Skip to content

Helm chart not compatible with OPA v1 #272

@Skoucail

Description

@Skoucail

The opa-kube-mgmt helm chart is not compatible with OPA v1.
When setting the image in values.yaml to 1.0.0-envoy-4 (should be same issue with the 'normal' 1.0.0) the following error blocks the startup of the OPA container:

error: load error: 4 errors occurred during loading:
/bootstrap/authz.rego:4: rego_parse_error: `if` keyword is required before rule body
/bootstrap/authz.rego:5: rego_parse_error: `if` keyword is required before rule body
/bootstrap/authz.rego:7: rego_parse_error: `if` keyword is required before rule body
/bootstrap/authz.rego:8: rego_parse_error: `if` keyword is required before rule body

In incident open-policy-agent/opa#7262 srenatus found the issue to be in the deployment.yaml file of the helm chart:

allow { input.path = [""]; input.method = "POST" }
allow { input.path = [""]; input.method = "GET" }
# This is only used for health check in liveness and readiness probe
allow { input.path = ["health"]; input.method = "GET" }
{{- if .Values.prometheus.enabled }}
# This allows metrics to be scraped by prometheus
allow { input.path = ["metrics"]; input.method = "GET" }
{{- end }}
allow { input.identity == "$TOKEN" }

This rego policy is not compatible with rego v1. OPA v1 defaults to rego v1.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions