This change brings in support for multiple bundles to be downloaded
and activated OPA.
This is enabled by using the new config option `bundles` to define
the bundles, and deprecates the older `bundle` option.
The new `bundles` keyword and structure is propagated through to the
decision logs, status API, provenance, stored manifests, etc. Check
out the doc changes for all the updated structures.
That being said any existing configuration using `bundle` will *not*
see the new structure, everything is intended to be backwards
compatible (almost to a fault).
Fixes: #721
Signed-off-by: Patrick East <east.patrick@gmail.com>
This tag will follow the current master branch and lines up with what
is in the docs as the `edge` version alias.
Signed-off-by: Patrick East <east.patrick@gmail.com>
It is not very discoverable as to how the `--set` options work when
keys have `.` characters in them. This adds in a section to the config
docs on how to do it.
Signed-off-by: Patrick East <east.patrick@gmail.com>
This is a common question that comes up. Until we have a keyword that
lets users express "FOR ALL" we should have docs we can point to.
Fixes#1307
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Clarify the requirements/caveats for using the local decision logger
and include a blurb on the decision log.
Signed-off-by: Patrick East <east.patrick@gmail.com>
These changes update the rule index to support glob.match calls. The
changes update the build step to transform glob.match(pattern,
delimiter, match) calls into ref/value pairs like equality
expressions. In addition, the build step creates a mapper function
that transforms resolved values into lookup values during traversal.
As part of these changes, the build operation has been refactored so
that most of the process is encapsulated by a new refindices struct
that's separate from the actual rule index/trie. Hopefully this makes
the code easier to follow.
The index build step for glob.match only recognizes statements where
the match operand was given as a reference (and then was rewritten by
the earlier step in the compiler.) If this is too brittle we could
revisit the build step and close over all intermediate assignments.
Fixes#1496
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The ToC will now show deeper heading levels as needed, and gives
some visual indication of where you are on the page. This helps a
ton with browsing around and referencing different parts of the docs.
Signed-off-by: Patrick East <east.patrick@gmail.com>
Add specific example using array indexes to show what expression is
allowed and what is not explicitly.
Signed-off-by: Ken Fukuyama <kenfdev@gmail.com>
Add option to log decision logs locally. They'll get logged via
Logrus at info level.
To enable configure OPA with something like:
```
decision_logs:
console: true
```
This will work alongside remote services and plugins. It will also
log the masked events in the case a masking policy is set.
Fixes: #1334
Signed-off-by: Patrick East <east.patrick@gmail.com>
We were using a file with hard coded versions to display docs for, but
this complicates things if/when we need to do patch releases on
different branches from master.
Signed-off-by: Patrick East <east.patrick@gmail.com>
These changes simply update the bundle reader to accept data.yaml
files in addition to data.json files. This allows callers to supply
YAML files to OPA without having to convert them into JSON.
Fixes#1471
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes enhance the in-built decision logger to support masking
of input and result fields for cases where sensitive information is
passed to OPA (or generated by the policy.)
Also, fix rego package to avoid panic-ing on programmatically created
queriest that lack Location information.
Fixes#779
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
In bb0d4e271b whitespace in the
these sections got wiped out which removed the indentation from the examples.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes update the server to include request headers in the
authorization input document.
Fixes#1456
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This commit renames the 'var' keyword to 'some'. 'some' is more
descriptive than 'var' and will better complement an 'every' or
'forall' keyword representing for universal quantifiers.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This is less sophisticated than the default logrus one, but it is
much easier to read the server output. Primarily with JSON fields
and multi-line strings. They are decoded and prettified.
Signed-off-by: Patrick East <east.patrick@gmail.com>
The `json-pretty` log format flips on the “pretty” flag for logrus
which gives multi-line formatted json log output.
This also changes to make the `json` format to be the default as it
is likely to be what deployers want when running with `—server`.
Fixes: #1202
Signed-off-by: Patrick East <east.patrick@gmail.com>
Adds operation support for both CREATE and UPDATE.
This allows OPA to prevent updates to an Ingress when
it conflicts with another namespace.
Only enforcing on CREATE could allow an actor to first
apply a valid ingress and then update to a conflicting one.
Signed-off-by: David Katz <david.katz@mongodb.com>
Patrick East