The SDK support is there for many languages now and these
are likely a preferred way to use OPA's REST API for many
application developers.
This PR adds some links to make sure these are featured in
suitable locations so they are not missed as people browse
the docs.
Signed-off-by: Charlie Egan <charlie@styra.com>
* docs: Use Example field for alternative commands
This makes it safer to process this text into markdown and other
formats. (<path> is tricky as it looks like an HTML tag.
Signed-off-by: Charlie Egan <charlie@styra.com>
* docs: update CLI docs
Signed-off-by: Charlie Egan <charlie@styra.com>
---------
Signed-off-by: Charlie Egan <charlie@styra.com>
In the OPA ecosystem, there are a number of language SDKs for different
general purpose languages, mostly integrating with the REST API. This PR
highlights these at the start of the OPA ecosystem page, adds some other
projects for completeness and clarifies the owner where more than one
SDK for a language exists.
Signed-off-by: Charlie Egan <charlie@styra.com>
Prometheus appears to have dropped the `go_memstats_gc_cpu_fraction`
metric, since at least Go 1.18. This commit drops the missing metric
from the table of expected metrics for OPA on the monitoring docs page.
Reference: https://github.com/prometheus/client_golang/issues/1500Fixes: #6783
Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
It would be useful if users had the ability to enhance the
decision log with info from the incoming HTTP request such as
headers. This change allows users to configure headers whose
values if present in the incoming HTTP request would be
surfaced via the decision log. This can be extended in the
future to include more context from the request.
Fixes: #6693
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Previously if Discovery was enabled, other features like bundle downloading and status reporting could not be configured manually.
The reason for this was to prevent OPAs being deployed that could not be controlled through discovery. It's possible that
the system serving the discovered config is unaware of all options locally available in OPA. Hence, we relax the configuration
check when discovery is enabled so that the bootstrap configuration can contain plugin configurations. In case of conflicts,
the bootstrap configuration for plugins wins. These local configuration overrides from the bootstrap configuration are included
in the Status API messages so that management systems can get visibility into the local overrides.
**In general, the bootstrap configuration overrides the discovered configuration.** Previously this was not the case for all
configuration fields. For example, if the discovered configuration changes the `labels` section, only labels that are
additional compared to the bootstrap configuration are used, all other changes are ignored. This implies labels in the
bootstrap configuration override those in the discovered configuration. But for fields such as `default_decision`, `default_authorization_decision`,
`nd_builtin_cache`, the discovered configuration would override the bootstrap configuration. Now the behavior is more consistent
for the entire configuration and helps to avoid accidental configuration errors.
Fixes: #5722
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Let me know if these should be in a box of their own — my reasoning
was that they should be avoided even prior to that, so if people won't
use them as var names or whatever, all the better.
Signed-off-by: Anders Eknert <anders@eknert.com>
The service name used for signing the request must be same as
the host header which is of the form https://sts.*
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Adds support for signing AWS requests using temporary credentials
obtained from AWS STS via AssumeRole operation. One use-case of
this mechanism is for allowing existing IAM users to access AWS resources
that they don't already have access to. It is also useful as a means to
temporarily gain privileged access.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This commit adds a `--timeout` duration flag to the `opa exec` CLI command.
This flag helps out in use cases such as CI, where stalling indefinitely
is undesirable behavior.
Fixes: #6613
Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
To support uses cases where OPA is used for signing s3 requests whose payload is
not known upfront or payload is big enough (big file upload) to be sent over wire,
this PR adds support for unsigned payloads.
AWS signer has configurable option to use unsigned payload where the
x-amz-content-sha256 is set to "UNSIGNED-PAYLOAD" and is included as part
of signing process. This PR provides an option for unsigned payload if
aws_config.disable_payload_signing is set to true. If payload signing is
disabled, SignV4 method will not compute the content sha from the request body
but instead use "UNSIGNED-PAYLOAD" string literal for x-amz-content-sha256
header during signature computation.
References:
https://docs.aws.amazon.com/AmazonS3/latest/API/sig-v4-header-based-auth.htmlhttps://docs.aws.amazon.com/AmazonS3/latest/API/sigv4-auth-using-authorization-header.html
Signed-off-by: Prasanth Jayachandran <p_jayachandran@apple.com>
This change updates the description of how the url path is used
to access values inside object and array documents. For data patch
operations, the description was updated to reflect the implementation.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This is a recognized content type now, so no need for the x prefix.
I also fixed some language in the doc while at it.
Signed-off-by: Anders Eknert <anders@eknert.com>
cli-docs-updater