Where can we set up decision log config through OPAL?

[hongbo-miao]

Based on OPA doc, for decision logs, we are able to either let to a remote server to receive decision logs or log locally.
I am wondering where can we set up OPA decision logs config through OPAL. Thanks!

[asafc]

Hi @hongbo-miao, you can definitely use OPAL to configure OPA's decision logs:

Running with standalone OPA

If running OPA standalone (in its own container), you can use the OPA --config-file option described here and pass a YAML with the options.

Running with inline OPA (recommended)

If you run OPA inline (by using the official opal-client docker image), you can use the OPAL_INLINE_OPA_CONFIG env var to setup the runtime options when the OPA process is invoked. The value of that env var is a dict that matches the OpaServerOptions pydantic schema, and inside this schema - you need to pass the path to the OPA configuration YAML inside config_file.

Since the config_file key expects a path accessible from the docker container, you must use docker volumes to expose your OPA configuration YAML to the OPAL client docker container.

Let's prepare a real configuration with decision logs

I am patching the example opal docker compose configuration. I created a step by step tutorial how to do this with docker-compose but you can use this in kubernetes as well - you should change the environment variables to the proper values matching to your kubernetes config.

1. create the following file structure on your computer:

❯ tree
.
├── docker-compose.yml
└── opa
    └── config.yaml

2. inside docker-compose.yml, put the contents of the gist found on this link.

the relevant part is this:

opal_client:
    image: authorizon/opal-client:latest
    environment:
      - OPAL_SERVER_URL=http://opal_server:7002
  
      # the configuration passed here will be piped to OPA agent (runs in server mode)
      # as command line arguments (schema is OpaServerOptions, link: https://github.com/authorizon/opal/blob/master/opal_client/opa/options.py#L19)
      # notice that opal-client expects to find the config file at `/home/opa/config.yaml` on the container
      - OPAL_INLINE_OPA_CONFIG={"config_file":"/home/opa/config.yaml"}
      
      # the inline OPA logs will allow you to see all OPA agent logs on the console
      # and debug more easily - but they are not required for the decision logs themselves.
      - OPAL_INLINE_OPA_LOG_FORMAT=full
  
    ...
    # by using a volume - i expose the `opa/config.yaml` file (located on my host machine) to the docker container
    # and i mount that file at `/home/opa/config.yaml` which is the path that we pass to opal-client.
    volumes:
      - ./opa:/home/opa:ro
    ...

3. inside opa/config.yaml, put your OPA configuration YAML.

This is the example config i used:

services:
  acmecorp:
    url: http://host.docker.internal:8000
    credentials:
      bearer:
        token: "MYTOKEN"

decision_logs:
  service: acmecorp
  reporting:
    min_delay_seconds: 1
    max_delay_seconds: 10

please replace http://host.docker.internal:8000 with the address of the server that should accept OPA decision logs.
I used host.docker.internal because i ran an example server on my host machine on port 8000.

4. (OPTIONAL): run the example server on your host machine.

i created an example server on my machine using fastapi, this is the code to my server: server gist.

you can run my example server with this command:

uvicorn opalogger:app --reload

5. run docker compose up

6. You need to trigger an OPA query in order to see some logs.
   run this against port 8181 (or wherever OPA server runs):

GET http://localhost:8181/v1/data

7. You should see the following logs:

docker compose (opal client):

opal_client.opa.runner | INFO  | Launching opa runner
opal_client.opa.runner | INFO  | Running OPA inline: opa run --server --addr=:8181 --authentication=off --authorization=off --config-file=/home/opa/config.yaml --log-level=info
opal_client.opa.logger | INFO  | Initializing server. {'addrs': [':8181'], 'diagnostic-addrs': [], 'time': '2021-07-08T20:49:44Z'}
opal_client.opa.logger | INFO  | Starting decision logger. {'plugin': 'decision_logs', 'time': '2021-07-08T20:49:44Z'}

...

opal_client.opa.logger | INFO  | Logs uploaded successfully. {'plugin': 'decision_logs', 'time': '2021-07-08T20:50:09Z'}

example server (after receiving the OPA decision logs):

❯ uvicorn acalla.opalogger:app --reload
INFO:     Uvicorn running on http://127.0.0.1:8000 (Press CTRL+C to quit)
INFO:     Started reloader process [8958] using watchgod
INFO:     Started server process [8969]
INFO:     Waiting for application startup.
INFO:     Application startup complete.

OPA LOGS:
[{'labels': {'id': 'ffc48755-05bd-4e7d-9a24-f42bdebbf137', 'version': '0.29.4'}, 'decision_id': 'a182a0d3-05fd-4ca8-a2c9-9425fd64dda9', 'result': {'app': {'rbac': {'allow': False, 'user_is_granted': []}}, 'role_permissions': {'billing': [{'action': 'read', 'type': 'finance'}, {'action': 'update', 'type': 'finance'}], 'customer': [{'action': 'read', 'type': 'dog'}, {'action': 'read', 'type': 'cat'}, {'action': 'adopt', 'type': 'dog'}, {'action': 'adopt', 'type': 'cat'}], 'employee': [{'action': 'read', 'type': 'dog'}, {'action': 'read', 'type': 'cat'}, {'action': 'update', 'type': 'dog'}, {'action': 'update', 'type': 'cat'}]}, 'users': {'alice': {'location': {'country': 'US', 'ip': '8.8.8.8'}, 'roles': ['admin']}, 'bob': {'location': {'country': 'US', 'ip': '8.8.8.8'}, 'roles': ['employee', 'billing']}, 'eve': {'location': {'country': 'US', 'ip': '8.8.8.8'}, 'roles': ['customer']}}}, 'requested_by': '172.19.0.1:65526', 'timestamp': '2021-07-08T20:50:04.1367232Z', 'metrics': {'counter_server_query_cache_hit': 0, 'timer_rego_external_resolve_ns': 8900, 'timer_rego_input_parse_ns': 8600, 'timer_rego_query_compile_ns': 261600, 'timer_rego_query_eval_ns': 4152000, 'timer_rego_query_parse_ns': 67200, 'timer_server_handler_ns': 7849900}}]
INFO:     127.0.0.1:60496 - "POST /logs HTTP/1.1" 200 OK

Hope that is clear enough, please let me know if there are any follow up questions :)

[hongbo-miao]

This is so detailed and works great! Thanks a lot for answering this question, @asafc !