[
https://issues.apache.org/jira/browse/CAMEL-24743?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18117648#comment-18117648
]
Andrea Cosentino commented on CAMEL-24743:
------------------------------------------
Implemented as PR #26669 (https://github.com/apache/camel/pull/26669).
Implemented, with one deviation flagged for review.
The issue proposes failing fast on failOpen in wasm mode ("nothing can be
unreachable"). On investigation failOpen is not meaningless in wasm: it lives
in the shared OpaPolicyEvaluator.evaluate() and governs how *any* evaluation
failure is handled, and a wasm evaluation can fail - a busy pool
(borrowTimeout), a bad bundle, an input that won't serialize. The "Evaluation
modes" documentation already states a wasm evaluation failure "fails closed or
proceeds under failOpen like any other", so rejecting failOpen would revert
CAMEL-24741 and contradict the docs.
The change therefore: (1) skips the producer health check in wasm mode (no
server to probe); (2) warns at startup when serverUrl/bearerToken are set in
wasm mode (genuinely ignored); (3) corrects the one documentation sentence that
wrongly listed failOpen among the "no meaning in wasm" options. failOpen is
left applicable in both modes.
If the intent was instead to make wasm strictly fail-closed (no fail-open path
at all), that is a larger behavioural change to CAMEL-24741 and should be
decided separately.
_Claude Code on behalf of Andrea Cosentino_
> camel-opa - document the WASM mode and gate the server-only options and
> health checks
> -------------------------------------------------------------------------------------
>
> Key: CAMEL-24743
> URL: https://issues.apache.org/jira/browse/CAMEL-24743
> Project: Camel
> Issue Type: Improvement
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
>
> h2. Problem
> Once {{evaluationMode=wasm}} exists, several options and behaviours apply
> only to the REST path:
> * {{serverUrl}}, {{bearerToken}} - no server to address or authenticate to
> * {{failOpen}} - nothing can be unreachable, so the option cannot mean what
> it says
> * the producer health check (CAMEL-24644) and the {{OpaSecurityPolicy}}
> health check (CAMEL-24736) - nothing to probe
> Silently ignoring them would be a poor outcome, and for {{failOpen}}
> specifically it would be a security surprise: an operator who sets
> {{failOpen=true}} and sees no complaint may reasonably believe a fail-open
> path exists.
> h2. Proposal
> * Reject, or warn clearly at startup about, options that do not apply to the
> configured mode. Prefer failing fast for the security-relevant ones.
> * Register no health check in WASM mode, and say so where the checks are
> documented - an absent check must not read as a healthy one.
> * Give {{opa-component.adoc}} a section on choosing a mode: what each gives
> up (decision logs, bundle polling and central management on one side; a
> network hop and a whole class of unreachable-PDP failures on the other), and
> a worked {{opa build -t wasm -e}} example, since a bundle is now a build-time
> artefact the operator has to produce.
> * State that the decision contract is identical across modes, so a route need
> not know which engine evaluated it.
> h2. Scope
> {{main}} only. Docs plus configuration validation.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
