Possibility to remove selected packages from the builtin Library

[nuwandiw]

We are are doing the bundle configuration with Java.

Sources for the "my-app" policy is created as Git sources and additionally we include "envoy-v2.1" as below
sources.put("envoy-v2.1", Source.builder()
.builtin("envoy-v2.1")
.build());

"my-app" contains it's own system.log package. With "my-app" sources and "envoy-v2.1" source added as requirements, bundle building with the ocp ctl gives the following error.

requirement "my-app" contains conflicting package system.log - package system.log from "envoy-v2.1"

Is there a way that I can remove only the system.log package from "envoy-v2.1" ?

Tried with path() and prefix() approach to prefix the system.log with something else. But if I specify .path("system.log") in the requirement, it drops all the other paths that I actually need but just don't want to prefix.

[srenatus]

I don't know the Java lib you're using there -- but perhaps you can use .path() to reference the envoy-v2.1 libs you want -- it cannot be used to exclude things, it can only be used to select the other things (which you want). Please give that a try!

[nuwandiw]

Thanks for the quick reply @srenatus We have implemented our own Java objects to build the configuration.

So if I understand correctly, we have to explicitly mention each one if we go with the .path() approach.
Is it possible to use the .path() without including a prefix? Because I only wanted to prefix the system.log package. When I tried to include other packages with just path, I see the following error
error occurred: main/main.rego:1: rego_parse_error: unexpected lt token package <illegal path "data">

It could be an issue with our implementation therefore wanted to confirm it's possible to add just a path with no prefix

[srenatus]

If you specify a path for a source, it'll be prepended to every package within that source. So you cannot add the path to "system.log" only.

Here's another workaround, the package to be used for masking decision logs can be anything else -- you could rename your package and configure your OPAs to use their corresponding ref for the mask decision. Is that possible in your deployment scenario?

[nuwandiw]

Sorry for the late reploy. We ended up registering each package separately and skipping the logs.

you could rename your package and configure your OPAs to use their corresponding ref for the mask decision.

I thought system.log is what opa checks for masking rules. Where can I customize this path?

[srenatus]

I thought system.log is what opa checks for masking rules. Where can I customize this path?

ref:

• mask_decision defaults to /system/log/mask
• drop_decision defaults to /system/log/drop