TEST: Service updater 2020 12 04 2332.612 #9
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Earlier we used only the OPA version to create a GH release and build the release binaries. We did not create a new GH release when changes we made to the plugin itself. This change updates the release target to use the plugin version instead of only the OPA version to checkout and build binaries. This will allow us to create releases for the plugin revisions. Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Notable bumps: - google.golang.org/grpc v1.23.0 ⏩ v1.33.1 - github.com/envoyproxy/go-control-plane v0.9.0 ⏩ v0.9.7 - github.com/sirupsen/logrus v1.4.2 ⏩ v1.7.0 Signed-off-by: Stephan Renatus <srenatus@chef.io>
Earlier the checkout step of the post-tag workflow used the default fetch-depth=1 which would only fetch a single commit. This would result in an incorrect calculation of the number of commits from the last OPA revendoring. This change sets fetch-depth=0 to fetch all history to correct this issue. Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
When the context is cancelled or deadline is reached durign query evaluation, the error message returned is "caller cancelled query execution". This message is not very informative from the pov of the plugin user. This change updates the plugin to handle eval cancellation errors and returns a more helpful error message. This change also checks if the context is cancelled or deadline is reached even before policy eval has started which may happen in scenarios where the server is overloaded and has pending requests in its queue and returns an appropriate error message in such cases. Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This commit includes changes to migrate from Travis to Github Actions. Couple of workflows are added that will trigger when a pull request is created and when changes are merged into master. Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
The post tag workflow used the `set-env` command to set the TAG_NAME env variable. The `set-env` command is now disabled. This change updates the worklow to remove usage of the `set-env` command to use environment files instead. Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Some day, we've updated our vendored protobuf files by updating go-control-plane,
and it has pulled in a change to the "well-known" type google.protobuf.Struct that
made it play nice with encoding/json from the stdlib.
This is a recent decision log entry (abbreviated) that shows that dynamic metadata
no longer looks like it did in oct 2019.
{
"decision_id": "0824f36e-8e1e-41e4-a692-b71fd72ee3db",
"input": {
"attributes": {
"destination": {
"address": {
"Address": {
"SocketAddress": {
"PortSpecifier": {
"PortValue": 51051
},
"address": "127.0.0.1"
}
}
}
},
"metadata_context": {
"filter_metadata": {
"envoy.filters.http.jwt_authn": {
"verified_jwt": {
"at_hash": "upgSTpYk9xI07B4MXcJwcg",
"aud": "example-app",
"email": "kilgore@kilgore.trout",
"email_verified": true,
"exp": 1605957182,
"groups": [
"authors"
],
"iat": 1605870782,
"iss": "http://127.0.0.1:5556/dex",
"name": "Kilgore Trout",
"sub": "Cg0wLTM4NS0yODA4OS0wEgRtb2Nr"
}
}
}
},
"request": {
"http": {
"headers": {
":authority": "127.0.0.1:51051",
":method": "GET",
":path": "/foobar",
"accept": "*/*",
Signed-off-by: Stephan Renatus <stephan@styra.com>
Signed-off-by: keyolk <chanhun.jeong@navercorp.com>
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This change makes opa-envoy-plugin expose two gRPC services: envoy.service.auth.v2.Authorization and envoy.service.auth.v3.Authorization. Since switching to v3 requires user action already, we've taken this chance to migrate the representation of the v3 CheckRequest to the specified JSON mapping. See the README.md for details. That aside, if you're using the v2 API, no changes to your policies are required, and you can keep using the v2 API for some time. It's TBD when we are going to drop support for it. This change also brings another input value that lets you determine the request version (v2/v3) and its encoding (protojson for the official mapping, "encoding/json" for the one used with v2). With respect to the software we're integrating with here, note - Envoy 1.13 is the first version to support the v3 API. - Istio 1.7.0 is the first version that lets you configure the v3 filters required to use the v3 API with Envoy. Support for the 1.6 series of Istio has been ended in Nov 21 2020. - That first version of Envoy released in 2021, presumably 1.18, will drop support for the v2 API. The `examples/istio/quick_start.yaml` file has been adapted: 1. it's using the v3 API 2. its hardcoded TLS certs (generated with `build/gen-tls-certs.sh`) work with a service that's built with Go 1.15 (which refuses CN in favour of SNI records) Signed-off-by: Stephan Renatus <stephan@styra.com>
Signed-off-by: Stephan Renatus <stephan@styra.com>
Also updates kind to 0.9.0, required for Istio 1.7.0. (Oversight of open-policy-agent#217) Signed-off-by: Stephan Renatus <stephan@styra.com>
Signed-off-by: opa-updater-automation <opa-updater-automation@openpolicyagent.org>
Signed-off-by: opa-updater-automation <opa-updater-automation@openpolicyagent.org>
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.