This is largely plumbing changes required to get Wasm modules loaded
from bundles and configured as external resolvers for evaluations.
Signed-off-by: Patrick East <east.patrick@gmail.com>
Previously the C library was not escaping non-string object
before serializing them--this would break callers that expect
valid JSON output from opa_json_dump. With this change,
opa_json_dump will serialize/escape non-string object
keys. opa_value_dump retains the old behaviour.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This commit adds support into the C library for parsing and dumping
set literals without representing them as arrays (we use the Rego
convention of curly-braces and set() for emptiness.) The parsing and
dumping that supports set literals is exposed via new opa_value_parse
and opa_value_dump functions (respectively).
Fixes#2773
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
There are three new API's implemented and exposed from the C code:
```
opa_value_add_path
opa_value_remove_path
```
and a new helper:
```
opa_object_remove
```
The first two provide similar functionality as the OPA stores "add"
and "remove" op (same style of path). The main difference for the add
is that it will create intermediate objects as required, we do not
have a separate `mkdir` operation like the store does.
Signed-off-by: Patrick East <east.patrick@gmail.com>
Adds support for signing S3 requests using Web Identity credentials. Specifically supports the Env Var version that's used in EKS IRSA.
Closes: #2463
Signed-off-by: Richard Simpson <richardsimpson@outlook.com>
This commit lets users override the 1GB file size limit on the bundle
reader with a configuration setting.
Fixes#2781
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Change statement from "language that let’s you specify policy" to
"language that lets you specify policy."
Signed-off-by: Kanishk Kakar <kanishk.kakar@gmail.com>
Allows OPA to obtain OAuth2 access tokens and present them as bearer tokens for authentication at remote endpoints.
Fixes#1205
Signed-off-by: Anders Eknert <anders.eknert@bisnode.com>
This change updates how errors from http.send are handled.
By default, an error returned by `http.send` halts the policy evaluation.
This commit allows users to return errors in the response object
returned by `http.send` instead of halting evaluation.
Fixes: #2187
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This commit adds two new fields to the http.send builtin
that allow the user to override the caching directives defined
by the server and thus get more control over the caching
behavior.
Fixes: #2666
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Store bundles under a specific sub-directory of the new working
directory (as the same directory may be useful in future for other
persitence features.) Also, update the docs to mention where the files
are saved to as this was unclear from the user's perspective.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
This commit adds support to persist and load bundles from disk.
A new field is introduced in OPA's bundle configuration that can
be optionally set to enable OPA to write and read bundles from disk.
This feature will allow OPA to serve policy decisions in scenarios
such as OPA being unable to communicate with the bundle server.
Fixes#2097
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This commit adds a new builtin to merge adjacent subnets and return the
smallest possible list of CIDRs.
To help with computing CIDR blocks between two
IP networks, an implemetation from https://github.com/cilium/cilium
is leveraged.
Fixes: #2692
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Updated envoy version and links. Updated service type and minikube commands to tunnel to the service for consistency across minikube versions and drivers
Signed-off-by: Peter Sullivan <pvsone@gmail.com>
The current age of a http response is calculated as the difference
between the current time and the value contained in the "Date" response
header. There are couple of scenarios that could lead to the current age
being represented as a negative duration.
1. Since the value of "Date" response header is parsed using Go's
time.Parse method, it does not contain a monotonic clock reading. As a result,
the time.Sub method uses wall clock readings to determine the difference between
current time and the parsed version of the response time.
2. The server could set a value for the "Date" response header which may not be a true indication of
when the response was generated.
This change updates the logic that determines whether a cached response is fresh or not,
to treat the resposne as stale if the current response age is represented as a negative duration.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This builtin is the reverse of the encode_object builtin and
makes it easier to use the URI query parameters in policies
Fixes#2647
Signed-off-by: Frederic <frederic.vanreet@icloud.com>
This commmit sets the values for the last request and last successful request
in the discovery bundle status.
Fixes: #2630
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This commit adds a new configurable timeout to the Services
config to set the amount of time to wait for the server's
response headers. With this change, the client will no longer
wait indefinitely for the HTTP request to complete.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
The release patch will include a new file in the repo so we need to
use git add to include that file.
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously the build command and the compile package would only mark
input as unknown. If documents under data needed to be treated as
unknown, there was no solution. This commit updates the compile
package to infer unknowns based on the bundle roots. If the policy
refers to a data document _outside_ of one of the bundle roots, that
data document will be marked as unknown during optimization/partial
eval.
Fixes#2581
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
The test examples cannot be opened into the playground because they
require multiple files and the playground UI does not support that
today.
Fix#2073
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Using `npm audit fix` update dependencies of the live-blocks tooling.
This corrects all severe ones that can be corrected without pulling
library versions that include breaking changes.
Signed-off-by: Patrick East <east.patrick@gmail.com>
This change adds a sample bundle which can be exercised as
part of the quick start instructions for opa-envoy plugin.
This commit also updates the shortcode to use the latest-envoy tag
for the opa-envoy image for latest and edge versions of the OPA docs.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This deprecates the key id claim. The claim will be injected in
signing for backwards compatibility and checked in verifying, if the
header has no kid.
Signed-off-by: Teemu Koponen <koponen@styra.com>
This commit adds a new inter-query cache that built-in
functions can use to cache responses across queries.
The OPA config includes a new "caching" field that can be used
to set the size of the cache. By default there is no limit.
This change also updates `http.send` to optionally utilize the
inter-query cache.
Fixes#1753
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
SDKs don't need to set the heap top address because it's managed by
the malloc implementation and should be left intact across
executions (otherwise the malloc implementation will keep allocating
more memory from the host because the top has been reset across
executions.)
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously, when OPA attempted to convert an ast.Object to interface{}
it would error if the ast.Object contained any keys that were not
ast.String values. This behaviour was implemented because JSON only
supports object keys as strings.
This commit changes the conversion implementation to simply JSON
marshal non-string object keys when they are encountered. This way
we avoid runtime errors which can be difficult to debug.
Fixes#516
Signed-off-by: Torin Sandall <torinsandall@gmail.com>
Previously we had some required configuration for the Github Actions,
and forks of OPA would need to set them _and_ have the underlying
infra configured (eg, docker registries, s3 bucket, etc).
Now it will check if the secrets are set, and if any required ones
are missing it will skip the steps.
This significantly lowers the bar for OPA forks to be able to run the
normal action workflows without getting errors. The only lost
functionality is primarily around publishing release assets, which
is not required for dev forks, and other forks can opt int to pieces
they care about (eg, only want to publish docker images and no
s3 release assets).
Signed-off-by: Patrick East <east.patrick@gmail.com>
Patrick East