davsclaus commented on code in PR #26664:
URL: https://github.com/apache/camel/pull/26664#discussion_r4060485739
##########
components/camel-opa/src/main/docs/opa-component.adoc:
##########
@@ -326,6 +326,25 @@ decision point available".
Setting `failOpen=true` reverses this and lets the exchange proceed when the
policy cannot be evaluated. It exists
for development and for non-critical policies, and should not be enabled in
production.
+An exchange that proceeds that way carries `CamelOpaDecisionFailedOpen=true`.
`CamelOpaDecisionAllow` is `true`
+in both cases, and on its own it cannot tell "a policy allowed this" from "no
policy ran and we were told to
+proceed" — which is exactly the distinction an audit trail needs. The marker
is set only on the fail-open path,
+so a route can branch on it and an operator can alert on its presence:
+
+[source,java]
+------------------------------------------------------------
+from("platform-http:/orders")
+ .to("opa:authz/orders/allow?failOpen=true")
+ .choice()
+ .when(header(OpaConstants.DECISION_FAILED_OPEN).isEqualTo(true))
+ .to("log:unauthorized?level=WARN")
+ .end()
+ .to("direct:orders")
+------------------------------------------------------------
+
+Like the other decision headers it is cleared before every evaluation, so a
message cannot arrive claiming
Review Comment:
Non-blocking: the evaluator is shared with `OpaSecurityPolicy`, so this
marker is also set when a *policy* fails open, but the paragraph only lives in
the producer's `failOpen` section. A short cross-reference in the policy
section (where `healthCheckEnabled=false ... one running failOpen` is
mentioned) would tell route authors using `.policy(...)` that the same
`CamelOpaDecisionFailedOpen` header applies there too.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
