You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@polaris.apache.org by "MonkeyCanCode (via GitHub)" <gi...@apache.org> on 2026/01/15 02:38:50 UTC
[PR] Update OPA docker image version [polaris]
MonkeyCanCode opened a new pull request, #3448:
URL: https://github.com/apache/polaris/pull/3448
<!--
๐ Describe what changes you're proposing, especially breaking or user-facing changes.
๐ See https://github.com/apache/polaris/blob/main/CONTRIBUTING.md for more.
-->
As reported in https://github.com/apache/polaris/issues/3447, we are using very outdated version of OPA image. This PR bump the version to the latest one and updated the rego policy to reflect v1.
## Checklist
- [x] ๐ก๏ธ Don't disclose security issues! (contact security@apache.org)
- [x] ๐ Clearly explained why the changes are needed, or linked related issues: Fixes #
- [x] ๐งช Added/updated tests with good coverage, or manually tested (and explained how)
- [x] ๐ก Added comments for complex logic
- [x] ๐งพ Updated `CHANGELOG.md` (if needed)
- [x] ๐ Updated documentation in `site/content/in-dev/unreleased` (if needed)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update OPA docker image version [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on code in PR #3448:
URL: https://github.com/apache/polaris/pull/3448#discussion_r2696041407
##########
extensions/auth/opa/tests/src/intTest/resources/org/apache/polaris/extension/auth/opa/test/Dockerfile-opa-version:
##########
@@ -16,4 +16,4 @@
# specific language governing permissions and limitations
# under the License.
#
-FROM docker.io/openpolicyagent/opa:0.63.0
\ No newline at end of file
+FROM docker.io/openpolicyagent/opa:1.12.3
Review Comment:
I'm not worried about the docker file in our tests. A lot of getting-started examples based on docker file, which was not covered by any tests.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update OPA docker image version [polaris]
Posted by "flyrain (via GitHub)" <gi...@apache.org>.
flyrain commented on code in PR #3448:
URL: https://github.com/apache/polaris/pull/3448#discussion_r2695977568
##########
extensions/auth/opa/tests/src/intTest/resources/org/apache/polaris/extension/auth/opa/test/Dockerfile-opa-version:
##########
@@ -16,4 +16,4 @@
# specific language governing permissions and limitations
# under the License.
#
-FROM docker.io/openpolicyagent/opa:0.63.0
\ No newline at end of file
+FROM docker.io/openpolicyagent/opa:1.12.3
Review Comment:
Do we need the Renovate on docker? I assume there are use cases need to pin a version for docker to make sure it's stable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update OPA docker image version [polaris]
Posted by "MonkeyCanCode (via GitHub)" <gi...@apache.org>.
MonkeyCanCode merged PR #3448:
URL: https://github.com/apache/polaris/pull/3448
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update OPA docker image version [polaris]
Posted by "MonkeyCanCode (via GitHub)" <gi...@apache.org>.
MonkeyCanCode commented on code in PR #3448:
URL: https://github.com/apache/polaris/pull/3448#discussion_r2695927663
##########
extensions/auth/opa/tests/src/intTest/resources/org/apache/polaris/extension/auth/opa/test/Dockerfile-opa-version:
##########
@@ -16,4 +16,4 @@
# specific language governing permissions and limitations
# under the License.
#
-FROM docker.io/openpolicyagent/opa:0.63.0
\ No newline at end of file
+FROM docker.io/openpolicyagent/opa:1.12.3
Review Comment:
Here is the PR for this: https://github.com/apache/polaris/pull/3454
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update OPA docker image version [polaris]
Posted by "MonkeyCanCode (via GitHub)" <gi...@apache.org>.
MonkeyCanCode commented on code in PR #3448:
URL: https://github.com/apache/polaris/pull/3448#discussion_r2696110444
##########
extensions/auth/opa/tests/src/intTest/resources/org/apache/polaris/extension/auth/opa/test/Dockerfile-opa-version:
##########
@@ -16,4 +16,4 @@
# specific language governing permissions and limitations
# under the License.
#
-FROM docker.io/openpolicyagent/opa:0.63.0
\ No newline at end of file
+FROM docker.io/openpolicyagent/opa:1.12.3
Review Comment:
So those are the ones with standard dockerfile name (e.g. https://github.com/apache/polaris/pull/2678) meaning they are already being monitored by renovated bot. For other getting started example, I think they are docker-compose which are not monitored by renovate bot atm:
```
ozone-datanode:
image: &ozone-image apache/ozone:2.0.0
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update OPA docker image version [polaris]
Posted by "MonkeyCanCode (via GitHub)" <gi...@apache.org>.
MonkeyCanCode commented on code in PR #3448:
URL: https://github.com/apache/polaris/pull/3448#discussion_r2696002848
##########
extensions/auth/opa/tests/src/intTest/resources/org/apache/polaris/extension/auth/opa/test/Dockerfile-opa-version:
##########
@@ -16,4 +16,4 @@
# specific language governing permissions and limitations
# under the License.
#
-FROM docker.io/openpolicyagent/opa:0.63.0
\ No newline at end of file
+FROM docker.io/openpolicyagent/opa:1.12.3
Review Comment:
So currently we do have renovate bot on Dockerfile used by service/admin (ubi9 openjdk). But if we have proper testing on the docker files, I would think that should be fine. However, as far as I know, not all docker files are covered for automated testing as of now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update OPA docker image version [polaris]
Posted by "MonkeyCanCode (via GitHub)" <gi...@apache.org>.
MonkeyCanCode commented on code in PR #3448:
URL: https://github.com/apache/polaris/pull/3448#discussion_r2696002848
##########
extensions/auth/opa/tests/src/intTest/resources/org/apache/polaris/extension/auth/opa/test/Dockerfile-opa-version:
##########
@@ -16,4 +16,4 @@
# specific language governing permissions and limitations
# under the License.
#
-FROM docker.io/openpolicyagent/opa:0.63.0
\ No newline at end of file
+FROM docker.io/openpolicyagent/opa:1.12.3
Review Comment:
So currently we do have renovate bot on Dockerfile used by service/admin (ubi9 openjdk). But if we have proper testing on the docker files, I would think that should be fine. However, as far as I know, not all docker files are covered for automated testing as of now. Here is the reference which @snazy usually approves: https://github.com/apache/polaris/pull/3421
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update OPA docker image version [polaris]
Posted by "MonkeyCanCode (via GitHub)" <gi...@apache.org>.
MonkeyCanCode commented on PR #3448:
URL: https://github.com/apache/polaris/pull/3448#issuecomment-3757149111
Seem likes everyone approved this. I will merge this now.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update OPA docker image version [polaris]
Posted by "dimas-b (via GitHub)" <gi...@apache.org>.
dimas-b commented on code in PR #3448:
URL: https://github.com/apache/polaris/pull/3448#discussion_r2695666713
##########
extensions/auth/opa/tests/src/intTest/resources/org/apache/polaris/extension/auth/opa/test/Dockerfile-opa-version:
##########
@@ -16,4 +16,4 @@
# specific language governing permissions and limitations
# under the License.
#
-FROM docker.io/openpolicyagent/opa:0.63.0
\ No newline at end of file
+FROM docker.io/openpolicyagent/opa:1.12.3
Review Comment:
side note: I wonder why Renovate did not do this? ๐ค
##########
extensions/auth/opa/tests/src/intTest/resources/org/apache/polaris/extension/auth/opa/test/Dockerfile-opa-version:
##########
@@ -16,4 +16,4 @@
# specific language governing permissions and limitations
# under the License.
#
-FROM docker.io/openpolicyagent/opa:0.63.0
\ No newline at end of file
+FROM docker.io/openpolicyagent/opa:1.12.3
Review Comment:
@snazy : WDYT?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update OPA docker image version [polaris]
Posted by "MonkeyCanCode (via GitHub)" <gi...@apache.org>.
MonkeyCanCode commented on code in PR #3448:
URL: https://github.com/apache/polaris/pull/3448#discussion_r2695896602
##########
extensions/auth/opa/tests/src/intTest/resources/org/apache/polaris/extension/auth/opa/test/Dockerfile-opa-version:
##########
@@ -16,4 +16,4 @@
# specific language governing permissions and limitations
# under the License.
#
-FROM docker.io/openpolicyagent/opa:0.63.0
\ No newline at end of file
+FROM docker.io/openpolicyagent/opa:1.12.3
Review Comment:
Yeah, I was thinking about the same. Some quick debugging shows this is because they are using `Dockerfile-xxxx` which is not a standard name for docker file (which should be `Dockerfile`). That being said, there are couple more outdated stuff.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Update OPA docker image version [polaris]
Posted by "sungwy (via GitHub)" <gi...@apache.org>.
sungwy commented on PR #3448:
URL: https://github.com/apache/polaris/pull/3448#issuecomment-3757118585
Thanks for the cc @flyrain - I think it's a good idea to bump up the docker image to 1.0 +.
+1 from my side as well
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@polaris.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org