open-policy-agent/opa

`opa inspect` failure on custom funcs in policies

Closed this issue · 6 comments

simar7 commented

Short description

Since version v0.59.0, any bundles that include custom functions in their policies have now started to fail as undefined function.

Steps To Reproduce

  1. Create a bundle with a policy that contains a custom function
  2. Package the bundle
  3. Run opa inspect on the bundle
  4. Observe: rego_type_error: undefined function custom.func.name.here

Expected behavior

While the error seems correct, there also doesn't seem to be a way to define and load a custom function used in policies either to enable opa inspect to not throw any errors.

Additional context

These custom functions are defined loaded via the Go SDK during OPA initialization. They work just fine when done so, but during opa inspect they fail as the OPA cli has no way to know about the definitions of these custom functions.

This error has started since v0.59.0. Prior versions are unaffected.

anderseknert commented

Thanks for reporting this @simar7. We'll look into it.

ashutosh-narkar commented

@simar7 it would be helpful if you could provide a simple policy that fails inspect. Just having a custom function in a policy should not fail inspect. So if you help with a simple repro case that would be good.

simar7 commented

@simar7 it would be helpful if you could provide a simple policy that fails inspect. Just having a custom function in a policy should not fail inspect. So if you help with a simple repro case that would be good.

Any bundle with a policy that has a custom function fails it. Here's an example as done in the PR https://github.com/open-policy-agent/opa/pull/6462/files#diff-29da7cb39323409b7f0e930998e9da29487fdc6c3f8c52d838efa9b48827f7d2R571-R577

Keep in mind this custom function is loaded via the Go SDK later on during runtime. During inspect, there's no such setup.

ashutosh-narkar commented

Thanks for the context. So if you try to build a bundle with that policy it will fail too. This is true for pre-OPA 0.59.0. I imagine you're not using OPA tooling to build the bundle. You mention this was working pre-OPA 0.59.0. Is this correct?

HarshPathakhp commented

Hi @johanfylling @ashutosh-narkar
I think the fix here solves the problem only partially. I have an example below for which inspect still fails.

package play
import data.x.y as y

default r := false
r {
    y(1) == true
}

Tried this on 0.61.0. Steps to reproduce as below -

  1. tar -czvf bundle.tar.gz authz.rego
  2. opa inspect bundle.tar.gz

The error complains of an unsafe expression error: 1 error occurred: bundle/authz.rego:6: rego_unsafe_var_error: expression is unsafe

Unlike the author of this post, my dependency is coming from another bundle, which is loaded at runtime in OPA. However, I can't run the inspect command. It was working before v0.59.0

johanfylling commented

Thank you for reporting this @HarshPathakhp! I've created a separate bug report for tracking this issue: #6591.

  • 👍1