open-policy-agent/opa

"Overlapping roots problem" With bundles appearing only on the linux executable for latest versions

Closed this issue · 8 comments

Hi I'm working on a project that uses multiple bundles. One of them is a local bjndle and is run by OPA linux executable.

The local bundle contains roots of the sort "foo/bar".

The incoming bundle contains data in the hierarchy "foo/baz". It contains a .manifest containing roots as the same.

We want the data variable to look like
{foo: {
bar: {...},
baz: {...}
}}

This works locally on the mac with the latest version, but on the linux server it doesn't because of the overlapping roots problem.

It was working with older versions of the linux executable which we've been using until now and trying to upgrade from.

Thank you,
Rohit

Would you be able to figure out what the "old version" here was? What are the command line calls you've used to try it locally?

Old version was 0.37.1

We just use opa run both places

Can you share your manifest files, or an MRE?

In the incoming bundle it's as simple as
{
"roots":[" foo/baz"],
"revisions": ""
}

and the local bundle doesn't have a .manifest - which causes no error locally, but only while it's executed in the server.

and the local bundle doesn't have a .manifest - which causes no error locally, but only while it's executed in the server.

Hmm a bundle without a manifest implicitly has roots: "", i.e. everything. Can you try declaring the proper roots for both the local and the "incoming" bundle?

Old version was 0.37.1

That very old. Could be that some bug was changed in between then and now -- since overlapping roots should be forbidden.

An MRE here would be a sequence of calls and setup things to reproducibly get to the error. While you've outlined the situation, there are still a few gaps to fill when trying to reproduce it, and the details matter. 😅

If bundle1 contains
{foo: {
bar: {...}
}} with default roots

And bundle2 contains
{foo: {
bazz: {...}
}} with "foo/bazz" As the root

Does that constitute overlapping roots?

Does that constitute overlapping roots?

Yes, "default roots" means "", everything. So "foo/bazz" overlaps with "everything", because everything overlaps with everything. It wouldn't overlap if bundle1 would declare its roots as ["foo/bar"].

Closing this issue. As Stephan mentioned above if you declare your roots in the manifest the bundles will not overlap. Feel free to start a Discussion if you have more questions. Thanks!