CODEWITHSUNDEEP
open-policy-agentrego
Sulbigar Shanawaz
Sulbigar Shanawaz

Reputation: 159

Overlapping roots across multiple bundles

I was trying to understand the significance of roots. As per the docs,

The roots are not overlapping (e.g., a/b/c and a/b are overlapped and will result in an error.) Note: This is not enforced across multiple bundles. Only within the same bundle manifest.

So, I loaded two bundles with same .manifest files with the hope that OPA will not be causing any initialization error based on the above note. But it failed with

error: initialization error: detected overlapping roots in bundle manifest with: [/var/folders/hl/7twvsdm52jx6qn3tgkh_4rzm0000gp/T/valid_roots.tar.gz /var/folders/hl/7twvsdm52jx6qn3tgkh_4rzm0000gp/T/duplicate_valid_roots.tar.gz]

Am I doing something wrong or have I understood the statement incorrectly or does the document need an update?

Structure:

valid_roots.tar.gz & duplicate_valid_roots.tar.gz

./rule
./policy
./.manifest
./policy/policy_1.rego
./rule/rule_1.rego

.manifest

{'roots':['rule/lob','policy/consumers']

OPA run command

opa run -s -a 0.0.0.0:8191 -b /var/folders/hl/7twvsdm52jx6qn3tgkh_4rzm0000gp/T/valid_roots.tar.gz -b /var/folders/hl/7twvsdm52jx6qn3tgkh_4rzm0000gp/T/duplicate_valid_roots.tar.gz

Upvotes: 2

Views: 989

Answers (1)

Ash Narkar
Ash Narkar

Reputation: 21

valid_roots.tar.gz & duplicate_valid_roots.tar.gz will be considered as 2 separate bundles and hence you see the detected overlapping roots error. If the valid_roots.tar.gz has a manifest file with the below content, it means the valid_roots.tar.gz owns these roots and no other bundle can write to those paths.

{'roots':['rule/lob','policy/consumers']

The statement you're referring in the docs is the check that is performed while reading a single bundle. If a bundle specifies roots as a/b/c and a/b, OPA cannot determine, if the bundle owns everything under a/b like a/b/foo, a/b/bar or it owns only a/b/c.

Upvotes: 2

Related Questions