ashutosh-narkar
commented
1 year ago @jakubdyszkiewicz thanks for reporting this. Are you using bundles to serve the policies or some other way? I tried with your policy to repro this.
policy.rego
package envoy.authz
import input.attributes.request.http as http_request
default allow = false
allow {
http_request.method == "GET"
}config.yaml
plugins:
envoy_ext_authz_grpc:
addr: :9191
dry-run: false
enable-reflection: true
decision_logs:
console: trueThen run opa-envoy:
$ opa_envoy run --server --config-file=config.yaml policy.rego
{"addrs":[":8181"],"diagnostic-addrs":[],"level":"info","msg":"Initializing server.","time":"2023-01-25T10:55:12-08:00"}
{"level":"info","msg":"Starting decision logger.","plugin":"decision_logs","time":"2023-01-25T10:55:12-08:00"}
{"addr":":9191","dry-run":false,"enable-reflection":true,"level":"info","msg":"Starting gRPC server.","path":"test/hello","query":"","time":"2023-01-25T10:55:12-08:00"}
^C{"level":"info","msg":"Shutting down...","time":"2023-01-25T10:55:14-08:00"}
{"level":"info","msg":"Server shutdown.","time":"2023-01-25T10:55:14-08:00"}
{"level":"info","msg":"Stopping decision logger.","plugin":"decision_logs","time":"2023-01-25T10:55:14-08:00"}
jakubdyszkiewicz
Hey 👋
Short description
We use OPA in Kong Mesh by embedding it in our sidecar. We noticed that whenever we add multiple policies to the runtime store and send a request, OPA agent panics. I built a minimal repo https://github.com/jakubdyszkiewicz/opa-envoy-panic-repro to reproduce it
If we somehow misuse the API, I'd love to know what we should improve.
Here is the log.
I tried it with both 0.48.0 and 0.47.4, same result.
Steps To Reproduce
I built a minimal repo https://github.com/jakubdyszkiewicz/opa-envoy-panic-repro
Expected behavior
No panic.
Thanks for all the help!