Skip to content

Commit dba5d43

Browse files
PushpalankaPushpalanka
committed
Upgrade to opa v1.0.1
Signed-off-by: Pushpalanka Jayawardhana <[email protected]>
1 parent 377d5c3 commit dba5d43

File tree

11 files changed

+180
-156
lines changed

11 files changed

+180
-156
lines changed

‎filters/openpolicyagent/evaluation.go

+11-5
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,10 @@ import (
99
ext_authz_v3 "github.com/envoyproxy/go-control-plane/envoy/service/auth/v3"
1010
"github.com/open-policy-agent/opa-envoy-plugin/envoyauth"
1111
"github.com/open-policy-agent/opa-envoy-plugin/opa/decisionlog"
12-
"github.com/open-policy-agent/opa/ast"
13-
"github.com/open-policy-agent/opa/server"
14-
"github.com/open-policy-agent/opa/topdown"
12+
"github.com/open-policy-agent/opa/v1/ast"
13+
"github.com/open-policy-agent/opa/v1/plugins/logs"
14+
"github.com/open-policy-agent/opa/v1/server"
15+
"github.com/open-policy-agent/opa/v1/topdown"
1516
"github.com/opentracing/opentracing-go"
1617
pbstruct "google.golang.org/protobuf/types/known/structpb"
1718
)
@@ -59,7 +60,7 @@ func (opa *OpenPolicyAgentInstance) Eval(ctx context.Context, req *ext_authz_v3.
5960
return nil, fmt.Errorf("check request timed out before query execution: %w", ctx.Err())
6061
}
6162

62-
logger := opa.manager.Logger().WithFields(map[string]interface{}{"decision-id": result.DecisionID})
63+
logger := opa.Logger().WithFields(map[string]interface{}{"decision-id": result.DecisionID})
6364
input, err = envoyauth.RequestToInput(req, logger, nil, opa.EnvoyPluginConfig().SkipRequestBodyParse)
6465
if err != nil {
6566
return nil, fmt.Errorf("failed to convert request to input: %w", err)
@@ -111,7 +112,12 @@ func (opa *OpenPolicyAgentInstance) logDecision(ctx context.Context, input inter
111112
info.Path = opa.EnvoyPluginConfig().Path
112113
}
113114

114-
return decisionlog.LogDecision(ctx, opa.manager, info, result, err)
115+
plugin := logs.Lookup(opa.manager)
116+
if plugin == nil {
117+
return nil
118+
}
119+
120+
return decisionlog.LogDecision(ctx, plugin, info, result, err)
115121
}
116122

117123
func withDecisionID(decisionID string) func(*envoyauth.EvalResult) {

‎filters/openpolicyagent/internal/envoy/envoyplugin.go

+3-3
Original file line numberDiff line numberDiff line change
@@ -5,9 +5,9 @@ import (
55
"strconv"
66
"strings"
77

8-
"github.com/open-policy-agent/opa/ast"
9-
"github.com/open-policy-agent/opa/plugins"
10-
"github.com/open-policy-agent/opa/util"
8+
"github.com/open-policy-agent/opa/v1/ast"
9+
"github.com/open-policy-agent/opa/v1/plugins"
10+
"github.com/open-policy-agent/opa/v1/util"
1111
)
1212

1313
// Factory defines the interface OPA uses to instantiate a plugin.

‎filters/openpolicyagent/opaauthorizerequest/benchmark_test.go

+8-4
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ import (
44
_ "embed"
55
"fmt"
66
"github.com/golang-jwt/jwt/v4"
7-
opasdktest "github.com/open-policy-agent/opa/sdk/test"
7+
opasdktest "github.com/open-policy-agent/opa/v1/sdk/test"
88
"github.com/stretchr/testify/assert"
99
"github.com/stretchr/testify/require"
1010
"github.com/zalando/skipper/filters"
@@ -60,9 +60,11 @@ func BenchmarkMinimalPolicy(b *testing.B) {
6060
"main.rego": `
6161
package envoy.authz
6262
63+
import rego.v1
64+
6365
default allow = false
6466
65-
allow {
67+
allow if {
6668
input.parsed_path = [ "allow" ]
6769
}
6870
`,
@@ -101,9 +103,11 @@ func BenchmarkMinimalPolicyWithDecisionLogs(b *testing.B) {
101103
"main.rego": `
102104
package envoy.authz
103105
106+
import rego.v1
107+
104108
default allow = false
105109
106-
allow {
110+
allow if {
107111
input.parsed_path = [ "allow" ]
108112
}
109113
`,
@@ -200,7 +204,7 @@ func BenchmarkJwtValidation(b *testing.B) {
200204
"main.rego": fmt.Sprintf(`
201205
package envoy.authz
202206
203-
import future.keywords.if
207+
import rego.v1
204208
205209
default allow = false
206210

‎filters/openpolicyagent/opaauthorizerequest/opaauthorizerequest_test.go

+18-14
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ package opaauthorizerequest
22

33
import (
44
"fmt"
5-
opasdktest "github.com/open-policy-agent/opa/sdk/test"
5+
opasdktest "github.com/open-policy-agent/opa/v1/sdk/test"
66
"github.com/stretchr/testify/assert"
77
"github.com/stretchr/testify/require"
88
"github.com/zalando/skipper/eskip"
@@ -412,49 +412,51 @@ func TestAuthorizeRequestFilter(t *testing.T) {
412412
"main.rego": `
413413
package envoy.authz
414414
415+
import rego.v1
416+
415417
default allow := false
416418
default deny_with_query := false
417419
418-
allow {
420+
allow if {
419421
input.parsed_path == [ "allow" ]
420422
input.parsed_query == {}
421423
}
422424
423-
allow_with_http_path {
425+
allow_with_http_path if {
424426
input.attributes.request.http.path == "/some/api/path?q1=v1&msg=help%20me"
425427
}
426428
427-
allow_with_space_in_path {
429+
allow_with_space_in_path if{
428430
input.parsed_path == [ "my path" ]
429431
}
430432
431-
allow_with_path_having_empty_query {
433+
allow_with_path_having_empty_query if {
432434
input.parsed_path == [ "path-with-empty-query" ]
433435
input.parsed_query == {}
434436
}
435437
436-
allow_with_query {
438+
allow_with_query if {
437439
input.parsed_path == [ "allow-with-query" ]
438440
input.parsed_query.pass == ["yes"]
439441
input.parsed_query.id == ["1", "2"]
440442
input.parsed_query.msg == ["help me"]
441443
}
442444
443-
deny_with_query {
445+
deny_with_query if {
444446
input.attributes.request.http.path == "/allow-me?tofail=true"
445447
not input.parsed_query.tofail == ["true"]
446448
}
447449
448-
allow_with_path_having_fragment {
450+
allow_with_path_having_fragment if {
449451
input.parsed_path == [ "path-with-empty-query" ]
450452
input.attributes.request.http.path == "/path-with-empty-query"
451453
}
452454
453-
allow_context_extensions {
455+
allow_context_extensions if {
454456
input.attributes.contextExtensions["com.mycompany.myprop"] == "myvalue"
455457
}
456458
457-
allow_runtime_environment {
459+
allow_runtime_environment if {
458460
opa.runtime().config.labels.environment == "test"
459461
}
460462
@@ -465,7 +467,7 @@ func TestAuthorizeRequestFilter(t *testing.T) {
465467
"http_status": 401
466468
}
467469
468-
allow_object := response {
470+
allow_object := response if {
469471
input.parsed_path == [ "allow", "structured" ]
470472
response := {
471473
"allowed": true,
@@ -497,13 +499,13 @@ func TestAuthorizeRequestFilter(t *testing.T) {
497499
498500
default allow_body := false
499501
500-
allow_body {
502+
allow_body if {
501503
input.parsed_body.target_id == "123456"
502504
}
503505
504506
decision_id := input.attributes.metadataContext.filterMetadata.open_policy_agent.decision_id
505507
506-
allow_object_decision_id_in_header := response {
508+
allow_object_decision_id_in_header := response if {
507509
input.parsed_path = ["allow", "structured"]
508510
decision_id
509511
response := {
@@ -663,9 +665,11 @@ func TestAuthorizeRequestInputContract(t *testing.T) {
663665
"main.rego": `
664666
package envoy.authz
665667
668+
import rego.v1
669+
666670
default allow = false
667671
668-
allow {
672+
allow if {
669673
input.attributes.request.http.path == "/users/profile/amal?param=1"
670674
input.parsed_path == ["users", "profile", "amal"]
671675
input.parsed_query == {"param": ["1"]}

‎filters/openpolicyagent/opaserveresponse/opaserveresponse_test.go

+12-10
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ import (
77
"strings"
88
"testing"
99

10-
opasdktest "github.com/open-policy-agent/opa/sdk/test"
10+
opasdktest "github.com/open-policy-agent/opa/v1/sdk/test"
1111
"github.com/stretchr/testify/assert"
1212
"github.com/zalando/skipper/eskip"
1313
"github.com/zalando/skipper/filters"
@@ -172,9 +172,11 @@ func TestServerResponseFilter(t *testing.T) {
172172
"main.rego": `
173173
package envoy.authz
174174
175+
import rego.v1
176+
175177
default allow := false
176178
177-
allow {
179+
allow if {
178180
input.parsed_path == [ "allow" ]
179181
}
180182
@@ -185,7 +187,7 @@ func TestServerResponseFilter(t *testing.T) {
185187
"http_status": 403
186188
}
187189
188-
allow_object := response {
190+
allow_object := response if {
189191
input.parsed_path == [ "allow", "structured" ]
190192
response := {
191193
"allowed": true,
@@ -195,7 +197,7 @@ func TestServerResponseFilter(t *testing.T) {
195197
}
196198
}
197199
198-
allow_object := response {
200+
allow_object := response if {
199201
input.parsed_path == [ "allow", "structured", "with-empty-query-string" ]
200202
input.parsed_query == {}
201203
response := {
@@ -206,7 +208,7 @@ func TestServerResponseFilter(t *testing.T) {
206208
}
207209
}
208210
209-
allow_object := response {
211+
allow_object := response if {
210212
input.parsed_path == [ "allow", "structured", "with-query" ]
211213
input.parsed_query.pass == ["yes"]
212214
response := {
@@ -217,7 +219,7 @@ func TestServerResponseFilter(t *testing.T) {
217219
}
218220
}
219221
220-
allow_object := response {
222+
allow_object := response if {
221223
input.parsed_path == [ "allow", "production" ]
222224
opa.runtime().config.labels.environment == "production"
223225
response := {
@@ -228,7 +230,7 @@ func TestServerResponseFilter(t *testing.T) {
228230
}
229231
}
230232
231-
allow_object := response {
233+
allow_object := response if {
232234
input.parsed_path == [ "allow", "test" ]
233235
opa.runtime().config.labels.environment == "test"
234236
response := {
@@ -239,7 +241,7 @@ func TestServerResponseFilter(t *testing.T) {
239241
}
240242
}
241243
242-
allow_object_structured_body := response {
244+
allow_object_structured_body := response if {
243245
input.parsed_path == [ "allow", "structured" ]
244246
response := {
245247
"allowed": true,
@@ -249,7 +251,7 @@ func TestServerResponseFilter(t *testing.T) {
249251
}
250252
}
251253
252-
allow_object_contextextensions := response {
254+
allow_object_contextextensions := response if {
253255
input.parsed_path == [ "allow", "structured" ]
254256
response := {
255257
"allowed": true,
@@ -259,7 +261,7 @@ func TestServerResponseFilter(t *testing.T) {
259261
}
260262
}
261263
262-
allow_object_req_body := response {
264+
allow_object_req_body := response if {
263265
response := {
264266
"allowed": true,
265267
"headers": {},

‎filters/openpolicyagent/openpolicyagent.go

+11-11
Original file line numberDiff line numberDiff line change
@@ -18,17 +18,17 @@ import (
1818
ext_authz_v3_core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
1919
"github.com/google/uuid"
2020
"github.com/open-policy-agent/opa-envoy-plugin/envoyauth"
21-
"github.com/open-policy-agent/opa/ast"
22-
"github.com/open-policy-agent/opa/config"
23-
"github.com/open-policy-agent/opa/logging"
24-
"github.com/open-policy-agent/opa/plugins"
25-
"github.com/open-policy-agent/opa/plugins/discovery"
26-
"github.com/open-policy-agent/opa/rego"
27-
"github.com/open-policy-agent/opa/runtime"
28-
"github.com/open-policy-agent/opa/storage"
29-
"github.com/open-policy-agent/opa/storage/inmem"
30-
iCache "github.com/open-policy-agent/opa/topdown/cache"
31-
opatracing "github.com/open-policy-agent/opa/tracing"
21+
"github.com/open-policy-agent/opa/v1/ast"
22+
"github.com/open-policy-agent/opa/v1/config"
23+
"github.com/open-policy-agent/opa/v1/logging"
24+
"github.com/open-policy-agent/opa/v1/plugins"
25+
"github.com/open-policy-agent/opa/v1/plugins/discovery"
26+
"github.com/open-policy-agent/opa/v1/rego"
27+
"github.com/open-policy-agent/opa/v1/runtime"
28+
"github.com/open-policy-agent/opa/v1/storage"
29+
"github.com/open-policy-agent/opa/v1/storage/inmem"
30+
iCache "github.com/open-policy-agent/opa/v1/topdown/cache"
31+
opatracing "github.com/open-policy-agent/opa/v1/tracing"
3232
"github.com/opentracing/opentracing-go"
3333
"golang.org/x/sync/semaphore"
3434
"google.golang.org/protobuf/encoding/protojson"

‎filters/openpolicyagent/openpolicyagent_test.go

+7-5
Original file line numberDiff line numberDiff line change
@@ -14,14 +14,14 @@ import (
1414

1515
pbstruct "google.golang.org/protobuf/types/known/structpb"
1616

17-
"github.com/open-policy-agent/opa/ast"
17+
"github.com/open-policy-agent/opa/v1/ast"
1818

1919
ext_authz_v3_core "github.com/envoyproxy/go-control-plane/envoy/config/core/v3"
2020
authv3 "github.com/envoyproxy/go-control-plane/envoy/service/auth/v3"
2121
"github.com/open-policy-agent/opa-envoy-plugin/envoyauth"
22-
opaconf "github.com/open-policy-agent/opa/config"
23-
opasdktest "github.com/open-policy-agent/opa/sdk/test"
24-
"github.com/open-policy-agent/opa/storage/inmem"
22+
opaconf "github.com/open-policy-agent/opa/v1/config"
23+
opasdktest "github.com/open-policy-agent/opa/v1/sdk/test"
24+
"github.com/open-policy-agent/opa/v1/storage/inmem"
2525
"github.com/opentracing/opentracing-go"
2626
"github.com/stretchr/testify/assert"
2727
"github.com/stretchr/testify/require"
@@ -153,10 +153,12 @@ func mockControlPlaneWithResourceBundle() (*opasdktest.Server, []byte) {
153153
opasdktest.MockBundle("/bundles/use_body", map[string]string{
154154
"main.rego": `
155155
package envoy.authz
156+
157+
import rego.v1
156158
157159
default allow = false
158160
159-
allow { input.parsed_body }
161+
allow if { input.parsed_body }
160162
`,
161163
}),
162164
opasdktest.MockBundle("/bundles/anotherbundlename", map[string]string{

‎filters/openpolicyagent/tracing.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ package openpolicyagent
33
import (
44
"net/http"
55

6-
"github.com/open-policy-agent/opa/plugins"
7-
opatracing "github.com/open-policy-agent/opa/tracing"
6+
"github.com/open-policy-agent/opa/v1/plugins"
7+
opatracing "github.com/open-policy-agent/opa/v1/tracing"
88
"github.com/opentracing/opentracing-go"
99
"github.com/zalando/skipper/logging"
1010
"github.com/zalando/skipper/proxy"

‎filters/openpolicyagent/tracing_test.go

+2-2
Original file line numberDiff line numberDiff line change
@@ -6,8 +6,8 @@ import (
66
"net/url"
77
"testing"
88

9-
"github.com/open-policy-agent/opa/config"
10-
"github.com/open-policy-agent/opa/plugins"
9+
"github.com/open-policy-agent/opa/v1/config"
10+
"github.com/open-policy-agent/opa/v1/plugins"
1111
"github.com/opentracing/opentracing-go"
1212
"github.com/stretchr/testify/assert"
1313
"github.com/stretchr/testify/require"

0 commit comments

Comments
 (0)