Skip to content

OPA filter smoke tests #157

Description

@pavolloffay

This is a tracking issue for discussing OPA filter testing. The idea is that in agent we want to be able to test OPA filter https://github.com/hypertrace/javaagent/tree/main/filter-custom-opa against running https://github.com/open-policy-agent/opa. The filter gets data from /v1/data and runs evaluation on every request.

I would like to package https://github.com/open-policy-agent/opa into a docker container and make data.json and /v1/policies/remote-bundle/traceable/http/request/policy.rego configurable. This container could be used in smoke tests in all Hypertrace agents. There is already a docker container https://hub.docker.com/r/openpolicyagent/opa - we should have a look if it could be used.

In the meantime the OPA filter can be tested by:

  1. port-forwarding OPA agent from traceableai namespace k port-forward service/opa 8181:8181 -n traceableai
  2. get the data from OPA agent curl localhost:8181/v1/data and pick some IP address from denylist
  3. run agent on a test/demo app and do curl localhost:8080 -H "X-Forwarded-For: <IP from deny list> - the request should be blocked with 403

cc) @mohit-a21 @jcchavezs @davexroth

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions