oscerd opened a new pull request, #264:
URL: https://github.com/apache/camel-examples/pull/264
## What
Adds `camel-opa` (CAMEL-24634) to the `spiffe` example: SPIFFE keeps
authenticating the callers, Open Policy Agent now decides what an authenticated
caller may do.
- The shared `WorkloadIdentityPolicy` route configuration validates the
JWT-SVID as before, then calls `opa:camel/spiffe/<service>/allow` with
`includeHeaders=CamelSpiffeSpiffeId,X-On-Behalf-Of`, so OPA only sees the
SPIFFE ID of the caller (and, on the second hop, on whose behalf it calls) plus
the route id. The token never leaves the application. The
`CamelOpaDecisionAllow` header drives the 403, and an
`OpaPolicyEvaluationException` becomes a 503: the policy fails closed.
- The allow-lists move from `application.properties` to Rego:
`opa/backend.rego` (who may call `orders` and `audit`) and `opa/inventory.rego`
(the backend only, and only on behalf of a caller who may read the orders, by
referring to the backend's permissions in the same OPA). `opa/policy_test.rego`
holds 10 Rego unit tests, run with `opa test`.
- Compose gains an `opa` service (`openpolicyagent/opa:1.9.0-static`,
policies bind-mounted, `--watch` so edits reload, console decision logs, port
8181 published). The README shows how to ask OPA directly, read its decision
log, and change who may do what by editing the Rego file without rebuilding
anything.
- `AllowList` is removed; the tests bind a mocked `OPAClient` (autowired by
the component, like the SPIFFE client) that decides like the Rego policies and
lets the tests check the input document sent to OPA.
## Notes
- The OPA Java SDK declares Jackson 2.17 while Camel manages 2.22, and
`camel-bom` does not manage Jackson, so the example imports `jackson-bom` at
`${jackson2-version}`. Without it the mix of `jackson-databind` 2.22 and
`jackson-annotations` 2.17 fails at runtime.
- The bind mount of the policies uses the `z` flag so that it works on
SELinux hosts.
## Verification
18 unit tests and 10 Rego tests pass, Apache RAT passes, and the stack was
run end to end: 200/403 matrix from OPA decisions, the inventory delegation
rule, the decision log showing only the SPIFFE ID and the route id, and a
direct query to OPA.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
