Previously we provided actual performance benchmarks
for the OPA-Envoy plugin by running it in an experimental
setup. Although it maybe useful to document real numbers,
the results depend a lot on the environment in which OPA-Envoy
is run, OPA features being used and also on the methodology
used to generate them (eg. how a particular load test tool
measures latency).
Hence this commit provides guidance and best practices for
benchmarking the OPA-Envoy plugin which users can adopt in
their own environments.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
I think this helps people who are not as familiar with go to get
more expected results. The issue is that because `input` and `result`
are interfaces when `event` is printed to stdout without the map being
marshalled to JSON, both `input` and `result` are printed as memory
pointers. This is confusing to someone less familiar with go as
they may believe that their input is not present in the decision
log. By adding Marshal, the stdout will now be standard JSON which
will then have `result` and `input` with the string values.
Signed-off-by: John Snow <john@styra.com>
This change allows users to specify a certificate for the services
that implement the bundle, status etc. APIs. This cert will be
used to create the root CA pool.
Fixes: #1954
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
These aren't required, since github resolves the `master` links properly.
Anyways, let's clean these up.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This commit changes the default of `tls_use_system_certs`
parameter for `http.send` from `false` to `true`
Fixes#2271
Signed-off-by: Olamide Omolola <omololaolamidex@gmail.com>
Fixup to commit 5c213e5
Signed-off-by: Olamide Omolola <omololaolamidex@gmail.com>
Fixed variables name changes as suggested by @anderseknert
Signed-off-by: Olamide Omolola <omololaolamidex@gmail.com>
Amended test as suggested by @srenatus
Signed-off-by: Olamide Omolola <omololaolamidex@gmail.com>
golint is deprecated. The author of the code no longer supports the
codebase. golangci-lint is faster than golint, and is in use by other
opa repositories (e.g. Gatekeeper).
This commit changes tools.go to reference golangci (so it ends up in
vendor) and modifies check-lint to use golangci instead.
Breaking API Changes:
- plugins/rest/rest.go: Fix typo "AllowInsureTLS" -> "AllowInsecureTLS"
- storage/errors.go: Removed unused IndexingNotSupportedErr
Signed-off-by: Will Beason <willbeason@google.com>
This commit updates the discovery plugin so that discovery.resource
can be supplied without discovery.name. This change is a long time
coming and makes the discovery configuration consistent w/ bundle
configuration.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The path matching in the tutorial is wrong. For example:
> glob.match("/people*", [], "/peoplexyz")
true
> glob.match("/people*", [], "/peoplexxxx/1234")
true
This patch updates the examples so that the matches don't return false positives.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Since this file does not update with releases but with deployments,
we'll need to revert this until the release tomorrow.
Signed-off-by: Anders Eknert <anders@eknert.com>
Sphinx-rego automatically generates documentation for Rego policies based on meta properties.
This commit adds `integrations.yml` reference and Sphinx-doc logo.
Signed-off-by: mibarg <11074433+mibarg@users.noreply.github.com>
This might not be the most efficient or idiomatic way to do it, but
I think it works.
Doesn't do in-page anchors, so selecting a different version when on
page /docs/v0.26.0/policy-performance/#benchmarking-queries will get
you to /docs/<other>/policy-performance/ only.
Fixes#3023 to some extend. A little less annoying now, I hope.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Added support for plugins in status plugin, similar to the pattern
employed in the decision logs plugin. By setting `status.plugin`
in configuration, you can override how the status plugin sends status
updates.
Related to #3047
Signed-off-by: Grant Shively <gshively@godaddy.com>
This built-in function makes it possible to get the absolute
difference between to unix timestamps (nanoseconds since epoch)
on the format [year, month, day, hour, minute, second].
Fixes: #3348
Signed-off-by: Andre Håland <andre.haland@gmail.com>
This is required by the Azure Identity OAuth2 implementation
when the client credentials JWT flow is used.
Fixes#3372
Signed-off-by: Anders Eknert <anders@eknert.com>
Also, there is new support for adding annotations on Rules to specify the schemas to be used specifically for type checking the expressions within the scope of that Rule. It helps address issues with schema overloading, and provides even more precise type error reports for a Rego developer.
Also, added support for annotation processing when loading via bundles.
Co-authored-by: @vazirim Mandana Vaziri mvaziri@us.ibm.com
Co-authored-by: @aavarghese Ansu Varghese avarghese@us.ibm.com
Co-authored-by: @tsandall Torin Sandall torinsandall@gmail.com
Signed-off-by: Mandana Vaziri <mvaziri@us.ibm.com>
This change allows users to configure the rate at which decision
logs can be written into the encoder. A token bucket based rate
limiter is used to decide if a log event should be written into
the encoder. The encoded events are then added to the
buffer. If the rate limit is exceeded the event is dropped.
This change provides added control to users over buufering log events
on top of the existing behavior of specifying a buffer size limit.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Should fix annoying dependabot warning.
Live blocks functionality tested with make serve-local and
remotely using Netlify. Both seems to work as before.
Signed-off-by: Anders Eknert <anders@eknert.com>
Ashutosh Narkar