Using an "input" attribute for default decision queries results in "undefined_document" error

[anderseknert]

When querying OPA for the default decision (i.e. localhost:8181/), wrapping the input with an "input" attribute is incorrect, but the error message does nothing to hint at that:

{
  "code": "undefined_document",
  "message": "document missing or undefined: data.system.main"
}

Removing the input attribute from the request body and the same query works — the error message is thus misleading. We should fix the error message to let the user know why the query failed.

[srenatus]

We should give a more differentiated answer. Is there no default policy, or is there one and the result is undefined?

[forgedbrew]

I'm also seeing this, but I'm not sure if it is related. I have not yet been able to determine what is causing this error. What exactly does this error mean?

I'm seeing this from the OPA pod logs:

{
  "code": "undefined_document",
  "message": "document missing or undefined: data.system.main"
}

And I'm seeing this in the kube-apiserver logs:

W1109 22:30:42.884443       1 dispatcher.go:134] Failed calling webhook, failing closed [validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/): failed calling webhook "[validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/)": the server could not find the requested resource
W1109 22:30:42.958890       1 dispatcher.go:134] Failed calling webhook, failing closed [validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/): failed calling webhook "[validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/)": the server could not find the requested resource
W1109 22:30:43.038070       1 dispatcher.go:134] Failed calling webhook, failing closed [validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/): failed calling webhook "[validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/)": the server could not find the requested resource
W1109 22:30:54.229130       1 dispatcher.go:134] Failed calling webhook, failing closed [validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/): failed calling webhook "[validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/)": the server could not find the requested resource

[srenatus]

@forgedbrew this is impossible to answer without knowing your policy. I'd presume that it yields an undefined result for the input in question.

[anderseknert]

@forgedbrew in most cases, it just means that OPA has not been provided any policy file that defines an authorization policy — i.e. one that protects the OPA endpoints themselves.

[forgedbrew]

Thank you, @srenatus and @anderseknert.

Does that pertain to both messages, or just the "undefined_document" message? We have been running OPA for a few years, but suddenly this week the kube-apiserver started spewing these logs, but we've made no recent changes.

W1109 22:30:42.884443       1 dispatcher.go:134] Failed calling webhook, failing closed [validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/): failed calling webhook "[validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/)": the server could not find the requested resource
W1109 22:30:42.958890       1 dispatcher.go:134] Failed calling webhook, failing closed [validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/): failed calling webhook "[validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/)": the server could not find the requested resource
W1109 22:30:43.038070       1 dispatcher.go:134] Failed calling webhook, failing closed [validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/): failed calling webhook "[validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/)": the server could not find the requested resource
W1109 22:30:54.229130       1 dispatcher.go:134] Failed calling webhook, failing closed [validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/): failed calling webhook "[validating-webhook.openpolicyagent.org](http://validating-webhook.openpolicyagent.org/)": the server could not find the requested resource

[anderseknert]

It only pertains to the "undefined_document" error, but the error shown in the Kubernetes API server logs are likely a consequence of that. Strange how that would just pop up — we've not done any changes in that are in quite some time. How are your policies loaded into OPA? Is it via a mounted volume? And could that have changed somehow?

[forgedbrew]

Thanks, @anderseknert. We found the issue.

Someone created a DNS record for localhost, so it was resolving to an actual IP address instead of 127.0.0.1
Therefore, when the OPA pods started up and made their calls to obtain the policies from the ConfigMap, they failed and the OPA webhook didn't get the policies.

[anderseknert]

Oh! Happy to hear it was resolved 👍