Parsifal-M / backstage-opa-plugins

Open Policy Agent (OPA) Plugins for Backstage
https://parsifal-m.github.io/backstage-opa-plugins/
Apache License 2.0
46 stars 6 forks source link

[FEAT] Use the Notifications System in Backstage to notify when there is an issue with OPA #219

Open Parsifal-M opened 1 month ago

Parsifal-M commented 1 month ago

Is your feature request related to a problem? Please describe. Something that came to mind when looking into #218 is that if you fall back to say a deny/allow/fail you probably want to be notified that there could be an issue with OPA.

You could set a config value under here once we add policyFallback we could add another value maybe notifyGroup or/and notifyUser and have them receive notifications that there is an issue.

Describe the solution you'd like Using the notifications framework and based on advice by @drodil we could do something like:

1) You can do it pretty easily to OPA plugin directly, you just need probably a config value that contains notification receivers in case of error and add notificationService as optional dependency to the plugin. For this you also probably need a scheduled task to check the status periodically.

2) If it makes sense to use the existing devtools plugin, that would require first a scheduled task to check for the endpoints (+ i would add support for caching as it's possible to generate quite a lot of requests to external systems with this) and secondly support for notifications

Describe alternatives you've considered I think we can always go for Option 1 initially then also look at adding option 2 later on if we can.

Additional context N/A

drodil commented 1 month ago

Just throwing my two cents here; instead single user or group, you might want to add the config as an array. And also it's not only users or groups that notifications support - it can be any entity which the notifications backend will resolve to actual users receiving the notification (users as users, groups by their memberOf relation and other entities by their owner).

But anyways it's good idea to have it here. Possibly for people using the devtools, there could be a config value to disable notifications from OPA plugin, WDYT?

Also pinging @awanlin here.