This commit adds a new configurable timeout to the Services
config to set the amount of time to wait for the server's
response headers. With this change, the client will no longer
wait indefinitely for the HTTP request to complete.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
The AWS v4 signing feature for bundle requests would automatically
add a `Host` header by using the URL hostname. This would break for
URLs that specified a port number (eg: https://127.0.0.1:9000/). That
causes issues with sending a valid request.
This commit changes to use the `URL.Host` which will have the full
`host:port` string, when a port was specified.
Fixes: #2568
Signed-off-by: Patrick East <east.patrick@gmail.com>
AWS_SESSION_TOKEN or AWS_SECURITY_TOKEN is required when signing AWS requests
using ENV credentials from IAM assumed role. Missing token
results with S3 403 error when trying to download bundle.
Signed-off-by: Kamil Piotrowski <kamil.piotrowski@nordcloud.com>
Earlier with discovery enabled, there was no protection against accidental
changes to the discovery service. This change prevents the discovery service
from being modified by checking it's config in the service bundle.
Fixes#2058
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Earlier with discovery enabled updates to the 'services' configuration
was not allowed to protect against accidental changes to the discovery service
itself. Since adding new services could be useful, this change allows modifications
to the 'services' configuration. The only exception is that the service used to download
the discovery bundle cannot be modified.
Fixes#2058
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This change updates the bearer token config to allow clients to specify
a path to the token. With this refreshing tokens becomes easier as OPA
will now reload the token from file.
Fixes#2241
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
It seems as though go 1.14 changes some of the url errors to have
quotes around some fields. To make things compatible across a wider
number of platforms we can relax the checks a tiny bit to only look
at the actual error string and ignore the quoted part.
Signed-off-by: Patrick East <east.patrick@gmail.com>
The HTTP client we were using for bundle downloads was being loaded
once and then re-used. This was problematic for users that configure
cert files and then have them change.
This updates the client wrapper in OPA to re-create the underlying
client for each request.
Fixes: #1898
Signed-off-by: Patrick East <east.patrick@gmail.com>
This can be overridden by custom header configuration for services,
or requests but will default to something like:
`Open Policy Agent/<version> (<os>, <arch>)`
This is set on all outbound requests for status, decision logs, bundle
and discovery downloads, http requests from policies, etc.
Signed-off-by: Patrick East <east.patrick@gmail.com>
When instantiating a http.Transport struct without providing non-zero
values for some of its fields, it will leak connections.
The docs hint at this (https://golang.org/pkg/net/http/#Transport):
By default, Transport caches connections for future re-use. This may
leave many open connections when accessing many hosts. This behavior
can be managed using Transport's CloseIdleConnections method and the
MaxIdleConnsPerHost and DisableKeepAlives fields.
See this issue for details: https://github.com/golang/go/issues/19620
I have not observed any leaks in the wild for this, but I'm also
not using this plugin. I came to fix this because I had recently
introduced a bug in the server tests -- they were altering the
settings for the global http.DefaultTransport when my intention
was to create a copy. Digging in while fixing that revealed this
other location. (The fix for the server tests is in the next commit).
Signed-off-by: Stephan Renatus <srenatus@chef.io>
* Fix typo in run short description
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
* Add support for specifying services as object
Previously the services configuration had to be specified as an array,
for example:
services:
- name: foo
url: https://example.com
In some cases, it's easier to structure the configuration as an object.
Specifically, the Helm package manager does not allow you to override
values nested under arrays. These changes allow the services
configuration to be structured as an object:
services:
foo:
url: https://example.com
Ref: https://github.com/helm/helm/issues/1987
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Adds support for usings client certificates to authenticate against
service endpoints. It also enables users to allow insecure TLS
connections to service endpoints.
Fixes#684
Signed-off-by: Kim Christensen <kimworking@gmail.com>
Previously, policies and data had to be pushed into OPA via the REST API
or loaded via command line arguments at startup.
With these changes, OPA can now be configured to pull down bundles of
policy and data from remote HTTP servers. When a bundle is downloaded
successfully, the policies and data are loaded out of the bundle file
and inserted into storage.
mikaelcabot