Skip to content

Update OPA docker image version #3448

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
MonkeyCanCode merged 1 commit into from
Jan 15, 2026
Merged

Update OPA docker image version #3448

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions ...pa/tests/src/intTest/java/org/apache/polaris/extension/auth/opa/test/OpaTestResource.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,12 +69,12 @@ public Map<String, String> start() {
default allow := false

# Allow root user for all operations
allow {
allow if {
input.actor.principal == "root"
}

# Allow admin user for all operations
allow {
allow if {
input.actor.principal == "admin"
}
""";
Expand Down
2 changes: 1 addition & 1 deletion ...s/src/intTest/resources/org/apache/polaris/extension/auth/opa/test/Dockerfile-opa-version
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,4 +16,4 @@
# specific language governing permissions and limitations
# under the License.
#
FROM docker.io/openpolicyagent/opa:0.63.0
FROM docker.io/openpolicyagent/opa:1.12.3
Copy link
Contributor

@dimas-b dimas-b Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

side note: I wonder why Renovate did not do this? 🤔

Copy link
Contributor

@dimas-b dimas-b Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@snazy : WDYT?

Copy link
Contributor Author

@MonkeyCanCode MonkeyCanCode Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yeah, I was thinking about the same. Some quick debugging shows this is because they are using Dockerfile-xxxx which is not a standard name for docker file (which should be Dockerfile). That being said, there are couple more outdated stuff.

Copy link
Contributor Author

@MonkeyCanCode MonkeyCanCode Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here is the PR for this: #3454

Copy link
Contributor

@flyrain flyrain Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we need the Renovate on docker? I assume there are use cases need to pin a version for docker to make sure it's stable.

Copy link
Contributor Author

@MonkeyCanCode MonkeyCanCode Jan 15, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So currently we do have renovate bot on Dockerfile used by service/admin (ubi9 openjdk). But if we have proper testing on the docker files, I would think that should be fine. However, as far as I know, not all docker files are covered for automated testing as of now. Here is the reference which @snazy usually approves: #3421

Copy link
Contributor

@flyrain flyrain Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not worried about the docker file in our tests. A lot of getting-started examples based on docker file, which was not covered by any tests.

Copy link
Contributor Author

@MonkeyCanCode MonkeyCanCode Jan 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So those are the ones with standard dockerfile name (e.g. #2678) meaning they are already being monitored by renovated bot. For other getting started example, I think they are docker-compose which are not monitored by renovate bot atm:

  ozone-datanode:
    image: &ozone-image apache/ozone:2.0.0