This adds a new `service` option to the `s3_signing` config, allowing for other AWS services (such
as API Gateway endpoints) to be used for bundles, decision logs etc.
For example:
```
services:
decision-log-service:
url: https://myrestapi.execute-api.ap-southeast-2.amazonaws.com/prod/
credentials:
s3_signing:
service: execute-api
environment_credentials: {}
decision_logs:
service: decision-log-service
reporting:
min_delay_seconds: 300
max_delay_seconds: 600
```
If no service is specified, we default to `s3` to maintain backwards compatibility.
This updates the sigv4 signer to include the specified service in the signature, and to sign all
request headers for better compatibility with other AWS services, except an explicit ignore list,
as per https://github.com/aws/aws-sdk-go/blob/master/aws/signer/v4/v4.go#L92
Additionally, this fixes a bug in the signer where the body ReadCloser was consumed and not reset,
meaning requests that were signed were always sent with an empty body!
Fixes#3193
Signed-off-by: Jack Stevenson <jacsteve@amazon.com>
Refactor logging to allow providing custom logging implementations to plugin
manager. This should allow us to keep logging as it is when running OPA as a
server, while injecting noop-loggers or custom, provided loggers for SDK client
implementations.
Fixes#3180
Signed-off-by: Anders Eknert <anders@eknert.com>
Allow OPA to issue JWT's which it uses to authenticate a configured
OAuth2 client, as described in RFC7523. This replaces the client_secret
as the actual credential and allows for either using an entirely new
grant type called "JWT bearer", or using the previously supported
client_credentials grant type, only with the client_secret replaced
by a signed JWT. This change covers both scenarios described in
RFC7523.
Other changes made to accomodate this feature:
- Add `private_key` attribute to keys struct to allow for both public and
private keys to be stored there.
- Refactored the keys configuration struct and logic to its
own package no longer coupled to bundles.
Closes#3055
Signed-off-by: Anders Eknert <anders@eknert.com>
Plugins that implement the HTTPAuthPlugin can be used with a new
credentials options under services:
```
services:
my_service:
credentials:
plugin: my_plugin
plugins:
my_plugin: {}
```
Fixes#2758
Signed-off-by: Grant Shively <gshively@godaddy.com>
Adds support for fetching access and identity tokens from a GCP
metadata server. Identity tokens are used to authenticate to third
party applications running behind Google authentication proxies
such as containers deployed to Google's Cloud Run.
Access tokens are used to authenticate to first party GCP services
such as Google Cloud Storage.
Signed-off-by: Kelsey Hightower <kelsey.hightower@gmail.com>
Adds support for signing S3 requests using Web Identity credentials. Specifically supports the Env Var version that's used in EKS IRSA.
Closes: #2463
Signed-off-by: Richard Simpson <richardsimpson@outlook.com>
Allows OPA to obtain OAuth2 access tokens and present them as bearer tokens for authentication at remote endpoints.
Fixes#1205
Signed-off-by: Anders Eknert <anders.eknert@bisnode.com>
While toying around with a custom credential plugin I noticed that changing the `wantErr` values had no effect to the outcome for the TestNew tests - they would always pass. This was due to:
1. The `New` function only unmarshalling the JSON config, not actually instantiating plugins and clients (which is where the validation step is done).
2. wantErr was only checked if false on errors, not its opposite, i.e. not if wantErr == true and error == nil.
Signed-off-by: Anders Eknert <anders.eknert@bisnode.com>
This commit adds a new configurable timeout to the Services
config to set the amount of time to wait for the server's
response headers. With this change, the client will no longer
wait indefinitely for the HTTP request to complete.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
The AWS v4 signing feature for bundle requests would automatically
add a `Host` header by using the URL hostname. This would break for
URLs that specified a port number (eg: https://127.0.0.1:9000/). That
causes issues with sending a valid request.
This commit changes to use the `URL.Host` which will have the full
`host:port` string, when a port was specified.
Fixes: #2568
Signed-off-by: Patrick East <east.patrick@gmail.com>
AWS_SESSION_TOKEN or AWS_SECURITY_TOKEN is required when signing AWS requests
using ENV credentials from IAM assumed role. Missing token
results with S3 403 error when trying to download bundle.
Signed-off-by: Kamil Piotrowski <kamil.piotrowski@nordcloud.com>
Earlier with discovery enabled, there was no protection against accidental
changes to the discovery service. This change prevents the discovery service
from being modified by checking it's config in the service bundle.
Fixes#2058
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Earlier with discovery enabled updates to the 'services' configuration
was not allowed to protect against accidental changes to the discovery service
itself. Since adding new services could be useful, this change allows modifications
to the 'services' configuration. The only exception is that the service used to download
the discovery bundle cannot be modified.
Fixes#2058
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This change updates the bearer token config to allow clients to specify
a path to the token. With this refreshing tokens becomes easier as OPA
will now reload the token from file.
Fixes#2241
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
It seems as though go 1.14 changes some of the url errors to have
quotes around some fields. To make things compatible across a wider
number of platforms we can relax the checks a tiny bit to only look
at the actual error string and ignore the quoted part.
Signed-off-by: Patrick East <east.patrick@gmail.com>
The HTTP client we were using for bundle downloads was being loaded
once and then re-used. This was problematic for users that configure
cert files and then have them change.
This updates the client wrapper in OPA to re-create the underlying
client for each request.
Fixes: #1898
Signed-off-by: Patrick East <east.patrick@gmail.com>
This can be overridden by custom header configuration for services,
or requests but will default to something like:
`Open Policy Agent/<version> (<os>, <arch>)`
This is set on all outbound requests for status, decision logs, bundle
and discovery downloads, http requests from policies, etc.
Signed-off-by: Patrick East <east.patrick@gmail.com>
When instantiating a http.Transport struct without providing non-zero
values for some of its fields, it will leak connections.
The docs hint at this (https://golang.org/pkg/net/http/#Transport):
By default, Transport caches connections for future re-use. This may
leave many open connections when accessing many hosts. This behavior
can be managed using Transport's CloseIdleConnections method and the
MaxIdleConnsPerHost and DisableKeepAlives fields.
See this issue for details: https://github.com/golang/go/issues/19620
I have not observed any leaks in the wild for this, but I'm also
not using this plugin. I came to fix this because I had recently
introduced a bug in the server tests -- they were altering the
settings for the global http.DefaultTransport when my intention
was to create a copy. Digging in while fixing that revealed this
other location. (The fix for the server tests is in the next commit).
Signed-off-by: Stephan Renatus <srenatus@chef.io>
* Fix typo in run short description
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* Add support for specifying services as object
Previously the services configuration had to be specified as an array,
for example:
services:
- name: foo
url: https://example.com
In some cases, it's easier to structure the configuration as an object.
Specifically, the Helm package manager does not allow you to override
values nested under arrays. These changes allow the services
configuration to be structured as an object:
services:
foo:
url: https://example.com
Ref: https://github.com/helm/helm/issues/1987
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Adds support for usings client certificates to authenticate against
service endpoints. It also enables users to allow insecure TLS
connections to service endpoints.
Fixes#684
Signed-off-by: Kim Christensen <kimworking@gmail.com>
Previously, policies and data had to be pushed into OPA via the REST API
or loaded via command line arguments at startup.
With these changes, OPA can now be configured to pull down bundles of
policy and data from remote HTTP servers. When a bundle is downloaded
successfully, the policies and data are loaded out of the bundle file
and inserted into storage.
Anders Eknert