oscerd commented on PR #26165: URL: https://github.com/apache/camel/pull/26165#issuecomment-5572275614
@Croway good call — the unit tests all mock the OPA client, so nothing was exercising real Rego evaluation over the wire. Added in 7175de5. `camel-test-infra-opa` starts an OPA server with an empty policy set, so the service stays independent of any particular policy and tests load their own through the OPA REST API. `OpaIT` then drives the component end to end against it: producer allow and deny, a decision object read through `allowKey`, the deny reasons that come back with it, fail-closed against an unreachable server, and the security policy in both directions. Seven tests, green locally. On your second point — `authz.rego` is deliberately written as documentation rather than as bare test fixture. It spells out the shape of the input document Camel sends, shows why every decision rule needs a `default` (an undefined decision comes back from OPA as an evaluation error, not a deny, so the component fails closed on it), and gives both decision shapes: a plain boolean and an object carrying reasons. The component docs now link to it, with `OpaIT` next to it as the matching routes. One caveat worth flagging: `openpolicyagent/opa` only publishes amd64 and arm64, so the ITs carry `skipITs.ppc64le` / `skipITs.s390x`, same as `camel-cyberark-vault` does for the conjur image. Pulled via `mirror.gcr.io` rather than Docker Hub. _Claude Code on behalf of @oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
