Currently OPA binds to the 0.0.0.0 interface by default, which allows
the OPA server to be exposed to services running outside of the same machine.
Though not inherently insecure in a trusted environment, it's good practice
to bind OPA to the localhost interface by default if OPA is not intended
to be exposed to remote services.
This change also adds a new feature flag to `opa run` to allow users to enable
future OPA compatible behavior.
Fixes: #6286
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Perhaps it looks prettier, but this is only reported in
JSON output, so I don't think we should decide on what
precision to use there.
On coverage < threshold error, we still print using 2
decimals, which is Pretty (tm).
Fixes#6307
Signed-off-by: Anders Eknert <anders@eknert.com>
Printing lines not covered when test coverage threshold isn't met for `opa test --threshold`, and `--verbose` flag is enabled.
Fixes: #2562
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
The schema of the input document for the authorization
policy is known to OPA. This feature leverages that
to perform automatic type checking on the authorization policy.
The checks happen on policies provided to OPA on start-up and
also those provided via bundles. This check is enabled by default
and can be disabled using the `--skip-known-schema-check` flag
on `opa run`. This feature will help catch errors such as
typos, mismatch types etc. in these policies and provide precise
feedback to the policy author.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
I have added a system for showing fatal and non-fatal deprecation warnings. It's configurable by command and environment.
If we merge this PR, running a rootless image with any OPA command other than `opa run` will result in a fatal error and exit code 1.
It's possible for users to continue to use the image by unsetting: OPA_DOCKER_IMAGE_TAG=rootless.
`opa run` will show the message, but it's not fatal for this command. This is intended to avoid production disruption.
Signed-off-by: Charlie Egan <charlie@styra.com>
Currently the namespace for partially evaluated files
in an optimized bundle cannot be modified. As a result
if more than one optimized bundle is loaded in OPA, a root
conflict error would occur as the optimized bundles have a
root called "partial" automatially added to their
manifest. This change allows the namespace to be configured via
the build command.
Fixes: #5933
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
* Waiting for output buffer to contain expected data rather than making exact matches on the entire content.
* Not aborting watcher on encountered errors
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
This
1. changes the extension.Handler type to make it more flexible
2. simplifies the extension usage -- it used to be called in many places,
but it could all be handled through util.Unmarshal and util.UnmarshalJSON
instead
We've previously marked it as "EXPERIMENTAL", so we should have enough
leeway to change this now.
NOTE: As a consequence of (2.), we're no longer accepting trailing data for
json files loaded with OPA. I believe it wasn't intentional to ignore bad data
before -- now, it'll be an error.
Signed-off-by: Stephan Renatus <stephan@styra.com>
Previously if a data file was removed those changes would not be reflected on the store and OPA would continue using old data to run the test. This change attempts to fix that.
Fixes: #5986
Signed-off-by: boranx <boran.seref@gmail.com>
Similar to the watch mode available in OPA when run as a server,
this change adds a watch mode in OPA test which
reloads the policy on file-system changes and re-runs the tests.
The watch mode in OPA test could be useful for example in TDD of
policies.
Fixes: #1719
Co-authored-by: Johan Fylling <johan.dev@fylling.se>
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
* test: Add --schema flag to opa test
* runner: added annotation/metadata reading for opa test
Fixes: #5923
Signed-off-by: Renato Cordeiro <renato@renatocordeiro.com>
Currently if OPA listens on a Unix socket, the socket
file is created with 755 permissions. So if OPA is deployed
on k8s for example and the socket path is shared
via a volume between pods, due to the default permissions,
the socket will not be reachable for the caller. One way around
this is to match the user id for the OPA and caller containers
but that is not always possible.
This change adds a new flag to the OPA runtime that allows
to configure the permission of the socket file. In the
k8s scenario, if the file permission is updated to 777
for instance, the caller will be able to connect to OPA via
the socket.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
The number of EVAL/REDO counts in the profile result
are sometimes difficult to understand. This is mainly due to the
fact that the compiler rewrites expressions and assigns the
same location to each generated expression and the profiler
keys the counters by the location. So users have no idea
that multiple expressions may be contributing to the profile
result for a given line in the policy.
This change attempts to provide more clarity to the profile
output by including the number of generated expressions for
each given expression thereby helping to better understand
the result and also how the evaluation works.
Fixes: #2552
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Prior to this commit, when the AST information
were serialized to JSON, rules expressed as
discussed in #5790 included only the location
of their value and not the one of the rule
ref var itself. Now the AST serialized to
JSON includes this information.
Fixes: #5790
Signed-off-by: Gianluca Oldani <oldanigianluca@gmail.com>
run: added addrSetByUser to check if addr flag has been set by the user or not returns a bool to rt.ParamsAddrSetByUser in initRuntime
run_test: updated tests as we pass a bool now to initRuntime, added a test to check that changing the addr flag returns the expected output
runtime: added AddrSetByUser boolean and updated the server initialization info message, if AddrSetByUser is false, it will append an info message to the server initialization
runtime_test: added a test that will check the message is correctly set depending on if AddrSetByUser is true or false
docs/content/security: added paragraph addressing the potential issues of binding opa to the 0.0.0.0 interface
Fixes#5090
Signed-off-by: Peter Macdonald <macdonald.peter90@gmail.com>
This commit fixes the index out of range error discussed in #5646 and adds error
handling to avoid that `fmt` panics when such errors are encountered by the formatter
The error handling procedure introduced is similar to the one used by the Scanner struct
responsible for the parsing of a `rego` file, since it uses a slice which is filled with
all the eventual errors that can be found during the format procedure
Fixes: #5646
Signed-off-by: Gianluca Oldani <oldanigianluca@gmail.com>
* ast: Enforce inlined schemas without --schemas flag
Enabled for commands:
* eval
* check
* test
Always parse annotations.
Always use `schemas` annotations with inlined schemas for type checking.
Ignore `schemas` annotations with schema refs if no `--schema` flag was provided.
Fixes: #5506
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
* Pruning METADATA blocks associated with Wasm compiled entrypoints from Rego source in bundle
* Adding metadata annotations to wasm entrypoint declarations in bundle .manifest file
* Reading metadata annotations from both Rego source and .manifest file in bundle during `inspect`
Fixes: #5588
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Using ground ref of rule when generating entrypoint from annotation
as variable in head suffix cannot be included in generated entrypoint path.
Fixes: #5577
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Fixing an issue where if a `rego.metadata.*` function is called in a rule, any present `schemas` annotation will be used to inform type checking, even if no `--schema` flag was used for the command.
Only commands that takes the `--schema` flag can now use the `schemas` annotation to inform type checking; i.e. `eval` and `check`.
Fixes: 5430
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Since this was unset on the compiler for -t plan, print
calls got erased from the plans. Since this is useful for
debugging plan execution, we should allow print in this
context. If undesired, this can still be disabled via
the capabilities feature.
Signed-off-by: Anders Eknert <anders@eknert.com>
This commit adds type coercion guards around the AST annotation
set building logic, to avoid panics when nil values appear.
Nil node values can happen here after copy-propagation, because
the AST nodes can be ripped out from under the annotation system
when they are pruned away or inlined into other rules.
Fixes: #5368
Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
Since `alg` has a default setting, we've gotten that error too often.
Follow-up to #5297 and #4972.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Currently the e2e bench mode doesn't support providing an
OPA configuration to enable features like decision logging
that can have an impact on the server overhead. This change
adds a new flag to the bench cmd to specify the OPA configuration.
Fixes: #4899
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Before, the capabilities were plumbled through in most places:
1. checking which builtins exist
2. passed along to the optimizer
3. passed along to the planner
But they hadn't been passed along to the file loader. As such, it could not
pass the caps along to the parser either. This is now done, but adding a new
method to the FileLoader interface.
Fixes#5323.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
And enable the `tenv` linter for the future.
Also, bump version of golangci-lint and fix some new
warnings that came from that.
Signed-off-by: Anders Eknert <anders@eknert.com>
Ashutosh Narkar