https://linen.dev logo
Join Slack
Powered by
This message was deleted.
# opal
s
This message was deleted.
o
Hi @Jack Geek this would require further investigation. Do you see OPAL retry ? Or did the server crash fully?
How often does this happen. An a stop gap solution - Did you try restarting the server automatically following its healthcheck ? Does it succeed in pulling from Git at the point? CC: @Asaf Cohen
a
@Jack Geek typically exit code 1 means something in the git configuration (url, ssh key, branch name) is not configured correctly. i did not see it happening in other scenarios. where is your git repo stored?
j
@Or Weis it's stored in K8S secret (not changed), when I restarted the POD of the opal-server, it works. I did some investigation, I will start on the client side : • apparently the client throw an error because my rule contains "_"
This error started a loop of errors on the client side (throw errors, connects / disconnects from the server etc..) here are the screenshots:
## On the server side, that caused apparently a loop of errors also (new subscription, connection closed etc..) But I don't why that affacted the policy git polling:
Client errors
a
Hey @Jack Geek i don't think these are related
The 
_ var is unsafe
can throw the client into a loop of errors, and the fix is simple - push valid rego. Loops of errors in the client connection flow are unrelated to the git fetch flow. There is probably a different reason why git pull failed.
j
Hello Asaf, I used the OPA playground to format / evaluate the policy and no errors were detected. Maybe the version of OPA is outdated ? Here is the warning I get (with the latest dokcer image of the client).
a
The version of OPA is probably outdated in the official image. Unfortunately since version 0.40.0 they made several breaking changes to the language. Try to download the older version of OPA and eval the policy. We will release a new official image next week.
j
ok thanks @Asaf Cohen
@Asaf Cohen, did you release the new image ?
o
j
Hi @Or Weis thank you for the release. I have a question regarding the 
OPAL_POLICY_REPO_WEBHOOK_PARAMS
env variable , is it mandatory in the OPAL server config ? (because I didn't see it when you made the example with Github)
o
HI @Jack Geek - sorry for the late reply was being interviewed for a podcast. The default for 
OPAL_POLICY_REPO_WEBHOOK_PARAMS
is Github - so you don’t have to change anything if you’re using Github
j
@Or Weis I'm using Gitlab, so the default param config will be an escaped string, isn't it ? (this is a k8s deployment var config) 
- name: OPAL_POLICY_REPO_WEBHOOK_PARAMS
value: "{\"secret_header_name\":\"X-Gitlab-Token\",\"secret_type\":\"token\",\"secret_parsing_regex\":\"(.*)\",\"event_header_name\":\"X-Gitlab-Event\",\"push_event_value\":\"Push Hook\"}"
o
Looks about right, yes 🙂
Open in Slack
PreviousNext
Powered by