ewilliams28/releases
1
0
Fork 0
mirror of https://github.com/open-policy-agent/opa.git synced 2026-08-13 03:42:35 -06:00
Code Issues Packages Projects Releases Wiki Activity
5,123 Commits 45 Branches 221 Tags
f37b5ccbc23a3c8bb81ebd29083250da35f4a60b
Commit Graph

5123 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Tyler Schade f37b5ccbc2 cmd+bundle: Add --follow-symlinks flag to include symlinked files when building bundles (#6800) 
Signed-off-by: Tyler Schade <tyler.schade@solo.io>
 2024-07-02 15:10:18 +02:00
Sven Grosen e2721d3e01 Resurrect Workload Identity Work (#6802) 
Add support for using Azure Workload Identity authentication.

Signed-off-by: Sven Grosen <svengrosen@gmail.com>
 2024-07-01 20:02:06 +02:00
Charlie Egan 46b19707e7 docs: Use Example field for alternative commands (#6837) 
* docs: Use Example field for alternative commands

This makes it safer to process this text into markdown and other
formats. (<path> is tricky as it looks like an HTML tag.

Signed-off-by: Charlie Egan <charlie@styra.com>

* docs: update CLI docs

Signed-off-by: Charlie Egan <charlie@styra.com>

---------

Signed-off-by: Charlie Egan <charlie@styra.com>
 2024-07-01 10:36:39 +01:00
Johan Fylling b5172db03b Prepare v0.67.0 development (#6835) 
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2024-06-27 16:32:00 +02:00
Johan Fylling 91348a8ccc Prepare v0.66.0 release (#6834) 
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
v0.66.0 		2024-06-27 16:16:32 +02:00
Philip Conrad 4e01537fe7 server/authorizer: Fix gzip payload handling. (#6825) 
This PR fixes an issue where an OPA running authorization policies would
be unable to handle gzipped request bodies.

Example OPA CLI setup:

    opa run -s --authorization=basic

Example request:

    echo -n '{}' | gzip | curl -H "Content-Encoding: gzip" --data-binary @- http://127.0.0.1:8181/v1/data

This would result in unhelpful error messages, like:

```json
{
  "code": "invalid_parameter",
  "message": "invalid character '\\x1f' looking for beginning of value"
}
```

The cause was that the request body handling system in the
`server/authorizer` package did not take gzipped payloads into
account. The fix was to borrow the gzip request body handling function
from `server/server.go`, to transparently decompress the body when
needed.

Fixes: #6804

Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
 2024-06-27 09:55:19 +02:00
Johan Fylling c2cede76b3 ast: expanding nested expressions in every domain (#6832) 
Fixes: #6790
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2024-06-26 19:45:49 +02:00
cli-docs-updater cb77956ed3 docs: Update generated CLI docs 2024-06-26 13:55:59 +00:00
Johan Fylling e50a3061f5 cmd/exec: Supporting simultaneous input from stdin and files (#6831) 
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2024-06-26 15:54:01 +02:00
cli-docs-updater 5647253da1 docs: Update generated CLI docs 2024-06-26 13:06:38 +00:00
Colin J Lacy 96800d747b cmd/exec: adds --stdin-input (-I) flag for input piping or manual entry (#6822) 
Signed-off-by: Colin Lacy <colinjlacy@gmail.com>
 2024-06-26 15:04:54 +02:00
Johan Fylling 96ecf38a90 trace+tester: Adding local var values to trace and test report (#6815) 
Fixing: #2546
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2024-06-25 14:31:12 +02:00
Stephan Renatus 31120ce137 build: use chainguard images from dockerhub (#6830) 
Signed-off-by: Stephan Renatus <stephan@styra.com>
 2024-06-25 11:09:56 +02:00
Johan Fylling 5464b005e8 Bumping golangci-lint to v1.59.1 (#6817) 
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2024-06-19 15:13:43 +02:00
Philip Conrad 8e7172c8f8 bundle: Preallocate buffers for file contents. (#6818) 
This commit adds logic to preallocate buffers when loading files from
both tarballs and on-disk bundle directories. The change results in
lower max RSS memory usage at runtime, and better garbage collector
performance, especially when at lower values of GOMAXPROCS.

For very large bundles (>1 GB in size), this change can lower startup
times for OPA by as much as a full second.

The performance analysis was different than for most changes-- heap
usage increased by about 10% during bundle loading, which made the
change look bad at first. Some of the effect appears to be from the
Go compiler no longer inlining as far up the call chain during bundle
loading (visible in the `pprof` graphs).

Running with `GODEBUG=gctrace=1` and varying GOMAXPROCS allowed seeing a
fuller picture of how performance changes from preallocation, which
results in much less garbage for the collector, and a noticeable speedup
in wall-clock time the GC burns during bundle loading.

Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
 2024-06-19 14:19:15 +02:00
dependabot[bot] 3b06458cd0 build(deps-dev): bump braces in /docs/website/scripts/live-blocks (#6820) 
Bumps [braces](https://github.com/micromatch/braces) from 3.0.2 to 3.0.3.
- [Changelog](https://github.com/micromatch/braces/blob/master/CHANGELOG.md)
- [Commits](https://github.com/micromatch/braces/compare/3.0.2...3.0.3)

---
updated-dependencies:
- dependency-name: braces
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-19 14:07:25 +02:00
dependabot[bot] dbaa9cc1ce build(deps): bump aquasecurity/trivy-action from 0.22.0 to 0.23.0 (#6826) 
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.22.0 to 0.23.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.22.0...0.23.0)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-19 13:41:09 +02:00
Johan Fylling b4679c25c6 Fix/inspect unknowns in with stmt (#6824) 
Fixes: #6812
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2024-06-19 12:45:44 +02:00
dependabot[bot] ad1f75dba5 build(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 (#6823) 
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.8.0 to 1.8.1.
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](https://github.com/spf13/cobra/compare/v1.8.0...v1.8.1)

---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-17 14:28:45 +02:00
Charlie Egan 1b052e18a8 Add page aliases for moved or renamed pages. (#6821) 
https://github.com/open-policy-agent/opa/pull/6811

In the above PR, some pages were moved or renamed. This adds some aliases to those pages so that redirects are handled by Hugo correctly.

Signed-off-by: Charlie Egan <charlie@styra.com>
 2024-06-17 10:24:27 +01:00
Magnus Jungsbluth b463d30028 plugins: Reduce locks during decision logging (#6797) 
Signed-off-by: Magnus Jungsbluth <magnus.jungsbluth@zalando.de>
Co-authored-by: Johan Fylling <johan.dev@fylling.se>
 2024-06-12 15:07:33 +02:00
Charlie Egan 612b93af1f docs: Revise language SDK content (#6811) 
In the OPA ecosystem, there are a number of language SDKs for different
general purpose languages, mostly integrating with the REST API. This PR
highlights these at the start of the OPA ecosystem page, adds some other
projects for completeness and clarifies the owner where more than one
SDK for a language exists.

Signed-off-by: Charlie Egan <charlie@styra.com>
 2024-06-11 13:34:03 +01:00
Anders Eknert ecc134bb23 Fix wrong location on metadata parse errors on first line (#6807) 
Fixes #6587

Signed-off-by: Anders Eknert <anders@styra.com>
 2024-06-11 10:29:00 +02:00
Anders Eknert 8f25aaf56c Include original text in annotation location text attribute (#6808) 
Previously it would just say '# METADATA'

Fixes #6779

Signed-off-by: Anders Eknert <anders@styra.com>
 2024-06-11 10:05:15 +02:00
Anders Eknert b2146ed0c4 Use a better error message when trying to merge non-objects (#6805) 
Fixes #6803

Signed-off-by: Anders Eknert <anders@styra.com>
 2024-06-11 09:46:08 +02:00
Anders Eknert 6212f30619 docs: mention that default functions may not evaluate (#6806) 
Fixes #6265

Signed-off-by: Anders Eknert <anders@styra.com>
 2024-06-11 08:25:46 +02:00
dependabot[bot] fea2647aaf build(deps): bump aquasecurity/trivy-action from 0.21.0 to 0.22.0 
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.21.0 to 0.22.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.21.0...0.22.0)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-06-07 09:58:05 -07:00
dependabot[bot] 7e98a1f84d build(deps): bump github.com/containerd/containerd from 1.7.17 to 1.7.18 
Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.17 to 1.7.18.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](https://github.com/containerd/containerd/compare/v1.7.17...v1.7.18)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-06-05 10:14:48 -07:00
dependabot[bot] 1e52b43ba0 build(deps): bump golang.org/x/net from 0.25.0 to 0.26.0 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.25.0 to 0.26.0.
- [Commits](https://github.com/golang/net/compare/v0.25.0...v0.26.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-06-05 10:14:30 -07:00
Stephan Renatus 56e3a55805 build: bump golang 1.22.3 -> 1.22.4 
https://groups.google.com/g/golang-announce/c/XbxouI9gY7k

Signed-off-by: Stephan Renatus <stephan@styra.com>
 2024-06-05 08:29:35 -07:00
Jack Baldry bac8de036e Fix spelling and grammar of an HTTP (#6786) 
- To decide whether to use an or a:
https://www.merriam-webster.com/grammar/is-it-a-or-an

- Spelling of HTTP: https://en.wikipedia.org/wiki/HTTP

Signed-off-by: Jack Baldry <jack.baldry@grafana.com>
 2024-06-04 15:40:36 +01:00
Charlie Egan 12d6e9f662 docs: add flipt blog to their ecosystem page (#6789) 
Signed-off-by: Charlie Egan <charlie@styra.com>
Co-authored-by: Anders Eknert <anders@styra.com>
 2024-06-04 15:24:18 +01:00
Charlie Egan 186f7bcab1 docs: add vs code and zed to ecosystem page (#6788) 
Signed-off-by: Charlie Egan <charlie@styra.com>
 2024-06-04 15:54:40 +02:00
Philip Conrad 8a9cfdd59d docs/content/monitoring: Remove missing prometheus metric go_memstats_gc_cpu_fraction 
Prometheus appears to have dropped the `go_memstats_gc_cpu_fraction`
metric, since at least Go 1.18. This commit drops the missing metric
from the table of expected metrics for OPA on the monitoring docs page.

Reference: https://github.com/prometheus/client_golang/issues/1500

Fixes: #6783

Signed-off-by: Philip Conrad <philipaconrad@gmail.com>
 2024-06-03 23:33:30 -07:00
Mark Phelps ce4df7825d Add Flipt to the OPA ecosystem (#6781) 
Signed-off-by: Mark Phelps <209477+markphelps@users.noreply.github.com>
 2024-06-02 20:29:36 +02:00
Anders Eknert d2e995ea19 Fix blanket "unexpected assign token" error message / usability issue (#6778) 
This one has been among my top annoyances, and thanks to @johanfylling,
it was easy to finally track down. Had to update a few tests, but not too
many.

Fixes #6563

Signed-off-by: Anders Eknert <anders@styra.com>
 2024-05-31 12:23:55 +02:00
Evgenii Baranov f2ffbd6427 plugins/rest: Do local map modification in OAuth2 client credentials flow 
Fixes: #6769

Signed-off-by: eubaranov <evgeniy.baranov@deliveryhero.com>
 2024-05-30 09:54:54 -07:00
Rudrakh Panigrahi eeb633863b add http.send request attribute to ignore headers for caching key 
Signed-off-by: Rudrakh Panigrahi <rudrakh97@gmail.com>
 2024-05-30 09:37:34 -07:00
Johan Fylling bb65de47ab Prepare v0.66.0 development (#6775) 
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2024-05-30 18:21:19 +02:00
Johan Fylling f05497530d Updating changelog for v0.65.0 (#6774) 
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
v0.65.0 		2024-05-30 16:54:05 +02:00
Johan Fylling 5a49efdbb1 Release v0.65.0 (#6772) 
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2024-05-30 16:01:57 +02:00
Ashutosh Narkar 4e5c36d05c Include annotations in rule AST (#6771) 
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Co-authored-by: Johan Fylling <johan.dev@fylling.se>
 2024-05-30 14:54:48 +02:00
Anders Eknert 02c565a982 Add remainder operator to grammar (#6767) 
Signed-off-by: Anders Eknert <anders@eknert.com>
 2024-05-28 21:30:05 +02:00
Johan Fylling cb9d347738 Adding documentation for new IsSetStmt IR statement (#6764) 
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2024-05-28 16:33:19 +02:00
Johan Fylling 62834a22a6 Asserting every domain is an collection type before evaluation (#6763) 
Fixing an issue where a non-collection `every`-domain didn’t fail evaluation.
Removing a possible attack surface, where an attacker with the ability to craft portions of the input document could replace a value with an expected collection type, that is known to be processed by an `every`-statement, with a non-collection value and thereby would cause the policy to accept a query that should otherwise be rejected.

Fixes: #6762
Signed-off-by: Johan Fylling <johan.dev@fylling.se>
 2024-05-28 10:16:58 +02:00
dependabot[bot] 27da341200 build(deps): bump aquasecurity/trivy-action from 0.20.0 to 0.21.0 
Bumps [aquasecurity/trivy-action](https://github.com/aquasecurity/trivy-action) from 0.20.0 to 0.21.0.
- [Release notes](https://github.com/aquasecurity/trivy-action/releases)
- [Commits](https://github.com/aquasecurity/trivy-action/compare/0.20.0...0.21.0)

---
updated-dependencies:
- dependency-name: aquasecurity/trivy-action
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-23 10:02:11 -07:00
dependabot[bot] 3a198e0ee8 --- 
updated-dependencies:
- dependency-name: github.com/go-logr/logr
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-22 08:38:54 -07:00
Ashutosh Narkar a8ac7b38bb plugins/logs: Include http request context in decision logs 
It would be useful if users had the ability to enhance the
decision log with info from the incoming HTTP request such as
headers. This change allows users to configure headers whose
values if present in the incoming HTTP request would be
surfaced via the decision log. This can be extended in the
future to include more context from the request.

Fixes: #6693

Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
 2024-05-20 11:08:42 -07:00
dependabot[bot] a751084bfe build(deps): bump github.com/containerd/containerd from 1.7.16 to 1.7.17 
Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd) from 1.7.16 to 1.7.17.
- [Release notes](https://github.com/containerd/containerd/releases)
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md)
- [Commits](https://github.com/containerd/containerd/compare/v1.7.16...v1.7.17)

---
updated-dependencies:
- dependency-name: github.com/containerd/containerd
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-17 10:14:12 -07:00
dependabot[bot] 958efb2163 build(deps): bump google.golang.org/grpc from 1.63.2 to 1.64.0 
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.63.2 to 1.64.0.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](https://github.com/grpc/grpc-go/compare/v1.63.2...v1.64.0)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2024-05-15 08:18:57 -07:00