❗ We now parse rego metadata annotations by default.
Rule annotations now support a `labels` field. During policy eval,
labels from all successfully evaluated rules are collected and included
in each decision log entry as a top-level `rule_labels` array. Each
element preserves the label map from one evaluated rule. Exact
duplicates are omitted.
```rego
# METADATA
# labels:
# severity: low
# team: platform
allow if input.role == "admin"
```
The resulting decision log entry will contain:
```json
{"rule_labels": [{"severity": "low", "team": "platform"}]}
```
---------
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Improve the http.send documentation to address user confusion around
error response caching and the scope of force_cache. edits:
- Restructure caching section with intra-query and inter-query
subsections,
- Add a note that http.send is one of several ways to load external data
into OPA, linking to the External Data page
- Reorganise page structure with named sections
<img width="665" height="285" alt="Screenshot 2026-05-06 at 12 44 35"
src="https://github.com/user-attachments/assets/a88ac0c5-33b2-4480-bb15-70e50ed9701e"
/>
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
Rules can now be annotated with a metadata `id` field. When any
metadata `id` annotations are present in the rego (scope: rule), the IDs
of successfully evaluated rules are included in decision log events.
Additionally, the Data API supports a `?id` query parameter to
include evaluated rule IDs directly in the response payload.
```rego
# METADATA
# id: allow-admin
allow if input.role == "admin"
```
Modules containing `id` annotations will have metadata parsing enabled
automatically.
Fixes#2089
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
### Why the changes in this PR are needed?
When looking at the docs for the `not` keyword example, I was confused
why the `deny` rule wasn't including the "under 18" error if I changed
the age in the input. Turns out it was a string so that was never
getting triggered.
### What are the changes in this PR?
Changes the value of `age` in the input for the `not` example for an
undefined value in the docs.
Signed-off-by: AC <menma1234@users.noreply.github.com>
## Summary
The aggregates page only renders the `BuiltinTable` today and has no
worked examples, even though `count` and `sum` are among the most-used
built-ins. This adds two `PlaygroundExample`s following the existing
pattern under `_examples/<category>/<name>`:
- `aggregates/count/list_size` shows `count` over arrays, sets, objects,
and strings, plus a typical *too many containers* deny rule.
- `aggregates/sum/total_replicas` shows `sum` used to budget total
replicas across the deployments in a namespace.
#3786 explicitly says it's broad and meant to be filled in
incrementally, so this is sized accordingly; happy to follow up with
more categories if useful.
Refs #3786
---------
Signed-off-by: alliasgher <alliasgher123@gmail.com>
Wrapping projects can now attach custom metadata to Data API requests
and have evaluation produce response metadata.
Introduce two distinct metadata paths:
- Request (incoming) metadata: parsed from extra top-level keys in the request
body, made available to builtins via `BuiltinContext.RequestMetadata`.
Logged in the decision log under `Custom["request_metadata"]`.
- Response (outgoing) metadata: a separate map (`BuiltinContext.ResponseMetadata`)
that builtins can populate during evaluation. Only included in the
API response and decision log (`Custom["response_metadata"]`)
if non-empty.
In vanilla OPA, no builtins write response metadata, so responses are
unchanged. The request metadata map is only allocated when the request
carries extra fields; the outgoing map is one empty map per request.
To avoid conflicts with future OPA top-level keys, callers should use a
namespaced key: `{"input": {...}, "com.example.opa/md": {...}}`.
```mermaid
flowchart LR
req["POST /v1/data\n{input, com.example.opa/md}"]
parse["readInputPostV1"]
eval["topdown eval"]
resp["API response"]
dl["decision log"]
req --> parse
parse -- "reqMetadata" --> eval
parse -- "reqMetadata" --> dl
eval -- "respMetadata\n(if non-empty)" --> resp
eval -- "respMetadata\n(if non-empty)" --> dl
eval -. "BuiltinContext\n.RequestMetadata\n.ResponseMetadata" .-> eval
```
---------
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
This allows us to show the results of example evaluation before the user
clicks evaluate, but also for chatbots to see the output when viewing
without interaction.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
* docs/ecosystem: Add Vulnetix to the OPA Ecosystem
Vulnetix is a CLI security scanner that evaluates SCA, IaC, container,
secrets, SAST, license and SBOM findings using Rego, with 250+ built-in
rules and support for custom policy-as-code rule repositories. Adding it
to the ecosystem helps users discover an OPA-powered option for unified,
policy-driven security scanning.
Signed-off-by: Christopher Langton <chris@vulnetix.com>
* docs/ecosystem: Update Vulnetix entry links
Point the entry to the Vulnetix CLI repository and link to the custom
rules and CI/agent integration docs so readers can go directly to the
policy-as-code and integration material.
Signed-off-by: Christopher Langton <chris@vulnetix.com>
---------
Signed-off-by: Christopher Langton <chris@vulnetix.com>
* distributedtracing: export Prometheus metrics via OTLP
Add support for pushing OPA's existing Prometheus metrics to an
OpenTelemetry collector via OTLP, eliminating the need for a dedicated
scraper sidecar. Uses the OTel Prometheus bridge to read from OPA's
prometheus.Registry and export through an OTLP metric exporter (gRPC
or HTTP), reusing the same address and TLS configuration as traces.
New config fields: distributed_tracing.metrics (bool, default false)
and distributed_tracing.metrics_export_interval_ms (int, default 60000).
Fixes#7591
Signed-off-by: Michael Munch <mm.munk@gmail.com>
* metricsexport: decouple metrics export into top-level config section
Extract metrics export from distributed_tracing into its own
metrics_export config section with independent type (otlp/grpc,
otlp/http), address, and TLS settings. This allows exporting
Prometheus metrics via OTLP without enabling tracing, and to a
different endpoint than traces.
- Extract shared TLS helpers into internal/tlsutil
- Add MetricsExport field to top-level Config
- Create internal/metricsexport package with Init, config parsing
- Remove metrics fields from distributedtracing
- Update runtime to call metricsexport.Init separately
- Move e2e tests to v1/test/e2e/metricsexport
- Add Metrics Export section to configuration docs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Michael Munch <mm.munk@gmail.com>
* ci: retrigger checks
Signed-off-by: Michael Munch <mm.munk@gmail.com>
* go.mod: upgrade dependencies downgraded during rebase
Modules like containerd, go-sqlbuilder, OpenTelemetry, and golang.org/x/*
were at older versions than main after a rebase. Upgrade them to match or
exceed main.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: Michael Munch <mm.munk@gmail.com>
* Update internal/distributedtracing/distributedtracing_test.go
Signed-off-by: Michael Munch <mm.munk@gmail.com>
---------
Signed-off-by: Michael Munch <mm.munk@gmail.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Move event status message to prominent banner at top of page.
Replace heading-only note as it was not clear.
Signed-off-by: Charlie Egan <charlie_egan@apple.com>
Since we have seen a few reports that assume no authn/authz lately,
let's update the policy to say something about that.
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
Added support for web identity credentials in the AWS signing plugin.
This allows users to configure the plugin to use a web identity token file
for authentication when assuming a role,
which is particularly useful in environments like Kubernetes
where service accounts can be used to provide AWS credentials.
Signed-off-by: Tiago Viegas <tiago.viegas@siemens.com>
Co-authored-by: Johan Fylling <johan.dev@fylling.se>
I deleted the regal.zip file that the script created. I assume
that shouldn't be commited? But looking at Johan's "agent" PR,
it looks like it was included. We can fix that later though.
Signed-off-by: Anders Eknert <anders.eknert@apple.com>
dependabot[bot]