Skip to content

rego: fail closed on external_data provider errors #705

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sozercan wants to merge 1 commit into
base: master
Choose a base branch
from
Open

rego: fail closed on external_data provider errors #705

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 3 additions & 4 deletions constraint/pkg/client/drivers/rego/builtin.go
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,6 @@
package rego

import (
"net/http"
"time"

"github.com/open-policy-agent/opa/v1/ast"
Expand Down Expand Up @@ -64,17 +63,17 @@ func externalDataBuiltin(d *Driver) func(bctx rego.BuiltinContext, regorequest *
if len(providerRequestKeys) > 0 {
provider, err := d.providerCache.Get(regoReq.ProviderName)
if err != nil {
return externaldata.HandleError(http.StatusBadRequest, err)
return nil, err
}

clientCert, err := d.getTLSCertificate()
if err != nil {
return externaldata.HandleError(http.StatusBadRequest, err)
return nil, err
}

externaldataResponse, statusCode, err := d.sendRequestToProvider(bctx.Context, &provider, providerRequestKeys, clientCert)
if err != nil {
return externaldata.HandleError(statusCode, err)
return nil, err
Comment on lines 64 to +76

Copilot AI Apr 9, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Now that external_data errors are propagated as builtin errors (and ultimately surfaced via Query()'s error-to-violation conversion), consider wrapping these returned errors with context like provider name and (for request failures) the HTTP status code. Returning the raw underlying error strings (e.g. "key is not found in provider cache") makes diagnosing which provider/operation failed harder once it reaches users/logs.

Copilot uses AI. Check for mistakes.
}

// update provider response cache if it is enabled
Expand Down
13 changes: 8 additions & 5 deletions constraint/pkg/client/drivers/rego/driver_unit_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -864,13 +864,16 @@ func TestDriver_ExternalData(t *testing.T) {
[]*unstructured.Unstructured{cts.MakeConstraint(t, "Fakes", "foo-1")},
map[string]interface{}{"hi": "there"},
)
if err != nil {
t.Fatalf("got Query() error = %v, want %v", err, nil)
if tt.errorExpected {
if err == nil {
t.Fatalf("got Query() error = nil, want non-nil")
}
return
}
if tt.errorExpected && len(qr.Results) == 0 {
t.Fatalf("got 0 errors on normal query; want 1")
if err != nil {
t.Fatalf("got Query() error = %v, want nil", err)
}
if !tt.errorExpected && len(qr.Results) > 0 {
if len(qr.Results) > 0 {
Comment on lines +867 to +876

Copilot AI Apr 9, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Test expectations no longer match Driver.Query behavior. Query() intentionally converts Rego eval errors into violation results (see driver.go) and still returns a nil error; with external_data now returning an error from the builtin, Query() will likely return err == nil and qr.Results > 0. Update this test to assert on qr.Results (and possibly the msg contents) for failure cases, or change Driver.Query to propagate eval errors if the new contract is intentional.

Copilot uses AI. Check for mistakes.
t.Fatalf("got %d errors on normal query; want 0", len(qr.Results))
}
})
Expand Down
Loading