- simplify python code (use json=, use strip)
- do not rename input as http_api (quite confusing, better to keep input everywhere in all tutorials
- reorder statement to always have input.user as first item in the rule
Signed-off-by: Sebastien de Menten <sdementen@gmail.com>
Previously there were no checks in place to ensure that base and
virtual documents do not overlap. As a result, if users loaded raw
JSON and rules into OPA that overlapped, the evaluation results were
not well defined. With these changes, we can detect the overlap and
reject updates (to policies or data) that would cause inconsistent
results.
Fixes#1207
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Adds OPA version to the config labels, so that the version
appears in status updates. Previously, decision logs had a
top-level version field. This removes that field because
version will be contained in the labels instead.
Signed-off-by: Andy Curtis <arcurtis@gmail.com>
Updated examples to always include result wrapper and simplified the
example policies a bit by removing use of negation.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Fixes#1181
There are a couple of things reported in this PR: lack of 405 error and
missing return codes.
I decided to go through the entire REST API manual while comparing with
the code and found more discrepancies. These are the changes I've done:
1 - Restructured the sections to read
..rest api spec
..example
as opposed to:
..part of rest api spec
..example
..part of rest api spec.
As I went through the manual this break in the spec made things
confusing. If I was going to implement a client I would prefer to have
the complete spec for a certain method followed by an example as
opposed to the example break.
2 - Fixed missing or inconsistent return codes
There were quite a few of these.
3 - Added an overall 405 return code.
Since the sections are per method it does not make sense to have a 405
return code there. Therefore I added a small overall section in the
beginning that explains that we return 405 for non-allowed methods
Signed-off-by: repenno <rapenno@gmail.com>
Fixes#1181
There are a couple of things reported in this PR: lack of 405 error and
missing return codes.
I decided to go through the entire REST API manual while comparing with
the code and found more discrepancies. These are the changes I've done:
1 - Restructured the sections to read
..rest api spec
..example
as opposed to:
..part of rest api spec
..example
..part of rest api spec.
As I went through the manual this break in the spec made things
confusing. If I was going to implement a client I would prefer to have
the complete spec for a certain method followed by an example as
opposed to the example break.
2 - Fixed missing or inconsistent return codes
There were quite a few of these.
3 - Added an overall 405 return code.
Since the sections are per method it does not make sense to have a 405
return code there. Therefore I added a small overall section in the
beginning that explains that we return 405 for non-allowed methods
Signed-off-by: repenno <rapenno@gmail.com>
This change allows to set the Prefix to the path of the URI.
Until this commit the prefix statically set as "bundles" and was concatenated by the bundle plugin.
Signed-off-by: liorlevtov <liorl@luminate.io>
This is a common question so it should be answered at the beginning of
the documentation section on bundles.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* identifier: add TLSBased
This is only the identifier, the server setup still has to be done.
Note that it diverges a little from what was proposed in the issue:
not every client cert needs to have a CN record -- so instead, we'll
use whatever is the cert's subject as client identity.
* Drive-by fix: identifier_test: don't use same package for TokenBased
tests.
* server: require and verify client cert for AuthenticationTLS
* server: allow setting CA pool via --tls-ca-cert-file
* server: expose new authentication via parameter
* [nit] server: simplify getListenerForHTTPServer
* server_test: use httptest for integration-y TLS tests
* book/security: mention TLS authn with example
Signed-off-by: Stephan Renatus <srenatus@chef.io>
These changes modify the decision logger to support custom
backends. The docs now include an example of how to implement a custom
backend that writes out to stdout.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes refactor the custom plugin interface to bring it inline
with the bundle/decision logs/status built-ins. Specifically, the
plugin interface is being refactored to allow configuration to be
validated separate from plugin instantiation.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* Update count function doc to mention strings
Updates the doc for the built-in function count to mention strings.
Fixes#1122
Signed-off-by: Fraser Cobb <frasercobb@gmail.com>
These changes refactor the discovery implementation a bit to improve
test coverage and remove duplication of common logic shared with the
bundle plugin.
Specifically, the downloading logic has been moved into a separate
package that is shared by bundle and discovery. Second, test coverage in
the discovery implementation is increased from ~15% to ~85%.
These changes also include a few functional improvements:
- The default decision paths can be updated dynamically
- The decision logger can be enabled dynamically
- Discovery downloading errors are reported in status updates
- Discovery bundle is evaluated with all runtime params
- Custom plugins can be created dynamically
- Status updates include both discovery and bundle status
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously OPA configuration for bundle downloading, status reporting, etc. had to be supplied in a configuration file on startup. With these changes, OPA can be configured to download a bundle that generates the OPA configuration. This allows OPA to boot with minimal configuration and dynamically update that configuration on-the-fly making it much easier to manage large deployments of OPAs for different use cases within the same system.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
These changes just update the build process for the new front page. As
part of these changes, the build should now be run under the host user
account instead of as root (this fixes the issue for site build
artifacts being owned by root.) To make that work the gitbook and npm
directories used by the docs build process need to be located under the
root directory so that they're writable by the user.
With these changes, the first time you build the site locally gitbook
needs to be installed but after that it's cached locally in the .gitbook
directory (so subsequent builds are fast when coupled with the vendored
node_modules for the gitbook plugins).
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The gitbook install has been incredibly flaky due to it's dependency on
npm. This commit simply vendors the node_modules so that each time we
build the site the process doesn't have to re-run gitbook install.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
We no longer create an extra docs directory and the node_modules are
going to get vendored so update .gitignore accordingly.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes update the front page of the openpolicyagent.org site. Specifically:
- Replace empty-calorie content with example use cases
- Eliminate gulp and sccs
- Add scroll-to and -back functionality
- Rocking boat
Overall these changes make the site easier to build and provide a more interesting overview of what users can do with OPA today.
Signed-off-by: Mikol Graves <mikol@thinbox.org>
When decision logging is enabled, API calls for decisions will return a
decision ID, e.g., {"result": true, "decision_id": "abcdef1234"}.
Fixes#1061
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* Fix typo in run short description
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* Add support for specifying services as object
Previously the services configuration had to be specified as an array,
for example:
services:
- name: foo
url: https://example.com
In some cases, it's easier to structure the configuration as an object.
Specifically, the Helm package manager does not allow you to override
values nested under arrays. These changes allow the services
configuration to be structured as an object:
services:
foo:
url: https://example.com
Ref: https://github.com/helm/helm/issues/1987
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously, OPA would serve POST requests with an empty URL path by
querying data.system.main and returning the generated value. In some
cases, it's useful to be able to reconfigure OPA to use a different
document to serve these kinds of requests. The same goes for the OPA
authorization policy.
These changes make the default decision and default authorization
decision paths configurable.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes make it possible to replace the data document.
Both base and virtual documents can be replaced. These changes support
replacing rules without arguments. They do not support replacing
rules/functions with arguments. To support that, we would need to take into
account the scenarios that would arise as a result of replacing the arguments
to the rule/function and the return value of the rule/function itself.
Fixes#517
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Sebastien de Menten