Visibility of why http.send is not working

[tg-44]

I am struggling to understand why my Rego does not seem to behaving as expected when deployed along side my OPA service in Kubernetes.

The example Rego can be found here, note its a very contrived example but illustrates the problem I am having.

https://play.openpolicyagent.org/p/GoxD6aXwGN

I can get this to work fine when using OPA eval and with the URL pointing to a locally running API. So I know the Rego is fine.

But when deploying the OPA server to Kubernetes, and with the Rego URL pointing to an internal Kubernetes services it does not work.

The fact it doesn't work is fine, as if I can work out what the issue is then i can iterate to resolve the problem.

But the problem is I have NO visibility whatsoever of what's going on.

I have enabled debug logging on the server, then viewed the pod logs; but this does not seem to surface issues encountered in the Rego.
I have enabled decision logs, but this is also the same.

How on earth do you get the visibility necessary to be able to identify what is going wrong so that you can make changes to resolve the problem?

see below my Kubernetes deployment.

apiVersion: v1
kind: ConfigMap
metadata:
  name: opa-config
data:
  opa-config.yaml: |

    services:
      my-logs:
        url: https://webhook.site/82913bd1-76a8-4071-bbb2-8ef4346be390

    decision_logs:
      console: true
      service: my-logs
      reporting:
        min_delay_seconds: 5
        max_delay_seconds: 30
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: example-policy
data:
  externalcall.rego: |
    package example.authz

    default allow := false

    case_id := input.caseId

    allow if {
      lead_id := case_lead_id(caseId)
      lead_id == "10"
    }

    case_lead_id(case_id) := lead_id if {
      response := http.send({
        "method": "GET",
        "url": sprintf("http://accessapi-service.opa.svc.cluster.local:8080/case/getleadId?caseId=%v", [case_id]),
        "headers": {"Authorization": "Bearer some-token"},
      })

      response.status_code == 200
      lead_id := response.body.leadId
    }

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: opa
  labels:
    app: opa
spec:
  replicas: 1
  selector:
    matchLabels:
      app: opa
  template:
    metadata:
      labels:
        app: opa
      name: opa
    spec:
      containers:
      - name: opa
        image: openpolicyagent/opa:1.5.1
        ports:
        - name: http
          containerPort: 8181
        args:
        - "run"
        - "--ignore=.*" # exclude hidden dirs created by Kubernetes
        - "--server"
        - "--log-level=debug"
        - "--format=json"
        - "--log-format=json"
        - "--set=decision_logs.console=true"
        - "--config-file=/config/opa-config.yaml"
        - "/policies"
        volumeMounts:
        - readOnly: true
          mountPath: /policies
          name: example-policy
        - readOnly: true
          mountPath: /config
          name: opa-config
      volumes:
      - name: example-policy
        configMap:
          name: example-policy
      - name: opa-config
        configMap:
          name: opa-config

Any idea how I can debug what is happening by getting some visibility of what is failing?

[anderseknert]

Hi there! On my phone but you’ll want to look into:

1. The strict-builtin-errors parameter on the endpoint
2. The raise_error attribute on the http.send config object

[anderseknert]

@tg-44 did you get it to work eventually?