Andrea Cosentino created CAMEL-24644:
----------------------------------------
Summary: camel-opa - add a producer health check for the OPA server
Key: CAMEL-24644
URL: https://issues.apache.org/jira/browse/CAMEL-24644
Project: Camel
Issue Type: Improvement
Reporter: Andrea Cosentino
h2. Problem
{{camel-opa}} (CAMEL-24634) fails closed by design: when the policy cannot be
evaluated at all - OPA unreachable, timed out, or answering with an error - the
producer throws {{OpaPolicyEvaluationException}} and {{OpaSecurityPolicy}}
throws {{CamelAuthorizationException}}. That is the correct behaviour for an
authorization component, but it means an OPA server that is down takes down
*every* exchange through the route.
There is currently no way to observe that before traffic starts failing. The
only signal is the failures themselves.
h2. Proposal
Register a producer health check that probes the OPA server's {{/health}}
endpoint, so an unreachable policy decision point shows up in the health
registry (and therefore in {{/q/health}} and the readiness probe) rather than
only in the error logs.
Existing precedent for a component-supplied health check:
* {{RemoteFileProducerHealthCheck}} (camel-ftp-common)
* {{KafkaProducerHealthCheck}} (camel-kafka)
* {{PQCStatefulKeyHealthCheck}} (camel-pqc)
Notes:
* {{/health}} is the endpoint the {{camel-test-infra-opa}} container service
already uses as its Testcontainers wait strategy, so the probe is known to work.
* The check should report DOWN with the underlying reason, not swallow it,
since the whole point is telling an unreachable PDP apart from a policy that
denied.
* Worth considering whether the check belongs on {{OpaSecurityPolicy}} too - it
has the same exposure but no endpoint to hang a producer health check on.
h2. Scope
{{main}} only. Additive.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
