus <stephan@styra.com>
---------
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Signed-off-by: Stephan Renatus <stephan@styra.com>
Turns out that CORS is either any host, or a specific host. We need to
match any opa versioned deployment host, so we need a *.
Signed-off-by: Charlie Egan <charlie@styra.com>
I have also corrected some issues with a non / base path for the site
here which are mostly unrelated.
Changes to the release/build tasks will come in a different PR so we
only show the latest release and not the edge on
openpolicyagent.org/docs.
Signed-off-by: Charlie Egan <charlie@styra.com>
Otherwise, setting something from the runtime parameter
ExtraDiscoveryOpts would be impossible: on runtime startup, the runtime
is injecting its own registered plugins via that method.
With this change, for example factories passed via discovery.Factories()
in ExtraDiscoveryOpts will be able to add to (or replace) the previously
registered plugins.
Signed-off-by: Stephan Renatus <stephan@styra.com>
When an plugin http handler or some other mechanism wants to do rego
evaluations, too, it's beneficial to share the caches with the server.
This change introduces two new hook types to allow retrieving those
caches during server startup.
Signed-off-by: Stephan Renatus <stephan@styra.com>
Mobile uses 2, desktop uses 4. This is intended to show more of examples
on mobile.
Made two other small edits to improve the mobile presentation.
Signed-off-by: Charlie Egan <charlie@styra.com>
This makes a number of changes to how the built in functions are
displayed to ensure that there is no horizontal scrolling when viewing
builtin in tables with longer function names.
Signed-off-by: Charlie Egan <charlie@styra.com>
This way, the extra handler functions are still covered by prometheus
metrics and opentelemetry spans.
The previous method of directly registering routes with the router
bypassed the server's handler wrapping.
Signed-off-by: Stephan Renatus <stephan@styra.com>
This commit comprehensively plumbs in the bundle lazy loading mode
option in the compile, runtime, rego, and bundle packages. It also
includes the bare minimum plumbing to allow the path watcher utilities
to also toggle the option on.
In nearly all places where a default is expected, the lazy loading mode
is set to false (disabled) to avoid behavior changes.
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
This allows injecting discovery options, such as hooks, or extra
factories, into the runtime. It's useful because when wrapping OPA, you
don't want to re-write the runtime package, you want to use it as-is.
With this, we can still configure a few internals.
Signed-off-by: Stephan Renatus <stephan@styra.com>
QueryTracers is required for parameterized subtests to work in a
different rego plugin.
tracing.Options are needed to have http.send and friends be wired up
with OTel when using a different rego plugin.
Cancellation is useful when the evaluation scenario is different from
the usual, like in bulk requests
Co-authored-by: Philip Conrad <philip@chariot-chaser.net>
Signed-off-by: Stephan Renatus <stephan@styra.com>
A number of benchmarks did not have a `for range b.N` (or equivalent) loop in
them, leading to nothing being measured. This PR fixes that, along with some
cleanups in benchmarks found along the way.
Also remove `b.StopTimer` where not absolutely necessary, as that is
[notoriously buggy](https://github.com/golang/go/issues/27217), and had some
benchmarks hang for a very long time.
Signed-off-by: Anders Eknert <anders@styra.com>
This is quite hard to test, but if you're using a rego plugin that emits
metrics that are not int64 (such as counters), this would give a panic
at run time.
Signed-off-by: Stephan Renatus <stephan@styra.com>
This allows certain plugins to do their cleanup routines -- like sending
decision logs to some other location when using a custom decision log
setup.
Signed-off-by: Stephan Renatus <stephan@styra.com>
Philip Conrad