2

I was trying to understand the significance of roots. As per the docs,

The roots are not overlapping (e.g., a/b/c and a/b are overlapped and will result in an error.) Note: This is not enforced across multiple bundles. Only within the same bundle manifest.

So, I loaded two bundles with same .manifest files with the hope that OPA will not be causing any initialization error based on the above note. But it failed with

error: initialization error: detected overlapping roots in bundle manifest with: [/var/folders/hl/7twvsdm52jx6qn3tgkh_4rzm0000gp/T/valid_roots.tar.gz /var/folders/hl/7twvsdm52jx6qn3tgkh_4rzm0000gp/T/duplicate_valid_roots.tar.gz]

Am I doing something wrong or have I understood the statement incorrectly or does the document need an update?

Structure:

valid_roots.tar.gz & duplicate_valid_roots.tar.gz

./rule
./policy
./.manifest
./policy/policy_1.rego
./rule/rule_1.rego

.manifest

{'roots':['rule/lob','policy/consumers']

OPA run command

opa run -s -a 0.0.0.0:8191 -b /var/folders/hl/7twvsdm52jx6qn3tgkh_4rzm0000gp/T/valid_roots.tar.gz -b /var/folders/hl/7twvsdm52jx6qn3tgkh_4rzm0000gp/T/duplicate_valid_roots.tar.gz
Sulbigar Shanawaz
  • 159
  • 3
  • 13
  • Actually, identifying discrepancy across bundle is good but I just wanted to make sure on the expected behavior. – Sulbigar Shanawaz Sep 29 '21 at 23:12
  • Same problem here, but in my case, the overlapping is on the path `system/log`. I'm trying to compose a mask rule between two bundles. It seems that the documentation is wrong, the overlapping check occurs between bundles too. – Humberto Corrêa Jul 11 '22 at 21:12

1 Answers1

2

valid_roots.tar.gz & duplicate_valid_roots.tar.gz will be considered as 2 separate bundles and hence you see the detected overlapping roots error. If the valid_roots.tar.gz has a manifest file with the below content, it means the valid_roots.tar.gz owns these roots and no other bundle can write to those paths.

{'roots':['rule/lob','policy/consumers']

The statement you're referring in the docs is the check that is performed while reading a single bundle. If a bundle specifies roots as a/b/c and a/b, OPA cannot determine, if the bundle owns everything under a/b like a/b/foo, a/b/bar or it owns only a/b/c.

Ash Narkar
  • 21
  • 2