Currently OPA binds to the 0.0.0.0 interface by default, which allows
the OPA server to be exposed to services running outside of the same machine.
Though not inherently insecure in a trusted environment, it's good practice
to bind OPA to the localhost interface by default if OPA is not intended
to be exposed to remote services.
This change also adds a new feature flag to `opa run` to allow users to enable
future OPA compatible behavior.
Fixes: #6286
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Drop `EXPERIMENTAL` status of metrics reported via
Prometheus in Status API. OPA's maintained these for a while
now and there's no 3rd party dependency required to support these.
Fixes: #6298
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
http_request_duration has fixed, hardcoded number of buckets with no possibility to tweak them
For cases when the most of the latencies are above 1ms, with only 4 available buckets there's no good insight on OPA's performance.
This implementation:
- adds the possibility for the buckets to be configurable in ```server.metrics.prom.http_request_duration_seconds.buckets``` key
- it's not a breaking change, if the buckets are not present in the configuration, the metric is configured with the existing values as a fallback
Signed-off-by: aarnautu <aarnautu@adobe.com>
When an object in GCS contains special characters such as slashes (/) these
need to be url-encoded in the configuration. If not, the bundle will not be found.
e.g. `bundles/bundle.tar.gz` should be entered as `bundles%2fbundle.tar.gz`
This PR adds a small note to help the reader know about this.
Signed-off-by: Dennis Geurts <dennisg@dennisg.nl>
The schema of the input document for the authorization
policy is known to OPA. This feature leverages that
to perform automatic type checking on the authorization policy.
The checks happen on policies provided to OPA on start-up and
also those provided via bundles. This check is enabled by default
and can be disabled using the `--skip-known-schema-check` flag
on `opa run`. This feature will help catch errors such as
typos, mismatch types etc. in these policies and provide precise
feedback to the policy author.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
* Adding support for multiple variables at arbitrary locations in rule refs
* Updating type-checker to handle general ref heads
Fixes: #5993Fixes: #5994
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
* We are having trouble managing the complexity of having ecosystem pages shown in the versioned area of the OPA docs site (see website: link ecosystem from edge #6170)
* We have invested in the OPA ecosystem data recently and it makes sense to make it more prominent.
* The data in the OPA Ecosystem is harder to use when nested in docs as some Hugo functions are unavailable to nested sections.
This PR implements a solution by:
* Pages that were under /docs/version/ecosystem, /docs/version/integrations etc have been moved to /ecosystem and /integrations.
* Redirects have been created for the old pages in the netlify config.
Signed-off-by: Charlie Egan <charlie@styra.com>
This PR makes it possible to browse integrations, organizations and related softwares. Previously, these details were only available as modals on the ecosystem page.
There are also some changes to the policy enforcement on the docs content, the validation rules are much the same but have been updated to reflect that the content is stored in a new place. I have used some generated JSON in Hugo rather than using GitHub api requests to validate the files since it's A) faster, B) I think more simple, and C) easier to get Hugo to process the markdown frontmatter.
Much of the hackery in this PR (Hugo function partials to look up sets of files and get the data from them) is due to the fact that we can't use Hugo's native sections feature. All of our content is nested under docs, this means that all our pages are in the same section so custom lookups have been implemented as function partials instead to work around this.
Signed-off-by: Charlie Egan <charlie@styra.com>
The tutorial now uses kind as well as updated versions for envoy.
I have made some adjustments to how the bundle is served and the test
commands run to exercise the policy too.
Signed-off-by: Charlie Egan <charlie@styra.com>
* [docs/website] Link to OPA Ecosystem from docs
This PR makes the following changes to the website Ecosystem content and
linking:
* Creates and assigns categories to various projects where information
is available.
* Displays top level categories on Ecosystem page
* Links to categories from various relevant locations within the docs.
* Embeds related Ecosystem projects at the ends of some docs pages where
there are fewer than 6 and all have related content to the page in
question.
* Implements Hugo partials and shortcodes to make this extensible in
future.
* Updates to ecosystem projects to keep them current
* Adds various, previously unlisted, OPA ecosystem projects
Signed-off-by: Charlie Egan <charlie@styra.com>
Before this change, if a discovery bundle didn't contain configuration
for `persistence_directory`, this would be deleted from the manager's
configuration. When enabling persistence of the discovery bundle this
doesn't make much sense, as the first discovery bundle would erase the
persistence settings.
This change ensures that discovery never erases `persistence_directory`.
Signed-off-by: Benjamin Nørgaard <mail@blacksails.dev>
Standard OPA images are based on cc-dynamic from Chainguard Images:
https://github.com/chainguard-images/images/blob/main/images/cc-dynamic/README.md
(now deprecated, see: https://github.com/open-policy-agent/opa/issues/6037)
This image doesn't include tzdata.
Our static images however are based on static.
https://github.com/chainguard-images/images/blob/main/images/static/README.md
This build includes tzdata:
https://github.com/chainguard-images/images/blob/main/images/static/configs/latest.apko.yaml#L8
How to see this:
```
$ docker run -it openpolicyagent/opa:0.53.1-static eval 'time.clock([time.now_ns(), "Asia/Shanghai"])'
{
"result": [
{
"expressions": [
{
"value": [
17,
54,
3
],
"text": "time.clock([time.now_ns(), \"Asia/Shanghai\"])",
"location": {
"row": 1,
"col": 1
}
}
]
}
]
}
$ docker run -it openpolicyagent/opa:0.53.1 eval 'time.clock([time.now_ns(), "Asia/Shanghai"])'
{}
```
How to test this change:
```
make ci-build-linux ci-build-linux-static
make image-quick-amd64
docker run -it openpolicyagent/opa:0.54.0-dev eval 'time.clock([time.now_ns(), "Asia/Shanghai"])'
docker run -it openpolicyagent/opa:0.54.0-dev-static eval 'time.clock([time.now_ns(), "Asia/Shanghai"])'
```
You should see that both images provide the expected output. This shows
that `time/tzdata` is being used in the non-static image as expected.
These steps will not work as expected on main.
Signed-off-by: Charlie Egan <charlie@styra.com>
When http.send reaches out to the server if an
entry is not found in the cache or a stale entry
needs to revalidated, a network error while
calling the server will result in http.send recording
the error in the cache. It may sometimes be useful to
retry the request in case of intermittent failures etc.
This change adds a new option to the http.send input
object which allows policy authors to specify a retry count
for executing a HTTP request. Retries are performed with
an exponential backoff delay.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This commit fixes several memory leaks in the WASM engine that occur
when a caller mixes incremental calls to opa_value_path_add() /
opa_value_path_remove() with actual policy evaluations. The issue
occurs due to a combination of lack of deep free of internal data
structures and the fact that eval() and opa_eval() calls reset the heap
to free temporary memory that they previous allocated.
More details about the issues and their fix are described in detail at
https://github.com/open-policy-agent/opa/issues/5785.
The changes in this patch fall into 5 categories:
1. Adding support for both internal WASM functions and external WASM
callers to perform a "deep" free of OPA values by freeing not only
the immediate object memory but all the opa values it refers to.
The opa_value_free() function now does this by default and is
also an exported function. The opa_value_free_shallow() is added
for the few cases where shallow frees are required, primarily in
eval()-invoked functions.
2. Enable stashing of free blocks prior to eval() and opa_eval() calls.
Eval calls will always leak free blocks due to the way that
opa_heap_ptr_get() works. This patch adds three new exports allowing
the user to save this memory from leaking.
* opa_heap_blocks_stash() -- saves free heap blocks to shadow
freelists.
* opa_heap_blocks_restore() -- restores the allocated heap blocks from
shadow freelists.
* opa_heap_stash_clear() -- discard any saved heap blocks on the shadow
freelists. (this is used for resetting VM heap to an initial state)
3. Update the WASM calling conventions in the SDK. This includes using
the new APIs to avoid leaking memory when adding or removing data
from the data doc. It requires bumping the WASM ABI to 1.3
4. Adding unit tests for the WASM ABI 1.3 functions.
5. Adding documenttion for the WASM ABI 1.3 functions.
Fixes: #5785
Signed-off-by: Chris Telfer <chris.telfer@sophos.com>
This change addresses solutions 2) and 3) of the related issue #5553.
It mainly starts using the (now exposed) `Config.AuthPlugin()` function
of the `rest` package in the `download.OCIDownloader`. This allows it
to use any `HTTPAuthPlugin` that is defined in the `Config.Credentials`
section and makes it much more consistent with behavior of the
`download.Downloader` and potential other uses of the rest package.
Fixes#5553
Signed-off-by: DerGut <jannik.steinmann@gmx.de>
The number of EVAL/REDO counts in the profile result
are sometimes difficult to understand. This is mainly due to the
fact that the compiler rewrites expressions and assigns the
same location to each generated expression and the profiler
keys the counters by the location. So users have no idea
that multiple expressions may be contributing to the profile
result for a given line in the policy.
This change attempts to provide more clarity to the profile
output by including the number of generated expressions for
each given expression thereby helping to better understand
the result and also how the evaluation works.
Fixes: #2552
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
cli-docs-updater