Update OPA docker image version by MonkeyCanCode · Pull Request #3448 · apache/polaris

MonkeyCanCode · 2026-01-15T02:38:48Z

As reported in #3447, we are using very outdated version of OPA image. This PR bump the version to the latest one and updated the rego policy to reflect v1.

Checklist

🛡️ Don't disclose security issues! (contact security@apache.org)
🔗 Clearly explained why the changes are needed, or linked related issues: Fixes #
🧪 Added/updated tests with good coverage, or manually tested (and explained how)
💡 Added comments for complex logic
🧾 Updated CHANGELOG.md (if needed)
📚 Updated documentation in site/content/in-dev/unreleased (if needed)

flyrain

LGTM. Thanks @MonkeyCanCode. cc @sungwy

dimas-b

Thanks for keeping an eye of this, @MonkeyCanCode !

dimas-b · 2026-01-15T19:25:34Z

...ests/src/intTest/resources/org/apache/polaris/extension/auth/opa/test/Dockerfile-opa-version

 # under the License.
 #
-FROM docker.io/openpolicyagent/opa:0.63.0
+FROM docker.io/openpolicyagent/opa:1.12.3


side note: I wonder why Renovate did not do this? 🤔

@snazy : WDYT?

Yeah, I was thinking about the same. Some quick debugging shows this is because they are using Dockerfile-xxxx which is not a standard name for docker file (which should be Dockerfile). That being said, there are couple more outdated stuff.

Here is the PR for this: #3454

Do we need the Renovate on docker? I assume there are use cases need to pin a version for docker to make sure it's stable.

So currently we do have renovate bot on Dockerfile used by service/admin (ubi9 openjdk). But if we have proper testing on the docker files, I would think that should be fine. However, as far as I know, not all docker files are covered for automated testing as of now. Here is the reference which @snazy usually approves: #3421

I'm not worried about the docker file in our tests. A lot of getting-started examples based on docker file, which was not covered by any tests.

So those are the ones with standard dockerfile name (e.g. #2678) meaning they are already being monitored by renovated bot. For other getting started example, I think they are docker-compose which are not monitored by renovate bot atm:

ozone-datanode: image: &ozone-image apache/ozone:2.0.0

sungwy · 2026-01-15T22:08:54Z

Thanks for the cc @flyrain - I think it's a good idea to bump up the docker image to 1.0 +.

+1 from my side as well

MonkeyCanCode · 2026-01-15T22:17:15Z

Seem likes everyone approved this. I will merge this now.

* Flatten events hierarchy (apache#3293) Co-authored-by: Alexandre Dutra <adutra@apache.org> * (feat)Python CLI: Switch from Poetry to UV for python package management (apache#3410) * chore(deps): update dependency uv to v0.9.24 (apache#3430) * (doc): Fix Polaris getting started doc and docker-compose (apache#3425) * Fix Polaris getting started doc * Fix Polaris getting started doc * [Minor] [Site] fix scheduled meetings table (apache#3423) * NoSQL: add to config-docs (apache#3397) Add the NoSQL specific configurtion options to the configuration docs generation module. * Blog: Add blog for Lance-Polaris integration (apache#3424) * Add `--hierarchical` to Polaris CLI (apache#3426) * Add `--hierarchical` to Polaris CLI Following up on apache#3347 this change adds the `--hierarchical` option to Polaris CLI in order to allow configuring this storage flag in Azure-based Catalogs. * Use new Request Context for each realm during implicit bootstrap (apache#3411) * Use new Request Context for each realm during implicit bootstrap The implicit (auto) bootstrap calls used to share Request Context for potentially many realms. That used to work by coincidence because `RealmConfig`, for example, is a `RequestScoped` bean. With this change each realm will be bootstrapped in its own dedicated Request Context. This change lays down a foundation for future refactoring related to `RealmConfig`. * Change nested docs to use title case (apache#3432) * fix(deps): update dependency com.github.dasniko:testcontainers-keycloak to v4.1.1 (apache#3438) * Fix Helm doc note section under Gateway API (apache#3436) * Relax UV version (apache#3437) * fix(deps): update dependency org.jboss.weld.se:weld-se-core to v6.0.4.final (apache#3439) * Add free-disk-space action to regtest + spark_client_regtests (apache#3429) The "Spark Client Regression Tests" CI job requires some disk space to operate. With just a little bit of added "content", the job will fail to `no space left on device` during the `docker compose` invocation building an image. Such errors make it impossible to get the log from the workflow, unless you capture the log before the workflow runs into the `no space left on device` situation. With "no space left", GitHub workflow infra is unable to capture the logs. ``` #10 ERROR: failed to copy files: userspace copy failed: write /home/spark/polaris/v3.5/integration/build/2.13/quarkus-build/gen/quarkus-app/lib/main/com.google.http-client.google-http-client-1.47.1.jar: no space left on device ``` This change is a stop-gap solution to prevent this error from happening for now. * fix(deps): update dependency com.google.cloud:google-cloud-iamcredentials to v2.82.0 (apache#3449) * Update OPA docker image version (apache#3448) * Blog: Mapping Legacy and Heterogeneous Datalakes in Apache P… (apache#3417) * fix(deps): update dependency org.postgresql:postgresql to v42.7.9 (apache#3453) * chore(deps): update apache/spark docker tag to v3.5.8 (apache#3458) * fix(deps): update dependency org.apache.spark:spark-sql_2.12 to v3.5.8 (apache#3450) * site: add blog anchors (apache#3443) * render anchor * improve readme * RAT * fix(deps): update dependency com.google.cloud:google-cloud-storage-bom to v2.62.0 (apache#3455) * Update renovate to include docker file with suffix (apache#3454) * feat: Add trace_id to AWS STS session tags for end-to-end correlation (apache#3414) * feat: Add trace_id to AWS STS session tags for end-to-end correlation This change enables deterministic correlation between: - Catalog operations (Polaris events) - Credential vending (AWS CloudTrail via STS session tags) - Metrics reports from compute engines (Spark, Trino, etc.) Changes: 1. Add traceId field to CredentialVendingContext - Marked with @Value.Auxiliary to exclude from cache key comparison - Every request has unique trace ID, so including it in equals/hashCode would prevent all cache hits - Trace ID is for correlation/audit only, not authorization 2. Extract OpenTelemetry trace ID in StorageAccessConfigProvider - getCurrentTraceId() extracts trace ID from current span context - Populates CredentialVendingContext.traceId for each request 3. Add trace_id to AWS STS session tags - AwsSessionTagsBuilder includes trace_id in session tags - Appears in CloudTrail logs for correlation with catalog operations - Uses 'unknown' placeholder when trace ID is not available 4. Update tests to verify trace_id is included in session tags This enables operators to correlate: - Which catalog operation triggered credential vending - Which data access events in CloudTrail correspond to catalog operations - Which metrics reports correspond to specific catalog operations * Update AwsCredentialsStorageIntegrationTest.java * Review comments 1. Feature Flag to Disable Trace IDs in Session Tags Added a new feature configuration flag INCLUDE_TRACE_ID_IN_SESSION_TAGS in FeatureConfiguration.java: polaris-core/src/main/java/org/apache/polaris/core/config/FeatureConfiguration.java (EXCERPT) public static final FeatureConfiguration<Boolean> INCLUDE_TRACE_ID_IN_SESSION_TAGS = PolarisConfiguration.<Boolean>builder() .key("INCLUDE_TRACE_ID_IN_SESSION_TAGS") .description("If set to true (and INCLUDE_SESSION_TAGS_IN_SUBSCOPED_CREDENTIAL is also true), ...") .defaultValue(false) .buildFeatureConfiguration(); 2. Cache Key Correctness Solution The solution ensures cache correctness by including trace IDs in cache keys only when they affect the vended credentials: Key changes: 1. `StorageCredentialCacheKey` - Added a new traceIdForCaching() field that is populated only when trace IDs affect credentials: polaris-core/src/main/java/org/apache/polaris/core/storage/cache/StorageCredentialCacheKey.java (EXCERPT) @Value.Parameter(order = 10) Optional<String> traceIdForCaching(); 2. `StorageCredentialCache` - Reads both flags and includes trace ID in cache key only when both are enabled: polaris-core/src/main/java/org/apache/polaris/core/storage/cache/StorageCredentialCache.java (EXCERPT) boolean includeTraceIdInCacheKey = includeSessionTags && includeTraceIdInSessionTags; StorageCredentialCacheKey key = StorageCredentialCacheKey.of(..., includeTraceIdInCacheKey); 3. `AwsSessionTagsBuilder` - Conditionally includes trace ID based on the new flag. 4. Tests - Updated existing tests and added a new test testSessionTagsWithTraceIdWhenBothFlagsEnabled. How This Resolves the Cache Correctness vs. Efficiency Trade-off | Configuration | Trace ID in Session Tags | Trace ID in Cache Key | Caching Behavior | |---------------|--------------------------|----------------------|------------------| | Session tags disabled | No | No | Efficient caching | | Session tags enabled, trace ID disabled (default) | No | No | Efficient caching | | Session tags enabled, trace ID enabled | Yes | Yes | Correct but no caching across requests | This design ensures: • Correctness: When trace IDs affect credentials, they're included in the cache key • Efficiency: When trace IDs don't affect credentials, they're excluded from the cache key, allowing cache hits across requests * Update CHANGELOG.md Co-authored-by: Anand Kumar Sankaran <anand.sankaran@workday.com> * site: Update website for 1.3.0 (apache#3464) * site: Fix blog diagram with corrected architecture image (apache#3466) * Site: Add 20260108 Community Meeting (apache#3460) * CI: CLI Nightly build (apache#3457) * Fix Helm repository update after release vote (apache#3461) The Github workflow included a `svn add index.yaml` command which would be correct if it was a Git repository. But in SVN, this results in an error when the file is already under version control. This line is unnecessary and a simple `svn commit` results in pushing the changes to the SVN server. * Fix typo for the wrong reference (apache#3473) * chore(deps): update apache/ozone docker tag to v2.1.0 (apache#3364) * chore(deps): update docker.io/prom/prometheus docker tag to v3.9.1 (apache#3366) * chore(deps): update quay.io/keycloak/keycloak docker tag to v26.5.1 (apache#3362) * Last merged commit 1451ce4 --------- Co-authored-by: Oleg Soloviov <40199597+olsoloviov@users.noreply.github.com> Co-authored-by: Alexandre Dutra <adutra@apache.org> Co-authored-by: Yong Zheng <yongzheng0809@gmail.com> Co-authored-by: Mend Renovate <bot@renovateapp.com> Co-authored-by: Danica Fine <danica.fine@gmail.com> Co-authored-by: Jack Ye <jackye@apache.org> Co-authored-by: Dmitri Bourlatchkov <dmitri.bourlatchkov@gmail.com> Co-authored-by: Maninder <parmar.maninderjit@gmail.com> Co-authored-by: Kevin Liu <kevinjqliu@users.noreply.github.com> Co-authored-by: Anand K Sankaran <lists@anands.net> Co-authored-by: Anand Kumar Sankaran <anand.sankaran@workday.com> Co-authored-by: Pierre Laporte <pierre@pingtimeout.fr> Co-authored-by: JB Onofré <jbonofre@apache.org> Co-authored-by: Honah (Jonas) J. <honahx@apache.org>

Update OPA docker image version

4e1b82d

github-project-automation bot added this to Basic Kanban Board Jan 15, 2026

github-project-automation bot moved this to PRs In Progress in Basic Kanban Board Jan 15, 2026

MonkeyCanCode requested review from dimas-b, flyrain and snazy January 15, 2026 02:44

flyrain approved these changes Jan 15, 2026

View reviewed changes

github-project-automation bot moved this from PRs In Progress to Ready to merge in Basic Kanban Board Jan 15, 2026

dimas-b approved these changes Jan 15, 2026

View reviewed changes

MonkeyCanCode merged commit 01a61e6 into apache:main Jan 15, 2026
15 checks passed

github-project-automation bot moved this from Ready to merge to Done in Basic Kanban Board Jan 15, 2026

evindj pushed a commit to evindj/polaris that referenced this pull request Jan 26, 2026

Update OPA docker image version (apache#3448)

4079172

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Update OPA docker image version#3448

Update OPA docker image version#3448
MonkeyCanCode merged 1 commit intoapache:mainfrom
MonkeyCanCode:opa

MonkeyCanCode commented Jan 15, 2026

Uh oh!

flyrain left a comment

Uh oh!

dimas-b left a comment

Uh oh!

dimas-b Jan 15, 2026

Uh oh!

dimas-b Jan 15, 2026

Uh oh!

MonkeyCanCode Jan 15, 2026

Uh oh!

MonkeyCanCode Jan 15, 2026

Uh oh!

flyrain Jan 15, 2026

Uh oh!

MonkeyCanCode Jan 15, 2026 •

edited

Loading

Uh oh!

flyrain Jan 15, 2026

Uh oh!

MonkeyCanCode Jan 15, 2026

Uh oh!

sungwy commented Jan 15, 2026

Uh oh!

MonkeyCanCode commented Jan 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

MonkeyCanCode commented Jan 15, 2026

Checklist

Uh oh!

flyrain left a comment

Choose a reason for hiding this comment

Uh oh!

dimas-b left a comment

Choose a reason for hiding this comment

Uh oh!

dimas-b Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

dimas-b Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

MonkeyCanCode Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

MonkeyCanCode Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

flyrain Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

MonkeyCanCode Jan 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

flyrain Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

MonkeyCanCode Jan 15, 2026

Choose a reason for hiding this comment

Uh oh!

sungwy commented Jan 15, 2026

Uh oh!

MonkeyCanCode commented Jan 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

MonkeyCanCode Jan 15, 2026 •

edited

Loading