Docker test: Increase timeout to 30s

.github/workflows/tests.yml

@@ -13,44 +13,6 @@ on:
   workflow_dispatch:
 
 jobs:
-  build:
-    services:
-      redis:
-        image: redis
-        ports:
-          - 6379:6379
-        options: >-
-          --health-cmd "redis-cli ping"
-          --health-interval 10s
-          --health-timeout 5s
-          --health-retries 5
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        python-version: ["3.9", "3.10", "3.11", "3.12"]
-
-    steps:
-    - uses: actions/checkout@v2
-    - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v2
-      with:
-        python-version: ${{ matrix.python-version }}
-    - name: Install dependencies
-      run: |
-        python -m pip install --upgrade pip
-        python -m pip install flake8
-        if [ -f requirements.txt ]; then pip install -r requirements.txt; fi
-        if [ -f ./tests/requirements.txt ]; then pip install -r ./tests/requirements.txt; fi
-    - name: Lint with flake8
-      run: |
-        # stop the build if there are Python syntax errors or undefined names
-        flake8 . --count --select=E9,F63,F7,F82 --show-source --statistics
-        # exit-zero treats all errors as warnings. The GitHub editor is 127 chars wide
-        flake8 . --count --exit-zero --max-complexity=10 --max-line-length=127 --statistics
-    - name: Test with pytest
-      run: |
-        pytest
-
   test-docker:
     runs-on: ubuntu-latest
     steps:
@@ -79,19 +41,6 @@ jobs:
           tags: |
             permitio/opal-client:test
 
-      - name: Build client cedar
-        id: build_client_cedar
-        uses: docker/build-push-action@v2
-        with:
-          file: docker/Dockerfile
-          push: false
-          target: client-cedar
-          cache-from: type=registry,ref=permitio/opal-client-cedar:latest
-          cache-to: type=inline
-          load: true
-          tags: |
-            permitio/opal-client-cedar:test
-
       - name: Build server
         id: build_server
         uses: docker/build-push-action@v2
@@ -122,3 +71,57 @@ jobs:
         run: |
           docker-compose -f docker/docker-compose-test.yml logs opal_client | grep "Connected to PubSub server"
           docker-compose -f docker/docker-compose-test.yml logs opal_client | grep "Got policy bundle"
+
+      - name: Bring down stack
+        run: docker-compose -f docker/docker-compose-test.yml down
+
+      - name: Bring up stack
+        run: docker-compose -f docker/docker-compose-test.yml up -d
+
+      - name: Check if OPA is healthy
+        run: ./scripts/wait-for.sh -t 2 http://localhost:8181/v1/data/users -- sleep 10 && curl -s "http://localhost:8181/v1/data/users" | jq '.result.bob.location.country == "US"'
+
+      - name: Output container logs
+        run: docker-compose -f docker/docker-compose-test.yml logs
+
+      - name: check if opal-client was brought up
+        run: |
+          docker-compose -f docker/docker-compose-test.yml logs opal_client | grep "Connected to PubSub server"
+          docker-compose -f docker/docker-compose-test.yml logs opal_client | grep "Got policy bundle"
+
+      - name: Bring down stack
+        run: docker-compose -f docker/docker-compose-test.yml down
+
+      - name: Bring up stack
+        run: docker-compose -f docker/docker-compose-test.yml up -d
+
+      - name: Check if OPA is healthy
+        run: ./scripts/wait-for.sh -t 2 http://localhost:8181/v1/data/users -- sleep 10 && curl -s "http://localhost:8181/v1/data/users" | jq '.result.bob.location.country == "US"'
+
+      - name: Output container logs
+        run: docker-compose -f docker/docker-compose-test.yml logs
+
+      - name: check if opal-client was brought up
+        run: |
+          docker-compose -f docker/docker-compose-test.yml logs opal_client | grep "Connected to PubSub server"
+          docker-compose -f docker/docker-compose-test.yml logs opal_client | grep "Got policy bundle"
+
+      - name: Bring down stack
+        run: docker-compose -f docker/docker-compose-test.yml down
+
+      - name: Bring up stack
+        run: docker-compose -f docker/docker-compose-test.yml up -d
+
+      - name: Check if OPA is healthy
+        run: ./scripts/wait-for.sh -t 2 http://localhost:8181/v1/data/users -- sleep 10 && curl -s "http://localhost:8181/v1/data/users" | jq '.result.bob.location.country == "US"'
+
+      - name: Output container logs
+        run: docker-compose -f docker/docker-compose-test.yml logs
+
+      - name: check if opal-client was brought up
+        run: |
+          docker-compose -f docker/docker-compose-test.yml logs opal_client | grep "Connected to PubSub server"
+          docker-compose -f docker/docker-compose-test.yml logs opal_client | grep "Got policy bundle"
+
+      - name: Bring down stack
+        run: docker-compose -f docker/docker-compose-test.yml down

docker/docker-compose-api-policy-source-example.yml

@@ -37,7 +37,7 @@ services:
       # configures from where the opal client should initially fetch data (when it first goes up, after disconnection, etc).
       # the data sources represents from where the opal clients should get a "complete picture" of the data they need.
       # after the initial sources are fetched, the client will subscribe only to update notifications sent by the server.
-      - OPAL_DATA_CONFIG_SOURCES={"config":{"entries":[{"url":"http://host.docker.internal:7002/policy-data","topics":["policy_data"],"dst_path":"/static"}]}}
+      - OPAL_DATA_CONFIG_SOURCES={"config":{"entries":[{"url":"http://opal-server:7002/policy-data","topics":["policy_data"],"dst_path":"/static"}]}}
       - OPAL_LOG_FORMAT_INCLUDE_PID=true
     ports:
       # exposes opal server on the host machine, you can access the server at: http://localhost:7002

docker/docker-compose-with-callbacks.yml

@@ -32,7 +32,7 @@ services:
       # configures from where the opal client should initially fetch data (when it first goes up, after disconnection, etc).
       # the data sources represents from where the opal clients should get a "complete picture" of the data they need.
       # after the initial sources are fetched, the client will subscribe only to update notifications sent by the server.
-      - OPAL_DATA_CONFIG_SOURCES={"config":{"entries":[{"url":"http://host.docker.internal:7002/policy-data","topics":["policy_data"],"dst_path":"/static"}]}}
+      - OPAL_DATA_CONFIG_SOURCES={"config":{"entries":[{"url":"http://opal_server:7002/policy-data","topics":["policy_data"],"dst_path":"/static"}]}}
       - OPAL_LOG_FORMAT_INCLUDE_PID=true
     ports:
       # exposes opal server on the host machine, you can access the server at: http://localhost:7002

docker/docker-compose-with-kafka-example.yml

@@ -70,7 +70,7 @@ services:
       # configures from where the opal client should initially fetch data (when it first goes up, after disconnection, etc).
       # the data sources represents from where the opal clients should get a "complete picture" of the data they need.
       # after the initial sources are fetched, the client will subscribe only to update notifications sent by the server.
-      - OPAL_DATA_CONFIG_SOURCES={"config":{"entries":[{"url":"http://host.docker.internal:7002/policy-data","topics":["policy_data"],"dst_path":"/static"}]}}
+      - OPAL_DATA_CONFIG_SOURCES={"config":{"entries":[{"url":"http://opal-server:7002/policy-data","topics":["policy_data"],"dst_path":"/static"}]}}
       - OPAL_LOG_FORMAT_INCLUDE_PID=true
     ports:
       # exposes opal server on the host machine, you can access the server at: http://localhost:7002

docker/docker-compose-with-rate-limiting.yml

@@ -31,7 +31,7 @@ services:
       # configures from where the opal client should initially fetch data (when it first goes up, after disconnection, etc).
       # the data sources represents from where the opal clients should get a "complete picture" of the data they need.
       # after the initial sources are fetched, the client will subscribe only to update notifications sent by the server.
-      - OPAL_DATA_CONFIG_SOURCES={"config":{"entries":[{"url":"http://host.docker.internal:7002/policy-data","topics":["policy_data"],"dst_path":"/static"}]}}
+      - OPAL_DATA_CONFIG_SOURCES={"config":{"entries":[{"url":"http://opal-server:7002/policy-data","topics":["policy_data"],"dst_path":"/static"}]}}
       - OPAL_LOG_FORMAT_INCLUDE_PID=true
       # Turns on rate limiting in the server
       # supported formats documented here: https://limits.readthedocs.io/en/stable/quickstart.html#rate-limit-string-notation

docker/docker-compose-with-security.yml

@@ -46,7 +46,7 @@ services:
       # after the initial sources are fetched, the client will subscribe only to update notifications sent by the server.
       # please notice - since we fetch data entries from the OPAL server itself, we need to authenticate to that endpoint
       # with the client's token (JWT).
-      - OPAL_DATA_CONFIG_SOURCES={"config":{"entries":[{"url":"http://host.docker.internal:7002/policy-data","config":{"headers":{"Authorization":"Bearer ${OPAL_CLIENT_TOKEN}"}},"topics":["policy_data"],"dst_path":"/static"}]}}
+      - OPAL_DATA_CONFIG_SOURCES={"config":{"entries":[{"url":"http://opal-server:7002/policy-data","config":{"headers":{"Authorization":"Bearer ${OPAL_CLIENT_TOKEN}"}},"topics":["policy_data"],"dst_path":"/static"}]}}
       - OPAL_LOG_FORMAT_INCLUDE_PID=true
       # --------------------------------------------------------------------------------
       # the jwt audience and jwt issuer are not typically necessary in real setups

docker/docker-compose-with-statistics.yml

@@ -32,7 +32,7 @@ services:
       # configures from where the opal client should initially fetch data (when it first goes up, after disconnection, etc).
       # the data sources represents from where the opal clients should get a "complete picture" of the data they need.
       # after the initial sources are fetched, the client will subscribe only to update notifications sent by the server.
-      - OPAL_DATA_CONFIG_SOURCES={"config":{"entries":[{"url":"http://host.docker.internal:7002/policy-data","topics":["policy_data"],"dst_path":"/static"}]}}
+      - OPAL_DATA_CONFIG_SOURCES={"config":{"entries":[{"url":"http://opal-server:7002/policy-data","topics":["policy_data"],"dst_path":"/static"}]}}
       - OPAL_LOG_FORMAT_INCLUDE_PID=true
       # turning on statistics collection on the server side
       - OPAL_STATISTICS_ENABLED=true

packages/opal-client/opal_client/config.py

@@ -118,7 +118,7 @@ class OpalClientConfig(Confi):
     EXCLUDE_POLICY_STORE_SECRETS = confi.bool(
         "EXCLUDE_POLICY_STORE_SECRETS",
         False,
-        description="If set, policy store secrets will be excluded from the logs",
+        description="If set, policy store secrets will be excluded from the /policy-store/config route",
     )
 
     # create an instance of a policy store upon load

packages/opal-client/opal_client/tests/server_to_client_intergation_test.py

@@ -31,7 +31,7 @@
 from opal_server.server import OpalServer
 
 # Server settings
-PORT = int(os.environ.get("PORT") or "9123")
+PORT = int(os.environ.get("PORT") or "9124")
 UPDATES_URL = f"ws://localhost:{PORT}/ws"
 DATA_ROUTE = "/fetchable_data"
 DATA_URL = f"http://localhost:{PORT}{DATA_ROUTE}"

packages/opal-common/opal_common/async_utils.py

@@ -22,9 +22,12 @@ async def run_sync(
     """Shorthand for running a sync function in an executor within an async
     context.
 
-    For example:     def sync_function_that_takes_time_to_run(arg1,
-    arg2):         time.sleep(5)     async def async_function():
-    await run_sync(sync_function_that_takes_time_to_run, 1, arg2=5)
+    For example:
+        def sync_function_that_takes_time_to_run(arg1, arg2):
+            time.sleep(5)
+
+        async def async_function():
+            await run_sync(sync_function_that_takes_time_to_run, 1, arg2=5)
     """
     return await asyncio.get_event_loop().run_in_executor(
         None, partial(func, *args, **kwargs)

packages/opal-common/opal_common/git/tests/conftest.py

@@ -98,7 +98,7 @@ def local_repo(tmp_path, helpers: Helpers) -> Repo:
     """
     root: Path = tmp_path / "myrepo"
     root.mkdir()
-    repo = Repo.init(root)
+    repo = Repo.init(root, initial_branch="master")
 
     # create file to delete later
     helpers.create_new_file_commit(repo, root / "deleted.rego")

packages/opal-server/opal_server/git_fetcher.py

@@ -139,14 +139,7 @@ def __init__(
         )
 
     async def _get_repo_lock(self):
-        # # This implementation works across multiple processes/threads, but is not fair (next acquiree is random)
-        # locks_dir = self._base_dir / ".locks"
-        # await aiofiles.os.makedirs(str(locks_dir), exist_ok=True)
-
-        # return NamedLock(
-        #     locks_dir / GitPolicyFetcher.source_id(self._source), attempt_interval=0.1
-        # )
-
+        # Previous file based implementation worked across multiple processes/threads, but wasn't fair (next acquiree is random)
         # This implementation works only within the same process/thread, but is fair (next acquiree is the earliest to enter the lock)
         src_id = GitPolicyFetcher.source_id(self._source)
         lock = GitPolicyFetcher.repo_locks[src_id] = GitPolicyFetcher.repo_locks.get(

packages/opal-server/opal_server/policy/watcher/task.py

@@ -50,11 +50,12 @@ async def _subscribe_internal():
             )
 
         if self._pubsub_endpoint.broadcaster is not None:
-            async with self._pubsub_endpoint.broadcaster.get_listening_context():
-                await _subscribe_internal()
-                await self._pubsub_endpoint.broadcaster.get_reader_task()
-
-                # Stop the watcher if broadcaster disconnects
+            try:
+                async with self._pubsub_endpoint.broadcaster.get_listening_context():
+                    await _subscribe_internal()
+                    await self._pubsub_endpoint.broadcaster.get_reader_task()
+            finally:
+                # Stop the watcher if broadcaster disconnects / fails to connect
                 self.signal_stop()
         else:
             # If no broadcaster is configured, just subscribe, no need to wait on anything

packages/opal-server/opal_server/tests/policy_repo_webhook_test.py

@@ -29,7 +29,7 @@
 from opal_common.utils import get_authorization_header
 from opal_server.config import PolicySourceTypes, opal_server_config
 
-PORT = int(os.environ.get("PORT") or "9123")
+PORT = int(os.environ.get("PORT") or "9125")
 
 # Basic server route config
 WEBHOOK_ROUTE = "/webhook"

packages/opal-server/requires.txt

@@ -5,6 +5,6 @@ pyjwt[crypto]>=2.1.0,<3
 websockets>=10.3,<11
 slowapi>=0.1.5,<1
 # slowapi is stuck on and old `redis`, so fix that and switch from aioredis to redis
-pygit2>=1.13.3,<2
+pygit2>=1.14.1,<1.15
 asgiref>=3.5.2,<4
 redis>=4.3.4,<5

packages/requires.txt

@@ -1,7 +1,7 @@
 idna>=3.3,<4
 typer>=0.4.1,<1
 fastapi>=0.109.1,<1
-fastapi_websocket_pubsub==0.3.7
+fastapi_websocket_pubsub==0.3.9
 fastapi_websocket_rpc>=0.1.21,<1
 gunicorn>=22.0.0,<23
 pydantic[email]>=1.9.1,<2