mirror of
https://github.com/open-policy-agent/opa.git
synced 2026-08-12 19:32:48 -06:00
Philip Conrad
d2c0459cc4
* test: Parallelize package level tests in high-cost packages. This commit adds `t.Parallel()` calls to the beginning of many tests across several Go packages in OPA. The slowest packages (taking ~10s or more) have been instrumented where possible as a proof-of-concept. On a machine with many cores, the tests now will complete as fast as the slowest test per package, instead of the sum of all the tests in a particular package. * server/server_test: Remove 3x tests from parallel set. This commit fixes a data race that could occur in the `server` package tests, because 3x tests were modifying package variables under `internal/version`. These tests now run sequentially, and are not included in the parallel test set. * plugins/bundle/plugin_test: Remove 2x tests from the parallel set. Two tests in this package modified a package variable directly, and as such cannot be safely run in parallel with each other or any other tests in the package. * topdown/*_test: t.Parallel refactors. This commit wraps up a large batch of fairly mechanical refactorings to add t.Parallel() annotations to almost every test under `topdown`. The tests that could not be safely parallelized now have explicit warning comments on them describing why they are not safe to run in parallel. * storage/disk: t.Parallel refactors. This commit bundles up test parallelization changes for the `storage/disk` package, dramatically reducing its execution time. * topdown/net_test: Remove sub-test parallelization. * rego: t.Parallel refactors. This commit includes a bundle of t.Parallel refactoring changes for the `rego` package, including a timer-related bugfix, and a slight change on a cancellation test to reduce its overall cost during test runs (the logic is preserved, but the mandatory timeouts are lower now). * test: Fixes for sporadic test breakages. --------- Signed-off-by: Philip Conrad <philip@chariot-chaser.net>
Open Policy Agent
Open Policy Agent (OPA) is an open source, general-purpose policy engine that enables unified, context-aware policy enforcement across the entire stack.
OPA is proud to be a graduated project in the Cloud Native Computing Foundation (CNCF) landscape. For details read the CNCF announcement.
Get started with OPA
- Write your first Rego policy with the Rego Playground or use it to share your work with others for feedback and support. Have a look at the Access Control examples if you're not sure where to start.
- Install the VS Code extension to get started locally with live diagnostics, debugging and formatting. See Editor and IDE Support for other supported editors.
- Go to the OPA Documentation to learn about the Rego language as well as how to deploy and integrate OPA.
- Check out the learning resources in the Learning Rego section of the ecosystem directory.
- Follow the Running OPA instructions to get started with the OPA CLI locally.
- See Docker Hub for container images and the GitHub releases for binaries.
- Check out the OPA Roadmap to see a high-level snapshot of OPA features in-progress and planned.
Want to talk about OPA or get support?
- Join the OPA Slack to talk to other OPA users and maintainers. See
#helpfor support. - Check out the Community Discussions to ask questions.
Interested to learn what others are doing with OPA?
- Browse community projects on the OPA Ecosystem Directory - don't forget to list your own!
- Check out the ADOPTERS.md file for a list of production adopters. Does your organization use OPA in production? Support the OPA project by submitting a PR to add your organization to the list with a short description of your OPA use cases!
Want to integrate OPA?
- See the high-level Go SDK or the low-level Go API
to integrate OPA with services written in Go. - See the REST API reference to integrate OPA with services written in other languages.
- See the integration docs for more options.
Want to contribute to OPA?
- Read the Contributing Guide to learn how to make your first contribution.
- Use #contributors in Slack to talk to other contributors and OPA maintainers.
- File a GitHub Issue to request features or report bugs.
How does OPA work?
OPA gives you a high-level declarative language to author and enforce policies across your stack.
With OPA, you define rules that govern how your system should behave. These rules exist to answer questions like:
- Can user X call operation Y on resource Z?
- What clusters should workload W be deployed to?
- What tags must be set on resource R before it's created?
You integrate services with OPA so that these kinds of policy decisions do not have to be hardcoded in your service. Services integrate with OPA by executing queries when policy decisions are needed.
When you query OPA for a policy decision, OPA evaluates the rules and data (which you give it) to produce an answer. The policy decision is sent back as the result of the query.
For example, in a simple API authorization use case:
- You write rules that allow (or deny) access to your service APIs.
- Your service queries OPA when it receives API requests.
- OPA returns allow (or deny) decisions to your service.
- Your service enforces the decisions by accepting or rejecting requests accordingly.
For concrete examples of how to integrate OPA with systems like Kubernetes, Terraform, Docker, SSH, and more, see openpolicyagent.org.
Presentations
- Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon NA 2023: video
- Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon EU 2023: video
- Running Policy in Hard to Reach Places with WASM & OPA @ CN Wasm Day EU 2023: video
- OPA maintainers talk @ Kubecon NA 2022: video
- Open Policy Agent (OPA) Intro & Deep Dive @ Kubecon EU 2022: video
- Open Policy Agent Intro @ KubeCon EU 2021: Video
- Using Open Policy Agent to Meet Evolving Policy Requirements @ KubeCon NA 2020: video
- Applying Policy Throughout The Application Lifecycle with Open Policy Agent @ CloudNativeCon 2019: video
- Open Policy Agent Introduction @ CloudNativeCon EU 2018: video, slides
- Rego Deep Dive @ CloudNativeCon EU 2018: video, slides
- How Netflix Is Solving Authorization Across Their Cloud @ CloudNativeCon US 2017: video, slides.
- Policy-based Resource Placement in Kubernetes Federation @ LinuxCon Beijing 2017: slides, screencast
- Enforcing Bespoke Policies In Kubernetes @ KubeCon US 2017: video, slides
- Istio's Mixer: Policy Enforcement with Custom Adapters @ CloudNativeCon US 2017: video, slides
Security
A third party security audit was performed by Cure53, you can see the full report here.
Please report vulnerabilities by email to open-policy-agent-security. We will send a confirmation message to acknowledge that we have received the report and then we will send additional messages to follow up once the issue has been investigated.