oscerd opened a new pull request, #26669: URL: https://github.com/apache/camel/pull/26669
This fixes [CAMEL-24743](https://issues.apache.org/jira/browse/CAMEL-24743). In `wasm` mode the policy is evaluated in-process, so there is no OPA server to probe. `OpaProducer` no longer registers its readiness check in that mode — it previously did, contradicting the documentation, which already said no check is registered. `serverUrl` and `bearerToken` have no meaning without a server, so the endpoint now warns at startup when either was set. **A note on `failOpen` — a deviation from the issue.** The issue proposed *failing fast* on `failOpen` in `wasm` mode, on the basis that "nothing can be unreachable". That premise doesn't hold: `failOpen` lives in the shared `OpaPolicyEvaluator` and governs how an *evaluation failure* is handled, and a `wasm` evaluation can fail — a busy pool (`borrowTimeout`), a bad bundle, an input that won't serialize. Rejecting `failOpen` here would revert CAMEL-24741 and contradict the "Evaluation modes" docs, which say such a failure "fails closed or proceeds under `failOpen` like any other". So `failOpen` is left applicable in both modes, and the one doc sentence that wrongly listed it among the options with "no meaning in wasm mode" is corrected instead. If the intent was to make `wasm` strictly fail-closed, that's a larger change to CAMEL-24741 and should be decided on its own. **Tests** (`OpaWasmModeValidationTest`): no producer health check is registered in `wasm` mode, and `failOpen` is accepted rather than rejected. Both use the committed `authz.wasm` fixture. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
