As of v1.10, the default service account does not have read access on
objects in other namespaces and cannot update configmaps in the active
namespace.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
There were a few other example values that included a data key so those
have been updated to align with #758.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The violations definition was trying to filter for public_servers that
are 'true'; but this would never happen as they are structures
themselves.
Signed-off-by: Juan Antonio Osorio Robles <jaosorior@redhat.com>
The example wrongly covered the servers, ports and networks keys under
the "data" key. It shouldn't have been that way (probably a typo?). So I
removed that.
Signed-off-by: Juan Antonio Osorio Robles <jaosorior@redhat.com>
The service authentication configuration docs were included inte token
scheme in the token value. If users configured OPA this way,
authentication would fail.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
There is still a need to improve the output of references to set docs
that include variables. In those cases, the expression value AND the
variable bindings are displayed. Only the bindings should be displayed.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The example was "true = false" which was doing an assignment which
couldn't be evaluated, this would return undefined, instead of "false"
which is what the docs indicate. This changes the doc to an appropriate
expression.
Signed-off-by: Juan Antonio Osorio Robles <jaosorior@redhat.com>
Due to the deprecation of the -e/--eval flag of the run command in
release 0.8, the Terraform tutorial is no longer accurate. This commit
updates the tutorial to use the new eval command which replaces the old
flag.
Signed-off-by: Brendan Devenney <brendan.devenney@cloudreach.com>
Previously, decision logs were kept in-memory and enabled via
diagnostics configuration. With these changes, admins can configure OPA
to log decisions to a remote HTTP endpoint.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This plugin complements the bundle download plugin by reporting status
to a remote HTTP server. The status includes identification labels
configured on OPA as well as the status of bundle download and
activation.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These chanages introduce a manifest to the bundle files. This way bundle
services can include metadata about the bundle in the file. The initial
use case for bundle data is keeping track of bundle revisions.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The initial implementation allowed for N bundles to be configured. While
this is more flexible, it introduces unnecessary complexity around
management (e.g., how do you know which bundle a decision was comoputed
from?) and performance (e.g., you would expect OPA to dedup data between
bundles.)
Moving to a single bundle DOES NOT prevent admins from bundling
multiple policies and data sets together.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
- Added HTTP request snippet
- JSON payload needs to be an array. sprintf requires an array
as second operand.
See server_test.go tests for data/system for reference
Signed-off-by: repenno <rapenno@gmail.com>
Tutorial now uses display and pull policies to request authorization context.
Separate policies for sudo and SSH have been merged into one for simplicity.
Signed-off-by: Yash Tewari <yashtewari1996@gmail.com>
The anchors made headers orange but were being used inconsistently.
Removing all manually added anchors for now. If we want to style the
headers, there should be a more reliable method.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The special font was causing the text to flicker on load. These changes
attempt to remove traces of the adobe font from the docs.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously, policies and data had to be pushed into OPA via the REST API
or loaded via command line arguments at startup.
With these changes, OPA can now be configured to pull down bundles of
policy and data from remote HTTP servers. When a bundle is downloaded
successfully, the policies and data are loaded out of the bundle file
and inserted into storage.
Fixes#421
removed blank line
updated test
added command info documentation
wrap the error messages
used buitin URL decode method
moved verify token code in tokens module
The v1.9 webhook support contains a bug that causes CONNECT operations
to fail. We can add the privileged exec example back once that's fixed.
Fixes#567
Torin Sandall