feat(global): opa policy upgrade and observability

.github/workflows/build-and-push.yaml

@@ -93,19 +93,22 @@ jobs:
         uses: ./.github/actions/init-pnpm
         with:
           install-filter: '.'
-      - name: Log in to the Container registry
-        uses: docker/login-action@v4
-        with:
-          registry: ${{ secrets.ACR_URL }}
-          username: ${{ secrets.ACR_PUSH_USER }}
-          password: ${{ secrets.ACR_PUSH_TOKEN }}
+      - name: Helm | Login
+        shell: bash
+        run: echo '${{ secrets.ACR_PUSH_TOKEN }}' | helm registry login -u '${{ secrets.ACR_PUSH_USER }}' --password-stdin '${{ secrets.ACR_URL }}'
+        env:
+          HELM_EXPERIMENTAL_OCI: '1'
+
       - name: Get version from manifest
         id: get_version
         shell: bash
         run: |
           VERSION=$(cat .release-please-manifest.json | jq -r '.["."]')
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
 
+      - name: build opa
+        shell: bash
+        run: helm dependency build ./helm/charts/opa
       - name: build dependencies
         shell: bash
         run: pnpm --filter "./apps/*" -rc --parallel exec 'helm dependency build ./helm || true'

.regal/config.yaml

@@ -9,9 +9,12 @@ rules:
         - data.keys.kid
         - data.users.avi.allowNoBrowser
         - data.users.avi.allowNoOrigin
+        - data.users.avi.origins
   style:
     line-length:
       level: ignore
+    file-length:
+      level: ignore
   idiomatic:
     directory-package-mismatch:
       level: ignore

.vscode/settings.json

@@ -12,5 +12,9 @@
     "editor.defaultFormatter": "esbenp.prettier-vscode"
   },
   "opa.dependency_paths.opa": "${workspaceFolder}/policy/opa",
-  "opa.dependency_paths.regal": "${workspaceFolder}/policy/regal"
+  "opa.dependency_paths.regal": "${workspaceFolder}/policy/regal",
+  "files.associations": {
+    "**/helm/dashboards/*.json": "helm",
+    "**/helm/charts/opa/config/opa.yaml": "helm"
+  }
 }

helm/Chart.lock

@@ -17,5 +17,8 @@ dependencies:
 - name: nginx
   repository: oci://acrarolibotnonprod.azurecr.io/helm/common
   version: 2.1.6
-digest: sha256:49f1a50c589b1760030c7a449e779d5ca15acdbf8173ef953aceb699b88a170f
-generated: "2026-06-01T12:20:36.236385936+03:00"
+- name: grafana-datasources
+  repository: oci://acrarolibotnonprod.azurecr.io/helm/infra
+  version: 1.0.0
+digest: sha256:0797bfd08fb9ee79413ee32bc2944d1052ed7e250c9140e5a310cbfa4cbf1e73
+generated: "2026-07-22T09:52:31.741378493+03:00"

helm/Chart.yaml

@@ -30,3 +30,7 @@ dependencies:
     condition: kiosk-ui.enabled
     alias: kiosk-ui
     version: 2.1.6
+  - name: grafana-datasources
+    repository: oci://acrarolibotnonprod.azurecr.io/helm/infra
+    condition: grafana-datasources.enabled
+    version: 1.0.0

helm/charts/opa/Chart.lock

@@ -2,5 +2,8 @@ dependencies:
 - name: mclabels
   repository: oci://acrarolibotnonprod.azurecr.io/helm/infra
   version: 1.0.1
-digest: sha256:a97237cd8966ab9d4f8c0b8dda2ad110fbff5d485da868124fdce2a5dbbfa208
-generated: "2025-11-20T10:36:07.259160863+02:00"
+- name: fluent-bit
+  repository: oci://ghcr.io/fluent/helm-charts
+  version: 0.57.7
+digest: sha256:d4c09206ec7d0bee95f3cae64e127bfe93c4f3d827cdc1aac2a3e695210716b8
+generated: "2026-06-17T11:32:28.877870547+03:00"

helm/charts/opa/Chart.yaml

@@ -8,3 +8,8 @@ dependencies:
   - name: mclabels
     version: 1.0.1
     repository: oci://acrarolibotnonprod.azurecr.io/helm/infra
+  - name: fluent-bit
+    repository: oci://ghcr.io/fluent/helm-charts
+    version: 0.57.7
+    condition: fluent-bit.enabled
+    alias: fluentbit

helm/charts/opa/config/opa.yaml

@@ -5,6 +5,10 @@ services:
       s3_signing:
         # Required for finding the envs for S3
         environment_credentials: {}
+{{- if .Values.fluentbit.enabled }}
+  fluent-bit:
+    url: {{ .Values.fluentbit.url | default (printf "http://%s-fluentbit:9880" .Release.Name)}}/opa.logs
+{{- end }}
 
 bundles:
   authz:
@@ -21,8 +25,15 @@ status:
 
 decision_logs:
   console: {{ .Values.decisionLogs.console }}
+  {{- if .Values.fluentbit.enabled }}
+  service: fluent-bit
+  {{- end }}
   reporting:
-    buffer_size_limit_bytes: {{ .Values.decisionLogs.maxBufferSize }}
+    buffer_type: event
+    buffer_size_limit_events: {{ .Values.decisionLogs.maxBufferEvents }}
+    upload_size_limit_bytes: {{ .Values.decisionLogs.maxUploadSizeBytes }}
+    min_delay_seconds: {{ .Values.decisionLogs.minDelaySeconds }}
+    max_delay_seconds: {{ .Values.decisionLogs.maxDelaySeconds }}
 
 {{ if .Values.tracing.enabled }}
 distributed_tracing:
@@ -38,8 +49,8 @@ storage:
     auto_create: true
     directory: {{ .Values.bundlePersistencePath }}
 
-
 labels:
+  environment: {{ .Values.opaEnvironment | required "opaEnvironment is required" | quote }}
   {{- range $key, $value := .Values.labels }}
   {{ $key }}: {{ $value | quote }}
   {{- end }}

helm/charts/opa/templates/deployment.yaml

@@ -36,9 +36,7 @@ spec:
         {{- end }}
       annotations:
         {{ include "mclabels.annotations" . | nindent 8 }}
-        {{- if .Values.resetOnConfigChange }}
         checksum/configmap: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
-        {{- end }}
         {{- if .Values.additionalPodAnnotations }}
         {{- toYaml .Values.additionalPodAnnotations | nindent 8}}
         {{- end }}

helm/charts/opa/values.yaml

@@ -59,7 +59,10 @@ status:
 
 decisionLogs:
   console: true
-  maxBufferSize: 5242880 # 5MB
+  minDelaySeconds: 5
+  maxDelaySeconds: 60
+  maxBufferEvents: 30000
+  maxUploadSizeBytes: 1048576
 
 tracing:
   enabled: false
@@ -135,3 +138,199 @@ ingress:
 
 # Add any label you want as `KEY: VALUE`
 labels: {}
+
+fluentbit:
+  enabled: true
+  kind: Deployment
+  testFramework:
+    enabled: false
+  imagePullSecrets:
+    - name: my-registry-secret
+  serviceAccount:
+    create: false
+  rbac:
+    create: false
+  openshift:
+    enabled: true
+  resources:
+    limits:
+      cpu: 400m
+      memory: 256Mi
+    requests:
+      cpu: 100m
+      memory: 256Mi
+  autoscaling:
+    enabled: true
+  labels:
+    mapcolonies.io/environment: dev
+    mapcolonies.io/component: "infrastructure"
+    mapcolonies.io/part-of: "monitoring"
+    mapcolonies.io/owner: "infra"
+  podAnnotations:
+    prometheus.io/scrape: "true"
+    prometheus.io/port: "2021"
+    prometheus.io/path: "/metrics"
+  loki:
+    url: loki.namespace.svc.cluster.local
+    port: "3100"
+  envWithTpl:
+    - name: FLUENT_LOKI_HOST
+      value: "{{ .Values.loki.url }}"
+    - name: FLUENT_LOKI_PORT
+      value: "{{ .Values.loki.port }}"
+  extraPorts:
+    - name: input
+      port: 9880
+      containerPort: 9880
+      protocol: TCP
+    - name: prom-metrics
+      port: 2021
+      containerPort: 2021
+      protocol: TCP
+  luaScripts:
+    transform.lua: |
+      function transform_opa_log(tag, timestamp, record)
+        local new_record = {}
+        -- 1. Input and Bundles
+        new_record["input"] = record["input"]
+        new_record["bundles"] = record["bundles"]
+
+        -- 2. Trace & Span IDs
+        new_record["trace_id"] = record["trace_id"]
+        new_record["span_id"] = record["span_id"]
+
+        -- 3. Extract Environment and Domain
+        if record["labels"] ~= nil then
+            new_record["env"] = record["labels"]["environment"]
+        end
+
+        new_record["opa_domain"] = record["input"]["domain"]
+
+        new_record["token_location"] = "missing"
+        if record["input"]["headers"] ~= nil and record["input"]["headers"]["x-api-key"] ~= nil then
+            new_record["token_location"] = "header"
+        end
+
+        if record["input"]["query"] ~= nil and record["input"]["query"]["token"] ~= nil then
+            if new_record["token_location"] == "header" then
+                new_record["token_location"] = "both"
+            else
+                new_record["token_location"] = "query"
+            end
+        end
+
+        for bundle_name, bundle_data in pairs(record["bundles"] or {}) do
+            if bundle_data.revision then
+                new_record["bundle_revision"] = bundle_data["revision"]
+            end
+        end
+
+        if record["input"]["headers"] ~= nil then 
+          new_record["origin"] = record["input"]["headers"]["origin"]
+          new_record["user_agent"] = record["input"]["headers"]["user-agent"]
+          new_record["referer"] = record["input"]["headers"]["referer"]
+        end
+
+        -- 4. Requested By
+        new_record["requested_by"] = record["requested_by"]
+
+        -- 5. Result splits
+        if record["result"] ~= nil then
+            -- Loki metadata requires strings, so we cast the boolean
+            new_record["allowed"] = tostring(record["result"]["allowed"])
+            new_record["reasons"] = record["result"]["reasons"]
+            new_record["codes"] = record["result"]["codes"]
+            new_record["sub"] = record["result"]["metadata"]["sub"]
+            new_record["kid"] = record["result"]["metadata"]["kid"]
+            new_record["warn"] = record["result"]["warnings"]
+        end
+
+        -- 6. The original OPA timestamp string
+        new_record["opa_timestamp"] = record["timestamp"]
+
+        -- 7. Total processing time
+        if record["metrics"] ~= nil then
+            new_record["total_time_ns"] = tostring(record["metrics"]["timer_server_handler_ns"])
+        end
+
+        -- We return the Fluent Bit ingestion timestamp as the official log time.
+        return 1, timestamp, new_record
+      end
+
+  config:
+    inputs: |
+      [INPUT]
+          Name         http
+          Listen       0.0.0.0
+          Port         9880
+          Tag opa.logs
+
+      [INPUT]
+          Name fluentbit_metrics
+          Tag internal.metrics
+          Scrape_Interval 30
+    filters: |
+      [FILTER]
+          Name                log_to_metrics
+          Match               opa.logs*
+          Tag                 opa.metrics
+          Metric_Name         opa_decisions_total
+          Metric_Mode         counter
+          Metric_Description  Total OPA decisions by status, subject, and domain
+          Add_Label         status $result['computed_status']
+          Add_Label         subject $result['metadata']['sub']
+          Add_Label         domain $input['domain']
+          Add_Label         opa_env $labels['environment']
+
+      [FILTER]
+          Name                log_to_metrics
+          Match               opa.logs*
+          Tag                 opa.metrics
+          Metric_Name         opa_server_handler_ns
+          Metric_Mode         histogram
+          Metric_Description  OPA server handler latency in nanoseconds - not full request latency, but the time spent in the OPA handler itself
+          Value_Field         $metrics['timer_server_handler_ns']
+          Add_Label         status $result['computed_status']
+          Add_Label         opa_env $labels['environment']
+          Bucket              50000
+          Bucket              100000
+          Bucket              250000
+          Bucket              500000
+          Bucket              1000000
+          Bucket              2500000
+          Bucket              5000000
+          Bucket              10000000
+          Bucket              25000000
+          Bucket              50000000
+
+      [FILTER]
+          Name         grep
+          Match        opa.logs*
+          Exclude      $result['computed_status'] ^allowed$
+
+      [FILTER]
+          Name         lua
+          Match        opa.logs*
+          script       /fluent-bit/scripts/transform.lua
+          call         transform_opa_log
+    outputs: |
+      [OUTPUT]
+          Name         loki
+          Match        opa.logs*
+          Host         ${FLUENT_LOKI_HOST}
+          Port         ${FLUENT_LOKI_PORT}
+
+          # LABELS: Domain added here for fast stream routing
+          Labels       job=opa, environment=$env, opa_domain=$opa_domain
+
+          # METADATA: Allowed moved here, along with other high-cardinality data
+          Structured_metadata trace_id=$trace_id, span_id=$span_id, requested_by=$requested_by, reason=$reason, subject=$sub, token_kid=$kid, warnings=$warnings, total_time_ns=$total_time_ns, allowed=$allowed, token_location=$token_location, origin=$origin, user_agent=$user_agent, bundle_revision=$bundle_revision, origin=$origin, referer=$referer
+
+          # CLEANUP: Strip these fields from the main JSON log body
+          Remove_Keys  env, domain, allowed, trace_id, span_id, requested_by, sub, total_time_ns, opa_domain, token_location, origin, user_agent, bundles, referer
+
+      [OUTPUT]
+          Name prometheus_exporter
+          Match *
+          Host 0.0.0.0
+          Port 2021