This change attempts to keep the default decision path used by the server
in sync with the one defined on the manager's config. Currently the
server only updates the default decision path when it's initialized and
when there is a commit on the store. The issue happens when the default
decision path is updated via the discovered config. In this case, the
manager's config is updated but there could be no store txn. Hence
the updated value of default decision path is not taken into account by
the server.
Fixes: #6697
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Prioritizing generating v0 Rego with `rego.v1` import when producing support modules for non-`--v1-compatible` optimized builds.
Affects `opa build` when the `-O` flag is used for optimization, and `opa eval` for partial evaluation with the `-p` flag.
Fixes: #6450
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Previously if Discovery was enabled, other features like bundle downloading and status reporting could not be configured manually.
The reason for this was to prevent OPAs being deployed that could not be controlled through discovery. It's possible that
the system serving the discovered config is unaware of all options locally available in OPA. Hence, we relax the configuration
check when discovery is enabled so that the bootstrap configuration can contain plugin configurations. In case of conflicts,
the bootstrap configuration for plugins wins. These local configuration overrides from the bootstrap configuration are included
in the Status API messages so that management systems can get visibility into the local overrides.
**In general, the bootstrap configuration overrides the discovered configuration.** Previously this was not the case for all
configuration fields. For example, if the discovered configuration changes the `labels` section, only labels that are
additional compared to the bootstrap configuration are used, all other changes are ignored. This implies labels in the
bootstrap configuration override those in the discovered configuration. But for fields such as `default_decision`, `default_authorization_decision`,
`nd_builtin_cache`, the discovered configuration would override the bootstrap configuration. Now the behavior is more consistent
for the entire configuration and helps to avoid accidental configuration errors.
Fixes: #5722
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This change updates the WASM Rego test generation docker
command to address CVE-2022-24765 in Git which could cause
it to execute arbitrary commands.
The error was seen when running the `make wasm-rego-test` target on
darwin/arm64.
Fixes: #6703
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
When `rego.v1` is in the list of imports directly applied on the `rego.Rego` SDK struct, this import, and it's effects, is applied to the query when parsed.
This change affects the `eval` and `bench` commands when the `--imports` flag is used.
Fixes: #6701
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
This commit updates the `upload-artifact` and `download-artifact`
Github actions to the latest version (v4), which should eliminate
the deprecation warning spam we're seeing in CI.
Note: We had to break up the merged "binaries" target into multiple,
smaller targets, which are grouped by OS for the `post-tag` and
`post-merge` workflows, and by OS + arch for the `pull-request`
workflow.
Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
Fixing issue where active parser options aren't propagated to module reload during bundle activation.
Signed-off-by: Francisco Rodrigues <ednofco@gmail.com>
Adding a global `rego_version` attribute to bundle manifest, to inform OPA runtime about what rego-version (v0/v1) to use to parse/compile contained Rego files.
The rego-version of individual Rego files can be overridden through the `file_rego_versions` manifest attribute.
Implements: #6578
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Improving memory footprint and execution time of deps command for policies with high dependency connectivity.
Fixes: #6685
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
This reflects the reality -- we hadn't been sure why the dependabot update had
not increased the stanza when it should have; but doing so now should unbreak
the nightly tests.
Signed-off-by: Stephan Renatus <stephan@styra.com>
In workflow runs like this:
https://github.com/open-policy-agent/opa/actions/runs/7803493290/job/21283458848#step:3:317
We can see two problems. This commit is meant to address them.
First, the test failed with this message:
```
expected unknown certificate authority error but got: Get "https://127.0.0.1:38699/v1/data": write tcp 127.0.0.1:52786->127.0.0.1:38699: write: connection reset by peer
```
Now this step in the test is retried like the other steps in the test
since it can fail too.
Second, the error `failed to reload TLS config` appears many times in
the logs for that test. This issue is caused by the server attempting to
read the new cert, key, and CA contents from disk while they are still
being written to. This PR also introduces a 100ms pause between upto 5
attempts to reload the config for any given change to the state on disk.
This should mean that the error is seen only when is is actually an
issue and the reload has failed after a reasonable time. In most cases,
running locally, the reload happens without error on the first run.
Signed-off-by: Charlie Egan <charlie@styra.com>
This commit fixes a panic that could occur when `opa build` was provided
an entrypoint from both a CLI flag, and via entrypoint metadata
annotation.
The fix is simple: deduplicate the slice of entrypoint refs that the
compiler uses, before compiling WASM or Plan targets.
Fixes: #6661
Co-authored-by: Daniel Herzig <danielherzig96@gmail.com>
Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
This commit adds the possibility to configure the plugin manager with
custom options.
It will allow SDK users to override the options already provided by the
SDK and to futher customize it with configurations that were not
previously available. This is an advanced feature as it requires
some knowledge about the inner workings of OPA.
One use case for this is to provide a prometheus registerer and have the
status plugin metrics available for the client to use it in a
/metrics endpoint, for example.
resolves#6662
Signed-off-by: Francisco Rodrigues <ednofco@gmail.com>
Let me know if these should be in a box of their own — my reasoning
was that they should be avoided even prior to that, so if people won't
use them as var names or whatever, all the better.
Signed-off-by: Anders Eknert <anders@eknert.com>
The service name used for signing the request must be same as
the host header which is of the form https://sts.*
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This change logs the error response body at debug level.
Since the errors could contain senstive info we don't
include them in the status message. So this approach helps to
get more information about the error at debug log level which
is mostly used in a non-prod setup.
Fixes: #6609
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Adds support for signing AWS requests using temporary credentials
obtained from AWS STS via AssumeRole operation. One use-case of
this mechanism is for allowing existing IAM users to access AWS resources
that they don't already have access to. It is also useful as a means to
temporarily gain privileged access.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Fixing two issues where Early Exit was being suppressed when it shouldn't have been:
1. A cache hit for a rule/function discards EE for the call-site.
2. Non-EE rule/func discards EE for call-site.
Fixes: #6566
Ashutosh Narkar