Due to the deprecation of the -e/--eval flag of the run command in
release 0.8, the Terraform tutorial is no longer accurate. This commit
updates the tutorial to use the new eval command which replaces the old
flag.
Signed-off-by: Brendan Devenney <brendan.devenney@cloudreach.com>
Previously, decision logs were kept in-memory and enabled via
diagnostics configuration. With these changes, admins can configure OPA
to log decisions to a remote HTTP endpoint.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This plugin complements the bundle download plugin by reporting status
to a remote HTTP server. The status includes identification labels
configured on OPA as well as the status of bundle download and
activation.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
These chanages introduce a manifest to the bundle files. This way bundle
services can include metadata about the bundle in the file. The initial
use case for bundle data is keeping track of bundle revisions.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The initial implementation allowed for N bundles to be configured. While
this is more flexible, it introduces unnecessary complexity around
management (e.g., how do you know which bundle a decision was comoputed
from?) and performance (e.g., you would expect OPA to dedup data between
bundles.)
Moving to a single bundle DOES NOT prevent admins from bundling
multiple policies and data sets together.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
- Added HTTP request snippet
- JSON payload needs to be an array. sprintf requires an array
as second operand.
See server_test.go tests for data/system for reference
Signed-off-by: repenno <rapenno@gmail.com>
Tutorial now uses display and pull policies to request authorization context.
Separate policies for sudo and SSH have been merged into one for simplicity.
Signed-off-by: Yash Tewari <yashtewari1996@gmail.com>
The anchors made headers orange but were being used inconsistently.
Removing all manually added anchors for now. If we want to style the
headers, there should be a more reliable method.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The special font was causing the text to flicker on load. These changes
attempt to remove traces of the adobe font from the docs.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously, policies and data had to be pushed into OPA via the REST API
or loaded via command line arguments at startup.
With these changes, OPA can now be configured to pull down bundles of
policy and data from remote HTTP servers. When a bundle is downloaded
successfully, the policies and data are loaded out of the bundle file
and inserted into storage.
Fixes#421
removed blank line
updated test
added command info documentation
wrap the error messages
used buitin URL decode method
moved verify token code in tokens module
The v1.9 webhook support contains a bug that causes CONNECT operations
to fail. We can add the privileged exec example back once that's fixed.
Fixes#567
Previously OPA only tracked query performance a high level (e.g., parse,
compile, eval latencies.) In some cases, it's necessary to instrument
lower level evaluation operations to understand performance. These
changes update the eval implementation to support instrumentation:
* Eval has been instrumented to record time taken for various core
operations like term plugging, reading from the store, rule lookup,
cache hits, etc.
* Rego package has been updated to support a simple rego.Instrument
operation that enables query instrumentation.
* REPL and server have been updated to expose simple interfaces to turn
on instrumentation.
* Diagnostic policy config "all" will enable instrumentation.
Instrumentation can be expensive (because it requires timing frequently
executed operations) so it should be treated as a debugging tool and not
enabled all of the time.
These changes expose the partial evaluation optimization through the
HTTP API. Clients can request the optimization by including a query
parameter and the server will lazily run partial evaluation and keep a
cache of the results for subsequent queries.
Torin Sandall