[
https://issues.apache.org/jira/browse/CAMEL-24743?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino updated CAMEL-24743:
-------------------------------------
Fix Version/s: 4.23.0
> camel-opa - document the WASM mode and gate the server-only options and
> health checks
> -------------------------------------------------------------------------------------
>
> Key: CAMEL-24743
> URL: https://issues.apache.org/jira/browse/CAMEL-24743
> Project: Camel
> Issue Type: Improvement
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
> Fix For: 4.23.0
>
>
> h2. Problem
> Once {{evaluationMode=wasm}} exists, several options and behaviours apply
> only to the REST path:
> * {{serverUrl}}, {{bearerToken}} - no server to address or authenticate to
> * {{failOpen}} - nothing can be unreachable, so the option cannot mean what
> it says
> * the producer health check (CAMEL-24644) and the {{OpaSecurityPolicy}}
> health check (CAMEL-24736) - nothing to probe
> Silently ignoring them would be a poor outcome, and for {{failOpen}}
> specifically it would be a security surprise: an operator who sets
> {{failOpen=true}} and sees no complaint may reasonably believe a fail-open
> path exists.
> h2. Proposal
> * Reject, or warn clearly at startup about, options that do not apply to the
> configured mode. Prefer failing fast for the security-relevant ones.
> * Register no health check in WASM mode, and say so where the checks are
> documented - an absent check must not read as a healthy one.
> * Give {{opa-component.adoc}} a section on choosing a mode: what each gives
> up (decision logs, bundle polling and central management on one side; a
> network hop and a whole class of unreachable-PDP failures on the other), and
> a worked {{opa build -t wasm -e}} example, since a bundle is now a build-time
> artefact the operator has to produce.
> * State that the decision contract is identical across modes, so a route need
> not know which engine evaluated it.
> h2. Scope
> {{main}} only. Docs plus configuration validation.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
