Currently OPA binds to the 0.0.0.0 interface by default, which allows
the OPA server to be exposed to services running outside of the same machine.
Though not inherently insecure in a trusted environment, it's good practice
to bind OPA to the localhost interface by default if OPA is not intended
to be exposed to remote services.
This change also adds a new feature flag to `opa run` to allow users to enable
future OPA compatible behavior.
Fixes: #6286
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
The schema of the input document for the authorization
policy is known to OPA. This feature leverages that
to perform automatic type checking on the authorization policy.
The checks happen on policies provided to OPA on start-up and
also those provided via bundles. This check is enabled by default
and can be disabled using the `--skip-known-schema-check` flag
on `opa run`. This feature will help catch errors such as
typos, mismatch types etc. in these policies and provide precise
feedback to the policy author.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
run: added addrSetByUser to check if addr flag has been set by the user or not returns a bool to rt.ParamsAddrSetByUser in initRuntime
run_test: updated tests as we pass a bool now to initRuntime, added a test to check that changing the addr flag returns the expected output
runtime: added AddrSetByUser boolean and updated the server initialization info message, if AddrSetByUser is false, it will append an info message to the server initialization
runtime_test: added a test that will check the message is correctly set depending on if AddrSetByUser is true or false
docs/content/security: added paragraph addressing the potential issues of binding opa to the 0.0.0.0 interface
Fixes#5090
Signed-off-by: Peter Macdonald <macdonald.peter90@gmail.com>
Currently when OPA's HTTP server rejects requests per
the authz policy, this is not accounted for via the management APIs.
This change adds that count in the metric registry that is
part of the Status API for more visibility.
Fixes: #3378
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
In https://github.com/open-policy-agent/opa/pull/5742 we added support
for more advanced authz policy. This PR updates the docs to explain how
to use this new functionality with a best-practice example based on
SPIFFE IDs.
Signed-off-by: Charlie Egan <charlie@styra.com>
Fixes#5521
The fix is adding `-sha256` to use SHA 256 digests for certificates
rather than SHA1. Since go 1.18, SHA1 is rejected by go TLS.
This PR also updates the tutorial to use ECDSA keys, reduces the
lifetimes of the certs used and updates the sample logs to match
what OPA and curl show today.
Signed-off-by: Charlie Egan <charlieegan3@users.noreply.github.com>
Signed-off-by: Charlie Egan <charlieegan3@users.noreply.github.com>
Co-authored-by: Charlie Egan <charlieegan3@users.noreply.github.com>
Change --tls-ca-cert-path to --tls-ca-cert-file since --tls-ca-cert-path
is not a valid option (and a typo)
Fixes: #4678
Signed-off-by: Krishna Pramod A <krishna.adharapurapu@rakuten.com>
This adds a new flag to `opa run`, intended for server usage with HTTPS listeners:
`--tls-cert-refresh-period`. If used with a positive duration, such as "5m" (5 minutes),
"24h", etc, the server will track the certificate and key files' contents. When their
content changes, the certificates will be reloaded.
On an error in reloading, it will log (info) the error and try again in the next round.
Fixes#2500.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Make sure that we try to follow our own recommended
best practices here. There's probably more inconsistencies
out there, but you've gotta start somewhere.
Also fixed a few indentation issues and typos along the way.
I skipped the Kafka tutorial as I'll be working on that
separately.
Signed-off-by: Anders Eknert <anders@eknert.com>
* Authorization policy with deny reason
Currently the authorization policy only returns boolean result. There
are no way to give more context to denied requests. This adds the ability
to policies to return a reason for denying the request.
Applying backward compatible policy evaluation logic.
Fixes#3056
Signed-off-by: Ajanthan Balachandran <balaajanthan@gmail.com>
* docs/security:: make object-response the extra, not the default; update tests
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Co-authored-by: Ajanthan Balachandran <balaajanthan@gmail.com>
This commit updates the server's basic authorizer to include the
deserialized message body in the input to the authorization policy so
that the latter can make decisions based on policy query input
documents. The authorizer caches the parsed message body on the
request context and the server retrieves the value to avoid parsing twice.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This adds a new config option for the OPA server (along with plumbing
from `opa run` downward to the server) to configure separate
diagnostic addresses to listen on. These will only be configured to
serve the /metrics and /health.
This will allow for more secure OPA deployments with the normal "data"
or "policies" API's made to be only accessible on localhost.
Fixes: #2002
Signed-off-by: Patrick East <east.patrick@gmail.com>
* Move the integration guide into the core docs. This is one of the
most common questions when people get started.
* Split the configuration and monitoring sections into their own
pages. This prepares the management page for an introduction that
explains the control plane concept.
* Move bundle section up to the top of the page since basic policy
distribution is usually the first concern.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Any links that were caught by the link checker have been
repaired. This also standardizes some to ensure we are
always using URLs with trailing `/` when possible.
Signed-off-by: Patrick East <east.patrick@gmail.com>
The docs have grown organically and it was time for a reorganization, specifically
helping people understand at a single glance the information
that is available in the docs.
The new docs are organized as follows:
- Core docs (policy and data)
- Use-case specific docs
- Operations
- Support
As part of the reorganization, several files were renamed and/or combined.
Also made an editing pass over what was previously the user-attribute docs
and generalized them to focus on data-replication, an issue that is
now promoted to the core docs. As part of that, updated the images
and removed the old ones; new image sources are in google slides.
Tweaked the navigation bar to give more space on the left-hand column
so that more of the topics are visible without scrolling.
Signed-off-by: Tim Hinrichs <tim@styra.com>
These changes update most of the docs to use live blocks. The
following pages have not been touched or updated significantly:
* Get Started - this page is based entirely on the REPL. We should
revisit the "Get Started" page once these changes have
landed. The existing page can live on as an introduction to the REPL
while the Get Started page can be tailored to live blocks.
* Ceph Authorization - this page has not been updated aside from
making the policy example use the live blocks for syntax
highlighting. We need to revisit the policy example and refactor the
tutorial a bit to emphasize the policy as opposed to the manifests
required to install.
* Terraform - this page has not been touched because @vgramer is
planning to update for Terraform v0.12. We can update this page once
those changes are in to avoid conflicts.
These changes also remove the use of non-Markdown code examples. All
the examples are inlined into Markdown now.
A few OPA deployment examples have been updated to enable the console
decision logging. This is better than the request/response debug logs.
Fixes#1650
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These changes update the server to include request headers in the
authorization input document.
Fixes#1456
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This commit renames the 'var' keyword to 'some'. 'some' is more
descriptive than 'var' and will better complement an 'every' or
'forall' keyword representing for universal quantifiers.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously the code content was only kept in master and was
Subsequently referenced by the versioned doc contents. This causes
A few problems.. so we will version it along with the doc content.
To get this to work we make a handful of changes:
* Move the docs up into just opa/docs/content/*, we’re going to remove
The difference between local/dev and production builds soon.
* Move the “code” directory into the content dir, it is content tied
To the markdown files already there.
* Change the Hugo config to ignore the code directories
* Change the “code” shortcode to load the versioned code snippet
* Change load-docs to copy the code directory in addition to the other
markdown content.
Signed-off-by: Patrick East <east.patrick@gmail.com>
Ashutosh Narkar