I have removed the references to the regular meetings, but also made a
number of other updates to this page to make it clear where we need help
and how to get started.
Signed-off-by: Charlie Egan <charlie@styra.com>
In addition to the vendor update, a test case was updated to account for a
prometheus change where the Content-Encoding header is unset if data is uncompressed.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
And automatically change implied `scope` from `rule` to `document` when
no `scope` is provided (on rule metadata).
Fixes#6798
Signed-off-by: Anders Eknert <anders@styra.com>
Fixing issue where ref-head rules could put evaluation result scoped by call-site ref unification into global virtual-cache, which would later erroneously be read by ref to same rule/virtual document but with different "unification scope".
Fixes: #6926
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
Just an idea, if we ever introduce an
import awesome
and people start receiving "unknown import" errors on outdated
OPA versions, they'll at least give a hint.
This could be extended to cover the other synthetic imports, like
`rego.*` and `future.*`, but it's a start...
Signed-off-by: Stephan Renatus <stephan@styra.com>
In Windows there are some reserved characters that cannot be used in the names
of files and directories (eg. ?, *). If a bundle name contains these and if it's
configured to be persisted, the operation will fail on Windows. This change attempts
to fix this on Windows systems by escaping any encountered reserved characters before
using them in the bundle persistence path.
Fixes: #6915
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Adding a resource map to the distributed_tracing
config. Entries in this map will be passed through to the OpenTelemetry SDK where they will be
added as resource attributes. The available resource attributes are service.namespace,
service.version and service.instance.id. see
https://opentelemetry.io/docs/specs/semconv/resource/Fixes: #6492
Signed-off-by: Brett McBride <brett@deakin.edu.au>
Previously the HTTP request context was included in the
request context at the info access log level. This means
if the access log level was set to error for instance,
the context would not include the http request context and
hence it would not be surfaced via decision logs.
This change always add the http request context to the request
context so that HTTP info like headers will be surfaced via decision
logs irrespective of the access log level.
Fixes: #6951
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
The CodeQL workflow uploads the results to GitHub so it
needs a write value on the contents permission.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
It wasn't obvious when configuring the inter-query cache might be needed, as
it wasn't mentioned which built-in made use of it.
Also fixed the docs on annotations where it said `scope` only applies to
`schemas`.
Signed-off-by: Anders Eknert <anders@styra.com>
This commit fixes an issue related to zero-sized bundles being saved to disk,
which can cause OPA to fail to start if a remote OCI repository is unavailable.
Fixes: #6939
Signed-off-by: Sergey-Kizimov <serget.kizimov@hiya.com>
Just a small improvement from looking into #6946
This doesn't necessarily solve all issues reported there, but I figured
I might as well commit this anyway.
Signed-off-by: Anders Eknert <anders@styra.com>
When the JSON option to include term locations have been set, they should be
included in all parts of the head where terms appear.
Fixes#6860
Signed-off-by: Anders Eknert <anders@styra.com>
If a UNC path is provided to OPA it won't read it
and instead return an error. This applies to paths
to load bundles and individual data/policy files.
One reason behind blocking UNC paths is they could
trigger a NTLMv2 hash leak. For example, if a SMB share
is provided, OPA will attempt to open it triggering LLMNR
queries which contain the client's NTLMv2 hash which can be cracked
using some tools. This could be exploited by a malicious user.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Fixes https://github.com/open-policy-agent/opa/issues/6925
This change modifies the `io.jwt.encode_sign` built-in to marshal the
parameters as JSON before signing the JWT. The previous implementation
was using String(), which was a sort of pseudo-JSON that was almost
correct but used the wrong JSON syntax for the set type.
I have chosen to marshal the headers in the same way as the payload as
the 'crit' header can also be an array type. I marshal the signature the
same way for consistency with the other two.
Signed-off-by: Charlie Egan <charlie@styra.com>
This change attempts to fix a race condition that could occur
when a reconfiguration on the bundle plugin occurs in parallel
with the activation of a downloaded bundle.
One scenario where this could occur is when the discovery plugin
attempts to reconfigure the bundle plugin and concurrently a bundle gets
downloaded and needs to be activated. A reconfig operation will perform
a write on the plugin's config. During a bundle activation, the plugin's
config is read. Currently we hold a lock when the config is being updated.
This change locks the config while reading thereby avoiding the race.
Fixes: #6849
Co-authored-by: Pushpalanka Jayawardhana <pushpalanka.jayawardhana@zalando.de>
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This was never supported, and the flag is thus confusing. Since the
only supported format is "json" (the default), the flag is redundant
now. However, I've kept it so if someone uses `opa exec --format=json`
somewhere, their calls won't become invalid.
If someone had been using `opa exec --format=pretty`, they will now
see an error, but I think that's less confusing: pretty formatting
is just not supported for 'opa exec'.
Signed-off-by: Stephan Renatus <stephan@styra.com>
Correct typ of port in the MeshConfig for extensionProviders and add section about Meshconfig's service value
Signed-off-by: Pindar <131621+Pindar@users.noreply.github.com>
This commit fixes a request handling bug introduced in #6868, which
caused OPA to treat all incoming chunked requests as if they had
zero-length request bodies.
The fix detects cases where the request body size is unknown in the
DecodingLimits handler, and propagates a request context key down to
the `util.ReadMaybeCompressedBody` function, allowing it to correctly
select between using the original `io.ReadAll` style for chunked
requests, or the newer preallocated buffers approach (for requests of
known size).
This change has a small, but barely visible performance impact for large
requests (<5% increase in GC pauses for a 1GB request JSON blob), and
minimal, if any, effect on RPS under load.
Fixes: #6904
Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
Support loading credentials from the AWS_CONTAINER_CREDENTIALS_FULL_URI
metadata endpoint which is helpful for AWS SnapStart lambdas
Fixes#6893
Signed-off-by: Matthew Bamber <mattb@grabyo.com>
Johan Fylling