Only topdown can make sense of rules and comprehension indices, so Wasm and any
eval plugins should instruct the compiler to avoid that work.
Signed-off-by: Stephan Renatus <stephan@styra.com>
Adding `future.compat` import for enforcing strict-mode checks and additional `1.0` behavior for the module.
Fixes: #6247
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
The `hub` tool is deprecated in favor of the GitHub CLI and
is removed from GitHub's action runner images.
Fixes: #6326
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Currently OPA binds to the 0.0.0.0 interface by default, which allows
the OPA server to be exposed to services running outside of the same machine.
Though not inherently insecure in a trusted environment, it's good practice
to bind OPA to the localhost interface by default if OPA is not intended
to be exposed to remote services.
This change also adds a new feature flag to `opa run` to allow users to enable
future OPA compatible behavior.
Fixes: #6286
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This is especially nice for functions doing pattern matching on
equality in its arguments.
Previously, we'd rewrite:
```rego
f(1)
```
into
```rego
f(1) = true
```
Now, we'll leave the shorter form alone, while still respecting
explicit assignment, using either `=` or `:=`.
Signed-off-by: Anders Eknert <anders@eknert.com>
In OPA versions older than 0.56.0, a recursion cycle could be hidden to the compiler if partial-object rules were "properly" organized. Adding regression test to cover this case.
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Perhaps it looks prettier, but this is only reported in
JSON output, so I don't think we should decide on what
precision to use there.
On coverage < threshold error, we still print using 2
decimals, which is Pretty (tm).
Fixes#6307
Signed-off-by: Anders Eknert <anders@eknert.com>
The partial query parameter has been marked as deprecated since
v0.23.0. It's also removed from the docs since that time.
Fixes: #2266
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
To fix#6292 issue which leads to inconsistent dependencies when used wit otel library.
Fixes#6292.
Signed-off-by: Sidharthan Kamaraj <csidharthank@gmail.com>
Signed-off-by: Sidharthan Chandrasekaran Kamaraj <csidharthank@gmail.com>
Drop `EXPERIMENTAL` status of metrics reported via
Prometheus in Status API. OPA's maintained these for a while
now and there's no 3rd party dependency required to support these.
Fixes: #6298
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
http_request_duration has fixed, hardcoded number of buckets with no possibility to tweak them
For cases when the most of the latencies are above 1ms, with only 4 available buckets there's no good insight on OPA's performance.
This implementation:
- adds the possibility for the buckets to be configurable in ```server.metrics.prom.http_request_duration_seconds.buckets``` key
- it's not a breaking change, if the buckets are not present in the configuration, the metric is configured with the existing values as a fallback
Signed-off-by: aarnautu <aarnautu@adobe.com>
Currently if a fsnotify watcher is specified for a particular
directory, we incorrectly also add it's parent directory to
be monitored. This happens because the function that determines
which paths are to be watched calls `filepath.Dir` on each of them
to get their directory. This is the right thing to do for files
as their parent directory gets watched, but when done on a directory
especially for the top-level directory adds an incorrect directory
to be watched. This changes attempts to fix that.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Printing lines not covered when test coverage threshold isn't met for `opa test --threshold`, and `--verbose` flag is enabled.
Fixes: #2562
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
We do a lot of `walk`-ing in [Regal](https://docs.styra.com/regal).
So much that it's by far the single most expensive operation. That means
any optimization of the `walk` built-in function will be a win for us.
Seeing as we rarely make use of the `path` component when `walk`-ing
through AST inputs, I was curious to see if there was any optimization
we could take when the path is a wildcard assignment, and as such clearly
marked as unimportant. Turns out there is. Since the return value is
provided in the operators list, we can check the value provided for the
`path` part of the assigned array, and if it's a wildcard (`_`) skip
path construction entirely. Example:
```rego
walk(input, [_, value])
```
This greatly simplifies the walk, and the performance gains are
substantial. Traversing a ~7MB AST:
**main**
```shell
$ opa bench -d p.rego -i objects.json data.p.w
+-------------------------------------------+---------------+
| samples | 6 |
| ns/op | 168806625 |
| B/op | 197364318 |
| allocs/op | 3855327 |
| histogram_timer_rego_query_eval_ns_75% | 169968114 |
| histogram_timer_rego_query_eval_ns_90% | 170513459 |
| histogram_timer_rego_query_eval_ns_95% | 170513459 |
| histogram_timer_rego_query_eval_ns_99% | 170513459 |
| histogram_timer_rego_query_eval_ns_99.9% | 170513459 |
| histogram_timer_rego_query_eval_ns_99.99% | 170513459 |
| histogram_timer_rego_query_eval_ns_count | 6.00 |
| histogram_timer_rego_query_eval_ns_max | 170513459 |
| histogram_timer_rego_query_eval_ns_mean | 168789611 |
| histogram_timer_rego_query_eval_ns_median | 168924020 |
| histogram_timer_rego_query_eval_ns_min | 166685000 |
| histogram_timer_rego_query_eval_ns_stddev | 1239390 |
+-------------------------------------------+---------------+
```
**no-path-walk**
```shell
$ opa bench -d p.rego -i objects.json data.p.w
+-------------------------------------------+--------------+
| samples | 21 |
| ns/op | 50629984 |
| B/op | 38018790 |
| allocs/op | 1025211 |
| histogram_timer_rego_query_eval_ns_75% | 51239562 |
| histogram_timer_rego_query_eval_ns_90% | 51540933 |
| histogram_timer_rego_query_eval_ns_95% | 51674420 |
| histogram_timer_rego_query_eval_ns_99% | 51688208 |
| histogram_timer_rego_query_eval_ns_99.9% | 51688208 |
| histogram_timer_rego_query_eval_ns_99.99% | 51688208 |
| histogram_timer_rego_query_eval_ns_count | 21.0 |
| histogram_timer_rego_query_eval_ns_max | 51688208 |
| histogram_timer_rego_query_eval_ns_mean | 50611103 |
| histogram_timer_rego_query_eval_ns_median | 50871459 |
| histogram_timer_rego_query_eval_ns_min | 49518833 |
| histogram_timer_rego_query_eval_ns_stddev | 748688 |
+-------------------------------------------+--------------+
```
The real-world impact is not as dramatic, since we aren't *just*
walking, but normally need to actually **do** something with the
values returned, but consistently shaving off about 13% eval time
when linting one of the largest policy libraries isn't bad at all:
**Regal main**
```shell
go run main.go lint ~/tmp/kics/assets 162.16s user 6.04s system 593% cpu 28.362 total
```
**Regal walk-no-path**
```shell
go run main.go lint ~/tmp/kics/assets 145.51s user 5.01s system 597% cpu 25.176 total
```
Signed-off-by: Anders Eknert <anders@eknert.com>
Currently for arithmetic operations like addition, subtraction etc.
the operands are first converted to the big float type before operating on
them. This conversion can be avoided for small numbers w/o impacting
the accuracy of the result. This change attemtps to avoid the conversion
for small numbers by caching them and thereby helping to speedup some operations.
Fixes: #6021
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
When an object in GCS contains special characters such as slashes (/) these
need to be url-encoded in the configuration. If not, the bundle will not be found.
e.g. `bundles/bundle.tar.gz` should be entered as `bundles%2fbundle.tar.gz`
This PR adds a small note to help the reader know about this.
Signed-off-by: Dennis Geurts <dennisg@dennisg.nl>
This test case exercises the scenario when a bundle is being written
to the store (ie. active write transaction) and the OPA server handling
a policy eval request at the same time. The former should not block
the later.
Fixes: #4792
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
* [docs] Use links on support page
Previously JS was used to trigger navigation. Since the cursor hadn't
been updated, it wasn't clear that the boxes were clickable.
Signed-off-by: Charlie Egan <charlie@styra.com>
* Remove on-click event
Signed-off-by: Charlie Egan <charlie@styra.com>
---------
Signed-off-by: Charlie Egan <charlie@styra.com>
OPA supports multiple AWS authentication methods. Currently
on an unsuccessful authentication, OPA logs the error at the debug
level. It would be helpful especially in a prod env to surface these
errors via the Status API to assist with debugging issues. This change
attempts to achieve that.
Fixes: #6232
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Fixing issue where strict-mode would only see the last var in a rule head's ref as used,
if that var is assigned in the rule body but only used in the ref.
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
It's unlikely that anyone is looking at the results when there's a
fresh run's results (of Sunday) awaiting you on Monday.
Signed-off-by: Stephan Renatus <stephan@styra.com>
dependabot[bot]