3pp-mirror/pomerium
1
0
Fork 0
mirror of https://github.com/pomerium/pomerium.git synced 2025-05-20 20:47:16 +02:00
Code Issues Projects Releases Packages Wiki Activity

databroker: add tracing for rego evaluation and databroker sync, fix bug in databroker config source (#1367)

Browse source
This commit is contained in:
Caleb Doxsey 2020-09-03 08:11:34 -06:00 • committed by GitHub
parent 5488e6d5fa
commit 49d1a71ff2
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 21 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

5
authorize/evaluator/custom.go
View file

@ -8,6 +8,8 @@ import (
"github.com/open-policy-agent/opa/rego" "github.com/open-policy-agent/opa/rego"
"github.com/open-policy-agent/opa/storage" "github.com/open-policy-agent/opa/storage"
"github.com/pomerium/pomerium/internal/telemetry/trace"
) )
// A CustomEvaluatorRequest is the data needed to evaluate a custom rego policy. // A CustomEvaluatorRequest is the data needed to evaluate a custom rego policy.
@ -42,6 +44,9 @@ func NewCustomEvaluator(store storage.Store) *CustomEvaluator {
// Evaluate evaluates the custom rego policy. // Evaluate evaluates the custom rego policy.
func (ce *CustomEvaluator) Evaluate(ctx context.Context, req *CustomEvaluatorRequest) (*CustomEvaluatorResponse, error) { func (ce *CustomEvaluator) Evaluate(ctx context.Context, req *CustomEvaluatorRequest) (*CustomEvaluatorResponse, error) {
_, span := trace.StartSpan(ctx, "authorize.evaluator.custom.Evaluate")
defer span.End()
q, err := ce.getPreparedEvalQuery(ctx, req.RegoPolicy) q, err := ce.getPreparedEvalQuery(ctx, req.RegoPolicy)
if err != nil { if err != nil {
return nil, err return nil, err

23
internal/databroker/config_source.go
View file

@ -12,6 +12,7 @@ import (
"github.com/pomerium/pomerium/config" "github.com/pomerium/pomerium/config"
"github.com/pomerium/pomerium/internal/log" "github.com/pomerium/pomerium/internal/log"
"github.com/pomerium/pomerium/internal/telemetry/trace"
"github.com/pomerium/pomerium/pkg/grpc" "github.com/pomerium/pomerium/pkg/grpc"
configpb "github.com/pomerium/pomerium/pkg/grpc/config" configpb "github.com/pomerium/pomerium/pkg/grpc/config"
"github.com/pomerium/pomerium/pkg/grpc/databroker" "github.com/pomerium/pomerium/pkg/grpc/databroker"
@ -70,6 +71,9 @@ func (src *ConfigSource) GetConfig() *config.Config {
} }
func (src *ConfigSource) rebuild(firstTime bool) { func (src *ConfigSource) rebuild(firstTime bool) {
_, span := trace.StartSpan(context.Background(), "databroker.config_source.rebuild")
defer span.End()
src.mu.Lock() src.mu.Lock()
defer src.mu.Unlock() defer src.mu.Unlock()
@ -83,10 +87,18 @@ func (src *ConfigSource) rebuild(firstTime bool) {
seen[policy.RouteID()] = struct{}{} seen[policy.RouteID()] = struct{}{}
} }
var additionalPolicies []config.Policy
// add all the config policies to the list // add all the config policies to the list
for _, cfgpb := range src.dbConfigs { for _, cfgpb := range src.dbConfigs {
cfg.Options.ApplySettings(cfgpb.Settings) cfg.Options.ApplySettings(cfgpb.Settings)
err := cfg.Options.Validate()
if err != nil {
log.Warn().Err(err).Msg("databroker: invalid config detected, ignoring")
return
}
for _, routepb := range cfgpb.GetRoutes() { for _, routepb := range cfgpb.GetRoutes() {
policy, err := config.NewPolicyFromProto(routepb) policy, err := config.NewPolicyFromProto(routepb)
if err != nil { if err != nil {
@ -112,15 +124,12 @@ func (src *ConfigSource) rebuild(firstTime bool) {
} }
seen[routeID] = struct{}{} seen[routeID] = struct{}{}
cfg.Options.Policies = append(cfg.Options.Policies, *policy) additionalPolicies = append(additionalPolicies, *policy)
}
} }
err := cfg.Options.Validate() // add the additional policies here since calling `Validate` will reset them.
if err != nil { cfg.Options.Policies = append(cfg.Options.Policies, additionalPolicies...)
log.Warn().Err(err).Msg("databroker: invalid config detected, ignoring")
return
}
}
src.computedConfig = cfg src.computedConfig = cfg
if !firstTime { if !firstTime {