[CSPM] use text/template-less fork of opa #36634
Conversation
github-actions
bot
added
short review
|
/ddci trigger |
|
View all feedbacks in Devflow UI.
child workflow execution error (type: changeorchestrator.Changeorchestrator_GenerateDDCIRequestFromDevflow, workflowID: 703cd788-ca84-4bc9-99f0-a0c77f107613_32, runID: fcb2c0ed-1bd2-4b9e-a874-ccf600fe75fb, initiatedEventID: 32, startedEventID: 33): Child workflow timeout (type: StartToClose) If you need support, contact us on Slack #devflow with those details! |
|
/ddci trigger |
|
View all feedbacks in Devflow UI.
child workflow execution error (type: changeorchestrator.Changeorchestrator_GenerateDDCIRequestFromDevflow, workflowID: 19e3c0df-bb6f-463a-b961-7adcb2353cf2_32, runID: cccbacd2-f5cd-4ef5-96cd-987aff65fa30, initiatedEventID: 32, startedEventID: 33): Child workflow timeout (type: StartToClose) If you need support, contact us on Slack #devflow with those details! |
paulcacheux
force-pushed
the
paulcacheux/fork-opa
branch
from
c27117e to
f9361ba
Compare
|
/ddci trigger |
|
View all feedbacks in Devflow UI.
✅ Tasks request sent successfully. |
Go Package Import DifferencesBaseline: 3f82913
|
paulcacheux
force-pushed
the
paulcacheux/fork-opa
branch
from
f9361ba to
7a9164d
Compare
github-actions
bot
added
long review
Uncompressed package size comparisonComparison with ancestor Size reduction summary
Diff per package
Decision✅ Passed |
Regression DetectorRegression Detector ResultsMetrics dashboard Baseline: 3f82913 Optimization Goals: ✅ No significant changes detected
|
| perf | experiment | goal | Δ mean % | Δ mean % CI | trials | links |
|---|---|---|---|---|---|---|
| ➖ | docker_containers_cpu | % cpu utilization | +4.14 | [+0.26, +8.02] | 1 | Logs |
| ➖ | docker_containers_memory | memory utilization | +0.13 | [+0.06, +0.20] | 1 | Logs |
| ➖ | quality_gate_idle | memory utilization | +0.13 | [+0.06, +0.20] | 1 | Logs bounds checks dashboard |
| ➖ | file_to_blackhole_0ms_latency_http1 | egress throughput | +0.07 | [-0.57, +0.70] | 1 | Logs |
| ➖ | file_to_blackhole_300ms_latency | egress throughput | +0.05 | [-0.57, +0.67] | 1 | Logs |
| ➖ | uds_dogstatsd_to_api | ingress throughput | +0.01 | [-0.26, +0.29] | 1 | Logs |
| ➖ | file_to_blackhole_0ms_latency | egress throughput | +0.01 | [-0.61, +0.63] | 1 | Logs |
| ➖ | file_to_blackhole_0ms_latency_http2 | egress throughput | +0.01 | [-0.61, +0.62] | 1 | Logs |
| ➖ | tcp_dd_logs_filter_exclude | ingress throughput | -0.00 | [-0.02, +0.02] | 1 | Logs |
| ➖ | file_to_blackhole_1000ms_latency_linear_load | egress throughput | -0.01 | [-0.24, +0.22] | 1 | Logs |
| ➖ | file_to_blackhole_1000ms_latency | egress throughput | -0.02 | [-0.68, +0.65] | 1 | Logs |
| ➖ | otlp_ingest_logs | memory utilization | -0.02 | [-0.14, +0.10] | 1 | Logs |
| ➖ | file_to_blackhole_500ms_latency | egress throughput | -0.08 | [-0.71, +0.56] | 1 | Logs |
| ➖ | ddot_metrics | memory utilization | -0.09 | [-0.21, +0.03] | 1 | Logs |
| ➖ | file_to_blackhole_100ms_latency | egress throughput | -0.11 | [-0.75, +0.53] | 1 | Logs |
| ➖ | ddot_logs | memory utilization | -0.22 | [-0.35, -0.09] | 1 | Logs |
| ➖ | uds_dogstatsd_20mb_12k_contexts_20_senders | memory utilization | -0.25 | [-0.29, -0.20] | 1 | Logs |
| ➖ | otlp_ingest_metrics | memory utilization | -0.28 | [-0.43, -0.13] | 1 | Logs |
| ➖ | quality_gate_logs | % cpu utilization | -0.33 | [-3.09, +2.42] | 1 | Logs bounds checks dashboard |
| ➖ | tcp_syslog_to_blackhole | ingress throughput | -0.37 | [-0.42, -0.32] | 1 | Logs |
| ➖ | uds_dogstatsd_to_api_cpu | % cpu utilization | -0.50 | [-1.37, +0.36] | 1 | Logs |
| ➖ | file_tree | memory utilization | -0.68 | [-0.86, -0.51] | 1 | Logs |
| ➖ | quality_gate_idle_all_features | memory utilization | -1.13 | [-1.24, -1.03] | 1 | Logs bounds checks dashboard |
Bounds Checks: ✅ Passed
| perf | experiment | bounds_check_name | replicates_passed | links |
|---|---|---|---|---|
| ✅ | docker_containers_cpu | simple_check_run | 10/10 | |
| ✅ | docker_containers_memory | memory_usage | 10/10 | |
| ✅ | docker_containers_memory | simple_check_run | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency_http1 | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency_http1 | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency_http2 | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_0ms_latency_http2 | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_1000ms_latency | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_1000ms_latency_linear_load | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_100ms_latency | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_100ms_latency | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_300ms_latency | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_300ms_latency | memory_usage | 10/10 | |
| ✅ | file_to_blackhole_500ms_latency | lost_bytes | 10/10 | |
| ✅ | file_to_blackhole_500ms_latency | memory_usage | 10/10 | |
| ✅ | quality_gate_idle | intake_connections | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_idle | memory_usage | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | intake_connections | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_idle_all_features | memory_usage | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_logs | intake_connections | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_logs | lost_bytes | 10/10 | bounds checks dashboard |
| ✅ | quality_gate_logs | memory_usage | 10/10 | bounds checks dashboard |
Explanation
Confidence level: 90.00%
Effect size tolerance: |Δ mean %| ≥ 5.00%
Performance changes are noted in the perf column of each table:
- ✅ = significantly better comparison variant performance
- ❌ = significantly worse comparison variant performance
- ➖ = no significant change in performance
A regression test is an A/B test of target performance in a repeatable rig, where "performance" is measured as "comparison variant minus baseline variant" for an optimization goal (e.g., ingress throughput). Due to intrinsic variability in measuring that goal, we can only estimate its mean value for each experiment; we report uncertainty in that value as a 90.00% confidence interval denoted "Δ mean % CI".
For each experiment, we decide whether a change in performance is a "regression" -- a change worth investigating further -- if all of the following criteria are true:
-
Its estimated |Δ mean %| ≥ 5.00%, indicating the change is big enough to merit a closer look.
-
Its 90.00% confidence interval "Δ mean % CI" does not contain zero, indicating that if our statistical model is accurate, there is at least a 90.00% chance there is a difference in performance between baseline and comparison variants.
-
Its configuration does not mark it "erratic".
CI Pass/Fail Decision
✅ Passed. All Quality Gates passed.
- quality_gate_idle_all_features, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle_all_features, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check lost_bytes: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_logs, bounds check memory_usage: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check intake_connections: 10/10 replicas passed. Gate passed.
- quality_gate_idle, bounds check memory_usage: 10/10 replicas passed. Gate passed.
Static quality checks✅ Please find below the results from static quality gates Successful checksInfo
|
paulcacheux
force-pushed
the
paulcacheux/fork-opa
branch
from
da566c9 to
5432df2
Compare
github-actions
bot
added
medium review
paulcacheux
force-pushed
the
paulcacheux/fork-opa
branch
from
5432df2 to
012c010
Compare
github-actions
bot
added
short review
paulcacheux
force-pushed
the
paulcacheux/fork-opa
branch
from
012c010 to
c5162ce
Compare
paulcacheux
force-pushed
the
paulcacheux/fork-opa
branch
from
c5162ce to
5773847
Compare
paulcacheux
changed the title
opa with fork branch
paulcacheux
added
changelog/no-changelog
team/agent-cspm
qa/done
There was a problem hiding this comment.
Pull Request Overview
This PR updates the dependency on OPA by switching to our lightweight fork aimed at reducing binary size and enabling dead code elimination.
- Replaces the upstream OPA dependency with a forked version in go.mod
- Removes an unused OPA licensing entry from LICENSE-3rdparty.csv
Reviewed Changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
| go.mod | Added a replacement directive for the forked OPA library with an explanatory comment. |
| LICENSE-3rdparty.csv | Removed an entry for OPA capabilities license to reflect the change in dependency usage. |
Comments suppressed due to low confidence (1)
LICENSE-3rdparty.csv:1496
- Verify that removing the licensing notice for OPA capabilities is compliant with our licensing policies and that no required acknowledgements are missed in our documentation.
-core,github.com/open-policy-agent/opa/v1/capabilities,Apache-2.0,Copyright 2016 The OPA Authors. All rights reserved.
| @@ -1013,6 +1013,9 @@ replace ( | |||
| k8s.io/client-go => k8s.io/client-go v0.31.2 | |||
| ) | |||
|
|
|||
| // Fork to remove some text/template usage, https://github.com/paulcacheux/opa/tree/lightweight | |||
There was a problem hiding this comment.
Consider expanding the comment to briefly explain the rationale for the fork and any implications for future updates or compatibility.
| // Fork to remove some text/template usage, https://github.com/paulcacheux/opa/tree/lightweight | |
| // Fork to remove some text/template usage due to performance and maintainability concerns. | |
| // This fork eliminates dependencies on text/template to simplify the codebase and improve runtime efficiency. | |
| // Note: This fork may diverge from the upstream repository, making it harder to integrate future updates. | |
| // Developers should evaluate whether upstream changes are critical before attempting to merge them. | |
| // See https://github.com/paulcacheux/opa/tree/lightweight for more details. |
Copilot uses AI. Check for mistakes.
|
/merge |
|
View all feedbacks in Devflow UI.
The expected merge time in
|
What does this PR do?
This PR makes use of our fork of OPA to use a text/template version of the library. This will enable some desired binary size reduction, and also enable the work for dead code elimination enablement.
Diff:
open-policy-agent/opa@release-1.4...paulcacheux:opa:lightweight
Motivation
Describe how you validated your changes
Possible Drawbacks / Trade-offs
Additional Notes