This change brings in support for multiple bundles to be downloaded
and activated OPA.
This is enabled by using the new config option `bundles` to define
the bundles, and deprecates the older `bundle` option.
The new `bundles` keyword and structure is propagated through to the
decision logs, status API, provenance, stored manifests, etc. Check
out the doc changes for all the updated structures.
That being said any existing configuration using `bundle` will *not*
see the new structure, everything is intended to be backwards
compatible (almost to a fault).
Fixes: #721
Signed-off-by: Patrick East <east.patrick@gmail.com>
It is not very discoverable as to how the `--set` options work when
keys have `.` characters in them. This adds in a section to the config
docs on how to do it.
Signed-off-by: Patrick East <east.patrick@gmail.com>
This is a common question that comes up. Until we have a keyword that
lets users express "FOR ALL" we should have docs we can point to.
Fixes#1307
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Clarify the requirements/caveats for using the local decision logger
and include a blurb on the decision log.
Signed-off-by: Patrick East <east.patrick@gmail.com>
These changes update the rule index to support glob.match calls. The
changes update the build step to transform glob.match(pattern,
delimiter, match) calls into ref/value pairs like equality
expressions. In addition, the build step creates a mapper function
that transforms resolved values into lookup values during traversal.
As part of these changes, the build operation has been refactored so
that most of the process is encapsulated by a new refindices struct
that's separate from the actual rule index/trie. Hopefully this makes
the code easier to follow.
The index build step for glob.match only recognizes statements where
the match operand was given as a reference (and then was rewritten by
the earlier step in the compiler.) If this is too brittle we could
revisit the build step and close over all intermediate assignments.
Fixes#1496
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Add specific example using array indexes to show what expression is
allowed and what is not explicitly.
Signed-off-by: Ken Fukuyama <kenfdev@gmail.com>
Add option to log decision logs locally. They'll get logged via
Logrus at info level.
To enable configure OPA with something like:
```
decision_logs:
console: true
```
This will work alongside remote services and plugins. It will also
log the masked events in the case a masking policy is set.
Fixes: #1334
Signed-off-by: Patrick East <east.patrick@gmail.com>
These changes simply update the bundle reader to accept data.yaml
files in addition to data.json files. This allows callers to supply
YAML files to OPA without having to convert them into JSON.
Fixes#1471
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes enhance the in-built decision logger to support masking
of input and result fields for cases where sensitive information is
passed to OPA (or generated by the policy.)
Also, fix rego package to avoid panic-ing on programmatically created
queriest that lack Location information.
Fixes#779
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes update the server to include request headers in the
authorization input document.
Fixes#1456
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This commit renames the 'var' keyword to 'some'. 'some' is more
descriptive than 'var' and will better complement an 'every' or
'forall' keyword representing for universal quantifiers.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This is less sophisticated than the default logrus one, but it is
much easier to read the server output. Primarily with JSON fields
and multi-line strings. They are decoded and prettified.
Signed-off-by: Patrick East <east.patrick@gmail.com>
The `json-pretty` log format flips on the “pretty” flag for logrus
which gives multi-line formatted json log output.
This also changes to make the `json` format to be the default as it
is likely to be what deployers want when running with `—server`.
Fixes: #1202
Signed-off-by: Patrick East <east.patrick@gmail.com>
Adds operation support for both CREATE and UPDATE.
This allows OPA to prevent updates to an Ingress when
it conflicts with another namespace.
Only enforcing on CREATE could allow an actor to first
apply a valid ingress and then update to a conflicting one.
Signed-off-by: David Katz <david.katz@mongodb.com>
There is a new parameter for /health REST API which will include the
Configured bundle activation in the response. Example:
GET /health?bundle=true HTTP/1.1
Without the parameter the behavior stays the same, with it the server
will respond with 500’s until the status has been updated with an
activation time.
The docs for kubernetes ready probe has been updated to show this as
it makes for a better ready check than the original behavior when
remote bundles are being used.
Fixes: #1153
Signed-off-by: Patrick East <east.patrick@gmail.com>
When we parse modules we won’t get an error back if the module contents
is empty, but we do get back a `nil` module value.
In the bundle loader we need to catch this before going further with
trying to load the module as it is not actually a valid module and
will break assumptions made about it.
According to the docs Modules must, at a minimum, have a package
declaration. With that in mind this seems like the right behavior to
enforce on the bundled rego files since we treat them as modules.
Fixes: #1393
Signed-off-by: Patrick East <east.patrick@gmail.com>
The older markdown still had `v{{< version >}}` shortcodes being used
which broke when the version changed to include the “v” in it.
This adds in some backwards compatibility logic for the shortcode and
adds newer, more specific, ones to replace it going forward. Part of
The issue is that typically the documentation will only want to
Reference the version that it is documenting and not always the
latest.
Fixes: #1382
Signed-off-by: Patrick East <east.patrick@gmail.com>
We mixed together doc content and website content. We don’t need to
version the website content (logos, main site stuff, etc) but the doc
static content (mostly images) should be tied to the markdown that
uses it.
Signed-off-by: Patrick East <east.patrick@gmail.com>
Previously the code content was only kept in master and was
Subsequently referenced by the versioned doc contents. This causes
A few problems.. so we will version it along with the doc content.
To get this to work we make a handful of changes:
* Move the docs up into just opa/docs/content/*, we’re going to remove
The difference between local/dev and production builds soon.
* Move the “code” directory into the content dir, it is content tied
To the markdown files already there.
* Change the Hugo config to ignore the code directories
* Change the “code” shortcode to load the versioned code snippet
* Change load-docs to copy the code directory in addition to the other
markdown content.
Signed-off-by: Patrick East <east.patrick@gmail.com>
It’s kinda weird that we have the “v” prefix all over when we started
out with the full tag name anyway. This change just keeps it all set
to the tag version.
Signed-off-by: Patrick East <east.patrick@gmail.com>
Patrick East