Users of OPA as a library are concerned about big binary blobs in their vendor/
directories. Even more so if they don't use them. This is the case for anyone
using OPA as library, but not using the wasm-backed evaluation feature.
With this change, importers of any packages other than `server` and `cmd`
will have to explicitly opt-in to using wasm evaluation features by having an
underscore import somewhere:
import _ "github.com/open-policy-agent/opa/features/wasm"
Fixes#3545.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Now, when an interrupt happens, we'll clean up after ourselves: we keep calling
a cheap function to ensure that the trap has been trapped on.
To get there, we'll move the "defer-recover" further down the call stack.
Also, this changes the cancellation error returned by the topdown builtin. It no
longer is a builtinError with a message indicating that the context was cancelled
(or its deadline reached), but return a CancelErr, the same thing that happens via
the other cancellation mechanisms involved topdown's Cancel (like in cidr.expand).
Compared with master, this isn't worse:
name old time/op new time/op delta
RESTAuthzForbidAuthn-16 542µs ±15% 525µs ±12% ~ (p=0.841 n=5+5)
RESTAuthzForbidPath-16 818µs ± 2% 827µs ± 2% ~ (p=0.556 n=4+5)
RESTAuthzForbidMethod-16 864µs ± 2% 851µs ± 4% ~ (p=0.310 n=5+5)
RESTAuthzAllow10Paths-16 896µs ±20% 855µs ± 5% ~ (p=1.000 n=5+5)
RESTAuthzAllow100Paths-16 4.28ms ± 3% 4.07ms ± 3% -4.97% (p=0.008 n=5+5)
name old alloc/op new alloc/op delta
RESTAuthzForbidAuthn-16 68.8kB ± 1% 67.2kB ± 1% -2.28% (p=0.008 n=5+5)
RESTAuthzForbidPath-16 68.5kB ± 0% 66.9kB ± 0% -2.33% (p=0.008 n=5+5)
RESTAuthzForbidMethod-16 68.5kB ± 0% 66.9kB ± 0% -2.33% (p=0.008 n=5+5)
RESTAuthzAllow10Paths-16 68.5kB ± 0% 66.9kB ± 0% -2.33% (p=0.008 n=5+5)
RESTAuthzAllow100Paths-16 69.1kB ± 0% 67.5kB ± 0% -2.31% (p=0.008 n=5+5)
name old allocs/op new allocs/op delta
RESTAuthzForbidAuthn-16 1.73k ± 1% 1.64k ± 1% -5.17% (p=0.008 n=5+5)
RESTAuthzForbidPath-16 1.72k ± 0% 1.63k ± 0% ~ (p=0.079 n=4+5)
RESTAuthzForbidMethod-16 1.72k ± 0% 1.63k ± 0% -5.13% (p=0.008 n=5+5)
RESTAuthzAllow10Paths-16 1.72k ± 0% 1.63k ± 0% -5.13% (p=0.008 n=5+5)
RESTAuthzAllow100Paths-16 1.72k ± 0% 1.63k ± 0% -5.16% (p=0.008 n=5+5)
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This refactors the vm and pool into separate internal packages, with
the required bits exported that we need for the `opa` package and the
various test packages.
This allows for more easily writing tests in separate packages which
can avoid import cycles, as well as (arguably) simplifying the `opa`
package which should be the main thing any usage of the "sdk" would
be interacting with.
While refactoring I moved the loaders, errors, and some shared code
out into their own packages as well. The new tree looks like:
```
internal/wasm/sdk
├─ internal
│ └─ wasm
│ ├─ bindings.go
│ ├─ pool.go
│ ├─ pool_test.go
│ ├─ util.go
│ └─ vm.go
└─ opa
├─ config.go
├─ errors
│ └─ errors.go
├─ loader
│ ├─ file
│ │ ├─ config.go
│ │ ├─ loader.go
│ │ └─ loader_test.go
│ ├─ http
│ │ ├─ config.go
│ │ ├─ loader.go
│ │ ├─ loader_test.go
│ │ └─ util.go
│ └─ loader.go
├─ opa.go
└─ opa_test.go
```
Where essentially everything under `opa` is public, with the
top level `opa` package being the main one, sub packages being
shared code or additional helpers.
Signed-off-by: Patrick East <east.patrick@gmail.com>
We would previously gate building the wasm resolver (and in turn pull
in the wasmer stuff) based on whether or not cgo was enabled. However
for library use-cases this isn't ideal as someone might be using cgo
for an unrelated reason, and not wish to enabled the wasmer code in
opa.
There is now a new go tag for the files called "opa_wasmer" and a
makefile flag WASMER_ENABLED (default on) which will trigger it. This
means any libraries building OPA that want to have it enabled will
need to specify this tag with like `-tags=opa_wasmer ` or similar when
building.
Signed-off-by: Patrick East <east.patrick@gmail.com>
Instead of round tripping through JSON we use the newer value parse
and dump helpers along with the value stringer and ast term parser
to round preserve the rego typing.
Signed-off-by: Patrick East <east.patrick@gmail.com>
The naming is adjusted to be more inline with other OPA metrics, and
the timers are cleaned up to remove redundancies and consolidate
some portions. A new one for the VM pool release step is added too.
Signed-off-by: Patrick East <east.patrick@gmail.com>
This plumbs through metrics to the wasm evaluation, adding several
new timers. They will show up when using a Wasm bundle with any of the
usual evaluation mechanisms (eg opa eval, bench, server requests etc)
Signed-off-by: Patrick East <east.patrick@gmail.com>
This commit updates the resolver package to make the wasmer dependency
conditional at build-time. If CGO is enabled then the wasmer
dependency will be included. If CGO is not enabled, the wasmer
dependency will be excluded and the OPA binary will not be able to run
wasm-compiled policies. This allows us to continue building statically
linked OPA executables that can be distributed and used.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The wasm binaries support >1 entrypoint per module, this makes changes
to reflect that in the various data structures we keep references to
the modules and resolvers, mapping them to entrypoints.
Signed-off-by: Patrick East <east.patrick@gmail.com>
This updates the SDK to support retrieving and specifying an
entrypoint when evaluating with the OPA Wasm modules.
The examples have been updated to use the newer APIs, as well as
expanded to include instructions to generate the binaries from source
as opposed to keeping them in the repo.
Signed-off-by: Patrick East <east.patrick@gmail.com>
This is largely plumbing changes required to get Wasm modules loaded
from bundles and configured as external resolvers for evaluations.
Signed-off-by: Patrick East <east.patrick@gmail.com>
Stephan Renatus