config

type AmazonRDS ¶

type AmazonRDS struct {
	Region       string     `json:"region"`
	Endpoint     string     `json:"endpoint"` // hostname:port
	Driver       string     `json:"driver"`   // mysql or postgres
	DatabaseUser string     `json:"database_user"`
	DatabaseName string     `json:"database_name"`
	DSN          string     `json:"dsn"`
	Credentials  *SecretRef `json:"credentials,omitempty"`
	// RootCertificates points to PEM-encoded root certificate bundle file. If empty, the default system
	// root CA certificates are used. For RDS, you can download the appropriate bundle for your region
	// from here: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/UsingWithRDS.SSL.html#UsingWithRDS.SSL.CertificatesAllRegions
	RootCertificates string `json:"root_certificates,omitempty"`
	// contains filtered or unexported fields
}

type AmazonS3 ¶

type AmazonS3 = extconfig.AmazonS3

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type AzureBlobStorage ¶

type AzureBlobStorage = extconfig.AzureBlobStorage

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Bundle ¶

type Bundle = extconfig.Bundle

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type BundleStatus ¶ added in v0.6.0

type BundleStatus = extconfig.BundleStatus

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type ClientSecret ¶ added in v0.3.0

type ClientSecret interface {
	Client(context.Context) (*http.Client, error)
}

ClientSecret is the shared type of those secrets that can become effective by returning a properly set-up *http.Client. Note that this is not used everywhere yet, only for a those supported in the HTTP datasource.

type CounterConfig ¶ added in v0.7.0

type CounterConfig struct {
	Enabled *bool `json:"enabled,omitempty"`
	// contains filtered or unexported fields
}

CounterConfig configures a Prometheus counter metric.

type Database ¶

type Database struct {
	SQL    *SQLDatabase `json:"sql,omitempty"`
	AWSRDS *AmazonRDS   `json:"aws_rds,omitempty"`
	// contains filtered or unexported fields
}

func DatabaseFromPublic(cfg *extconfig.DatabaseConfig) *Database

type Datasource ¶

type Datasource = extconfig.Datasource

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Datasources ¶

type Datasources = extconfig.Datasources

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Duration ¶

type Duration = extconfig.Duration

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type FileSystemStorage ¶

type FileSystemStorage = extconfig.FileSystemStorage

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Files ¶

type Files = extconfig.Files

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type GCPCloudStorage ¶

type GCPCloudStorage = extconfig.GCPCloudStorage

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Git ¶

type Git = extconfig.Git

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type GitRequirement ¶

type GitRequirement = extconfig.GitRequirement

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type GitSyncMetrics ¶ added in v0.7.0

type GitSyncMetrics struct {
	Enabled         *bool            `json:"enabled,omitempty"`
	GitSyncDuration *HistogramConfig `json:"git_sync_duration,omitempty"`
	GitSyncCount    *CounterConfig   `json:"git_sync_count,omitempty"`
	// contains filtered or unexported fields
}

GitSyncMetrics configures git synchronization metrics.

func (g *GitSyncMetrics) GetCountEnabled() *bool

type HTTPMetrics ¶ added in v0.7.0

type HTTPMetrics struct {
	Enabled         *bool            `json:"enabled,omitempty"`
	RequestDuration *HistogramConfig `json:"request_duration,omitempty"`
	// contains filtered or unexported fields
}

HTTPMetrics configures HTTP request metrics.

type HistogramConfig ¶ added in v0.7.0

type HistogramConfig struct {
	BucketsSeconds []float64 `json:"buckets_seconds,omitempty"`
	Enabled        *bool     `json:"enabled,omitempty"`
	// contains filtered or unexported fields
}

HistogramConfig configures a Prometheus histogram metric.

func (h *HistogramConfig) GetBuckets() []float64

type Labels ¶

type Labels = extconfig.Labels

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Metadata ¶

type Metadata struct {
	ExportedFrom string `json:"exported_from"`
	ExportedAt   string `json:"exported_at"`
	// contains filtered or unexported fields
}

Metadata contains metadata about the configuration file itself. This information is not stored in the database and is only used by the migration tooling.

type MetricsConfig ¶ added in v0.7.0

type MetricsConfig struct {
	Enabled *bool           `json:"enabled,omitempty"`
	HTTP    *HTTPMetrics    `json:"http,omitempty"`
	GitSync *GitSyncMetrics `json:"gitsync,omitempty"`
	Worker  *WorkerMetrics  `json:"worker,omitempty"`
	// contains filtered or unexported fields
}

MetricsConfig configures Prometheus metrics collection.

type ObjectStorage ¶

type ObjectStorage = extconfig.ObjectStorage

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Optimization ¶ added in v0.6.0

type Optimization = extconfig.Optimization

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Options ¶ added in v0.2.0

type Options = extconfig.Options

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Requirement ¶

type Requirement = extconfig.Requirement

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Requirements ¶

type Requirements = extconfig.Requirements

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Root ¶

type Root struct {
	Metadata Metadata           `json:"metadata"`
	Bundles  map[string]*Bundle `json:"bundles,omitempty"`
	Stacks   map[string]*Stack  `json:"stacks,omitempty"`
	Sources  map[string]*Source `json:"sources,omitempty"`
	Secrets  map[string]*Secret `json:"secrets,omitempty"` // Schema validation overrides Secret to object type.
	Tokens   map[string]*Token  `json:"tokens,omitempty"`
	Database *Database          `json:"database,omitempty"`
	Service  *Service           `json:"service,omitempty"`
	Metrics  *MetricsConfig     `json:"metrics,omitempty"`
	// contains filtered or unexported fields
}

Root is the top-level configuration structure used by OPA Control Plane.

func Parse(bs []byte) (*Root, error)

func ParseFile(filename string) (root *Root, err error)

func (r *Root) SetSQLitePersistentByDefault(persistenceDir string) bool

func (r *Root) SortedBundles() iter.Seq2[int, *Bundle]

func (r *Root) SortedSecrets() iter.Seq2[int, *Secret]

func (r *Root) SortedStacks() iter.Seq2[int, *Stack]

func (r *Root) TopologicalSortedSources() ([]*Source, error)

func (r *Root) Unmarshal() error

func (r *Root) UnmarshalJSON(bs []byte) error

func (r *Root) UnmarshalYAML(bs []byte) error

type SQLDatabase ¶

type SQLDatabase struct {
	Driver      string     `json:"driver"`
	DSN         string     `json:"dsn"`
	Credentials *SecretRef `json:"credentials,omitempty"`
	// contains filtered or unexported fields
}

type Scope ¶

type Scope struct {
	Role string `json:"role" enum:"administrator,viewer,owner,stack_owner"`
}

func (s Scope) Equal(other Scope) bool

type Secret ¶

type Secret struct {
	Name  string         `json:"-"`
	Value map[string]any `json:"-"`
}

Secret defines the configuration for secrets/tokens used by OPA Control Plane for Git synchronization, datasources, etc.

Each secret is stored as a map of key-value pairs, where the keys and values are strings. Secret type is also declared in the config. For example, a secret for basic HTTP authentication might look like this (in YAML):

my_secret:

type: basic_auth
username: myuser
password: mypassword

Secrets may also refer to environment variables using the ${VAR_NAME} syntax. For example:

my_secret:

type: aws_auth
access_key_id: ${AWS_ACCESS_KEY_ID}
secret_access_key: ${AWS_SECRET_ACCESS_KEY}
session_token: ${AWS_SESSION_TOKEN}

In this case, the actual values for username and password will be read from the environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN.

Currently the following secret types are supported:

• "aws_auth" for AWS authentication. Values for keys "access_key_id", "secret_access_key", and optional "session_token" are expected.
• "azure_auth" for Azure authentication. Values for keys "account_name" and "account_key" are expected.
• "basic_auth" for HTTP basic authentication. Values for keys "username" and "password" are expected. "headers" (string array) is optional and can be used to set additional headers for the HTTP requests (currently only supported for git).
• "oidc_client_credentials" for OIDC Client Credentials flow. Values for either `issuer` OR `token_url`, and `client_id`, and `client_secret` are expected, `scopes` are optional (currently only supported for HTTP datasource).
• "gcp_auth" for Google Cloud authentication. Value for a key "api_key" or "credentials" is expected.
• "github_app_auth" for GitHub App authentication. Values for keys "integration_id", "installation_id", and "private_key" are expected.
• "password" for password authentication. Value for key "password" is expected.
• "ssh_key" for SSH private key authentication. Value for key "key" (private key) is expected. "fingerprints" (string array) and "passphrase" are optional.
• "token_auth" for HTTP bearer token authentication. Value for a key "token" is expected.

func (s *Secret) Equal(other *Secret) bool

func (s *Secret) MarshalJSON() ([]byte, error)

func (s *Secret) MarshalYAML() (any, error)

func (s *Secret) Ref() *SecretRef

func (s *Secret) Typed(context.Context) (any, error)

func (s *Secret) UnmarshalJSON(bs []byte) error

func (s *Secret) UnmarshalYAML(bs []byte) error

type SecretAPIKey ¶ added in v0.5.0

type SecretAPIKey struct {
	Key   string `json:"key"`   // Header name or query param name (e.g., "X-API-Key")
	Value string `json:"value"` // The API key value
	In    string `json:"in"`    // Where to send the key: "header" or "query" (default: "header")
}

SecretAPIKey represents API key authentication for HTTP requests. The key can be sent via header or query parameter.

func (s *SecretAPIKey) Client(context.Context) (*http.Client, error)

type SecretAWS ¶

type SecretAWS struct {
	AccessKeyID     string `json:"access_key_id"`
	SecretAccessKey string `json:"secret_access_key"`
	SessionToken    string `json:"session_token"`
}

type SecretAzure ¶

type SecretAzure struct {
	AccountName string `json:"account_name"`
	AccountKey  string `json:"account_key"`
}

type SecretBasicAuth ¶

type SecretBasicAuth struct {
	Username string   `json:"username"`
	Password string   `json:"password"`
	Headers  []string `json:"headers,omitempty"` // Optional additional headers for HTTP requests.
}

func (s *SecretBasicAuth) Client(context.Context) (*http.Client, error)

type SecretGCP ¶

type SecretGCP struct {
	APIKey      string `json:"api_key"`
	Credentials string `json:"credentials"` // Credentials file as JSON.
}

type SecretGitHubApp ¶

type SecretGitHubApp struct {
	IntegrationID  int64  `json:"integration_id"`
	InstallationID int64  `json:"installation_id"`
	PrivateKey     string `json:"private_key"` // Private key filepath as PEM.
}

type SecretOIDCClientCredentials ¶ added in v0.3.0

type SecretOIDCClientCredentials struct {
	Issuer       string   `json:"issuer"`           // OIDC issuer URL for automatic discovery (required if TokenURL is not provided)
	TokenURL     string   `json:"token_endpoint"`   // Explicit token endpoint URL (optional if Issuer is provided)
	ClientID     string   `json:"client_id"`        // OAuth2 client ID (required)
	ClientSecret string   `json:"client_secret"`    // OAuth2 client secret (required)
	Scopes       []string `json:"scopes,omitempty"` // Optional OAuth2 scopes
}

SecretOIDCClientCredentials represents OIDC Client Credentials flow configuration. It supports both explicit token endpoint configuration and automatic discovery via issuer.

func (value *SecretOIDCClientCredentials) Client(ctx context.Context) (*http.Client, error)

func (value *SecretOIDCClientCredentials) Token(ctx context.Context) (string, error)

type SecretPassword ¶

type SecretPassword struct {
	Password string `json:"password"` // Password for authentication.
}

type SecretRef ¶

type SecretRef = extconfig.SecretRef

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type SecretSSHKey ¶

type SecretSSHKey struct {
	Key          string   `json:"key"`                    // Private key as PEM.
	Passphrase   string   `json:"passphrase,omitempty"`   // Optional passphrase for the private key.
	Fingerprints []string `json:"fingerprints,omitempty"` // Optional SSH key fingerprints.
}

type SecretTLSCert ¶ added in v0.2.0

type SecretTLSCert struct {
	RootCA  string `json:"root_ca"`  // Root CA certificate (PEM encoded)
	TLSCert string `json:"tls_cert"` // TLS certificate (PEM encoded)
	TLSKey  string `json:"tls_key"`  // TLS key (PEM encoded)
}

func (value *SecretTLSCert) Client(ctx context.Context) (*http.Client, error)

func (value *SecretTLSCert) ToConfig(ctx context.Context) (*tls.Config, error)

type SecretTokenAuth ¶

type SecretTokenAuth struct {
	BearerToken string `json:"token"` // Bearer token for HTTP authentication.
}

func (s *SecretTokenAuth) Client(context.Context) (*http.Client, error)

func (s *SecretTokenAuth) Token(context.Context) (string, error)

type Selector ¶

type Selector struct {
	// contains filtered or unexported fields
}

func MustNewSelector(s map[string]StringSet) Selector

func (s Selector) Equal(other Selector) bool

func (s *Selector) Get(key string) ([]string, bool)

func (s *Selector) Keys() []string

func (s *Selector) Len() int

func (s Selector) MarshalJSON() ([]byte, error)

func (s Selector) MarshalYAML() (any, error)

func (s *Selector) Matches(labels Labels) bool

func (*Selector) PrepareJSONSchema(schema *schemareflector.Schema) error

func (s *Selector) PtrEqual(other *Selector) bool

func (s *Selector) PtrMatches(labels Labels) bool

func (s *Selector) Set(key string, value []string) error

func (s *Selector) UnmarshalJSON(bs []byte) error

func (s *Selector) UnmarshalYAML(bs []byte) error

type Service ¶

type Service struct {
	// ApiPrefix prefixes all endpoints (including health and metrics) with its value. It is important to start with `/` and not end with `/`.
	// For example `/my/path` will make health endpoint be accessible under `/my/path/health`
	ApiPrefix string `json:"api_prefix,omitempty" pattern:"^/([^/].*[^/])?$"`
	// contains filtered or unexported fields
}

type Source ¶

type Source = extconfig.Source

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Sources ¶

type Sources = extconfig.Sources

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Stack ¶

type Stack struct {
	Name            string       `json:"name"`
	Selector        Selector     `json:"selector"` // Schema validation overrides Selector to object of string array values.
	ExcludeSelector *Selector    `json:"exclude_selector,omitempty"`
	Requirements    Requirements `json:"requirements,omitempty"`
	// contains filtered or unexported fields
}

Stack defines the configuration for an OPA Control Plane Stack.

func (a *Stack) Equal(other *Stack) bool

type Stacks ¶

type Stacks []*Stack

func (a Stacks) Equal(b Stacks) bool

type StringSet ¶

type StringSet = extconfig.StringSet

Type aliases for types now defined in pkg/config. These allow internal code to continue using the short names (e.g. config.Bundle) while the canonical definitions live in the public package.

type Token ¶

type Token struct {
	Name   string  `json:"-"`
	APIKey string  `json:"api_key"`
	Scopes []Scope `json:"scopes"`
	// contains filtered or unexported fields
}

Token represents an API token to access the OPA Control Plane APIs.

func (t *Token) Equal(other *Token) bool

type TokenSecret ¶ added in v0.4.0

type TokenSecret interface {
	Token(context.Context) (string, error)
}

TokenSecret is the shared type of those secrets that can become effective by returning a bearer token string. This is used for token-based authentication in various contexts like git repositories and HTTP requests.

type WorkerMetrics ¶ added in v0.7.0

type WorkerMetrics struct {
	Enabled             *bool            `json:"enabled,omitempty"`
	BundleBuildDuration *HistogramConfig `json:"bundle_build_duration,omitempty"`
	BundleBuildCount    *CounterConfig   `json:"bundle_build_count,omitempty"`
	// contains filtered or unexported fields
}

WorkerMetrics configures bundle build metrics.

func (w *WorkerMetrics) GetCountEnabled() *bool