Open Policy Agent
Data API #100
-
|
Hi, { Other requests direct to OPA, such as GET and POST work fine. I suspect I'm doing something daft, but can't figure out what... |
Beta Was this translation helpful? Give feedback.
Replies: 2 comments 5 replies
-
|
Hi Phil! When OPA get policies and data from a bundle, that bundle by default "owns" the paths (in this context, called "roots") declared by that bundle. This means that you can't modify the data from any paths provided by the bundle via the REST API. Unless paths are explicitly declared inside of the bundle, the default will be If you would like to split this apart, and have the policy be provided via a bundle, but the data via the REST API, you can do so by explicitly declare what "roots" are owned by the bundle, and publish your data on a different root. This is done via a As an example - if your policy resides under the "policy" root (i.e. your policy is declared with {
"roots": ["policy"]
}You can now modify any data that isn't under {
"my-data": {
"your-data": "here"
}
}But this would not work: {
"policy": {
"your-data": "here"
}
}Since the |
Beta Was this translation helpful? Give feedback.
-
|
Sorry about this, I'm really struggling with the documentation. I tried just creating the bundle by hand using tar, but I still get the 400 - "all paths owned by package nginx", and decisions seem to be using the 'roots' from the data.json that was deployed in an earlier attempt (when .manifest was renamed as such by opa build). Policy decisions now look like this: { This is after is deployed the hand-build bundle.tar.gz (using the bundle server from the API example). If I list policies, I get this: "result": [ |
Beta Was this translation helpful? Give feedback.
-
|
The output of
If you provide the |
Beta Was this translation helpful? Give feedback.
-
|
Thanks.. I still get an error, and again, can't track down where it's explained in the docs... I now have this rego doc (from the API example): package httpapi.authz default allow = false Allow users to get their own salaries.allow { Allow managers to get their subordinates' salaries.allow { And this manifest: { These are co-located in a folder. From that folder, I run opa build -b . and get: error: load error: bundle .: manifest roots [policy] do not permit 'package httpapi.authz' in module 'example.rego' I tried modifying the roots to include the package: { But still get a very similar error: error: load error: bundle .: manifest roots [policy httpapi.authz] do not permit 'package httpapi.authz' in module 'example.rego' |
Beta Was this translation helpful? Give feedback.
-
|
The root in the manifest would need to match the package, i.e. “ httpapi/authz”. See the bundle docs for an explanation of “roots”. |
Beta Was this translation helpful? Give feedback.
-
|
That's it! |
Beta Was this translation helpful? Give feedback.
-
|
I'm pleased to hear that Phil! I'll raise/prioritize some of the issues you encountered when working with this. Thanks for bearing with me! |
Beta Was this translation helpful? Give feedback.
The output of
opa build --helpcould perhaps do a better job of explaining this, and this ticket should help when implemented, but here's the key paragraph:If you provide the
-b(or--bundle) flag toopa build, the directory structure will be assumed to be that of a bundle, and your .manifest …