-
Notifications
You must be signed in to change notification settings - Fork 108
Closed
Description
The opa-kube-mgmt helm chart is not compatible with OPA v1.
When setting the image in values.yaml to 1.0.0-envoy-4 (should be same issue with the 'normal' 1.0.0) the following error blocks the startup of the OPA container:
error: load error: 4 errors occurred during loading:
/bootstrap/authz.rego:4: rego_parse_error: `if` keyword is required before rule body
/bootstrap/authz.rego:5: rego_parse_error: `if` keyword is required before rule body
/bootstrap/authz.rego:7: rego_parse_error: `if` keyword is required before rule body
/bootstrap/authz.rego:8: rego_parse_error: `if` keyword is required before rule body
In incident open-policy-agent/opa#7262 srenatus found the issue to be in the deployment.yaml file of the helm chart:
kube-mgmt/charts/opa-kube-mgmt/templates/deployment.yaml
Lines 63 to 71 in ae2e69d
| allow { input.path = [""]; input.method = "POST" } | |
| allow { input.path = [""]; input.method = "GET" } | |
| # This is only used for health check in liveness and readiness probe | |
| allow { input.path = ["health"]; input.method = "GET" } | |
| {{- if .Values.prometheus.enabled }} | |
| # This allows metrics to be scraped by prometheus | |
| allow { input.path = ["metrics"]; input.method = "GET" } | |
| {{- end }} | |
| allow { input.identity == "$TOKEN" } |
This rego policy is not compatible with rego v1. OPA v1 defaults to rego v1.
Reactions are currently unavailable
Metadata
Metadata
Assignees
Labels
No labels