Help with Policies not loading from bundle

[John-Vaughan]

so, the application or writing needs to generate bundles on the fly and i've manage to get this far as generating it,
It seems to check the rego, but doesn't actually load it

so the bundle
bundle.tar.gz

.manifest

{
  "revision": "2024-04-09 13:43:23",
  "roots": ["play", "data/play"]
}

allow.rego

package play

import future.keywords.in

default allow = false

allow {
	is_bob
	can_be_accessed_by_bob
}

is_admin() {
    print("input", input)
	input.context.identity.user == "admin"
}

is_bob() {
    print("input", input)
	input.context.identity.user == "bob"
}

can_be_accessed_by_bob() {
    print("input", input)
    input.action.operation in ["ImpersonateUser", "FilterCatalogs", "AccessCatalog", "ExecuteQuery"]
}

so, When Loading via the endpoint

services:
  acmecorp:
    url: https://host.docker.internal:7157/api/OPA/BundleGet
    allow_insecure_tls : true

discovery:
  service: acmecorp
  resource: /example/discovery.tar.gz

so it does query the endpoint, and retrieve the bundle, and as some sort of checking since it does complain about package the package is not been specified in manifest, however I think I got it into a working state, where the docker logs

2024-04-09 14:59:56 {"level":"info","msg":"Discovery update processed successfully.","plugin":"discovery","time":"2024-04-09T13:59:56Z"

The however when i query

GET http://localhost:8181/v1/policies
=
{
    "result": []
}

but If I

PUT http://localhost:8181/v1/policies/play

the policie it work and shows up in the policies at /v1/policies

so Something in a bundle is causing out to be loaded properly and I can't tell what it is?

[ashutosh-narkar]

What does your discovery policy bundle look like? Also turn on debug logging to see more logs that can help with the invstigation.

[John-Vaughan]

with debug

2024-04-11 11:09:14 {"level":"debug","msg":"Download starting.","time":"2024-04-11T10:09:14Z"}
2024-04-11 11:09:14 {"headers":{"Prefer":["modes=snapshot,delta"],"User-Agent":["Open Policy Agent/0.61.0 (linux, amd64)"]},"level":"debug","method":"GET","msg":"Sending request.","time":"2024-04-11T10:09:14Z","url":"https://host.docker.internal:7157/api/OPA/BundleGet/example/discovery.tar.gz"}
2024-04-11 11:09:14 {"headers":{"Content-Length":["564"],"Content-Type":["application/gzip"],"Date":["Thu, 11 Apr 2024 10:09:13 GMT"],"Server":["Kestrel"]},"level":"debug","method":"GET","msg":"Received response.","status":"200 OK","time":"2024-04-11T10:09:14Z","url":"https://host.docker.internal:7157/api/OPA/BundleGet/example/discovery.tar.gz"}
2024-04-11 11:09:14 {"level":"debug","msg":"Download in progress.","time":"2024-04-11T10:09:14Z"}
2024-04-11 11:09:14 {"level":"info","msg":"Discovery update processed successfully.","plugin":"discovery","time":"2024-04-11T10:09:14Z"}
2024-04-11 11:09:14 {"level":"debug","msg":"Waiting 1m28.542264757s before next download/retry.","time":"2024-04-11T10:09:14Z

[srenatus]

Is there a misunderstanding here, perhaps? The flow usually works like this:

1. the discovery bundle is evaluated, and it results in a config
2. that config contains a bundle definition (or more)
3. that bundle is pulled and that's where policies are taken from

So, the discovery bundle only contains a piece of (static or dynamic) config, no policies and no data that would be kept after evaluation the discovery bundle.

[John-Vaughan]

so, are you saying that the bundle, just contains configuration, on where to pull a bundle from to get the actual policies?
How would I configure this?

[srenatus]

So you can either have a configuration for using a (simple) bundle: config + docs

Or you can use a discovery bundle if you need more flexibility: config + docs

If you don't have a need for that, don't use a discovery bundle.

[John-Vaughan]

yeah that was it
Updated the config to

services:
  acmecorp:
    url: https://host.docker.internal:7157/api/OPA/BundleGet
    allow_insecure_tls : true

bundles:
  authz:
    service: acmecorp
    resource: somedir/bundle.tar.gz
    persist: true
    polling:
      min_delay_seconds: 60
      max_delay_seconds: 120

thanks