Title
h
Hazel Boyle
09/14/2022, 1:28 PMhi, i'm trying out cerbos right now - does the actual check api cache its policies while the admin api doesn't? i've got
watchForChanges/admin/policy/api/check/admin/store/reloada
Alex Olivier (Cerbos)
09/14/2022, 1:34 PMHey that's unexpected. How are you running the Cerbos instance?
h
Hazel Boyle
09/14/2022, 1:39 PMhi alex - it's just included as service in our docker-compose.yml
policies in a volume (whoops, terminology update)
a
Alex Olivier (Cerbos)
09/14/2022, 1:41 PMGreat and do you happen to know which version you are running?
The /api/check endpoint was deprecated a while ago now and replaced with this https://docs.cerbos.dev/cerbos/latest/api/index.html#check-resources
(That said it should still pickup the new policies)
h
Hazel Boyle
09/14/2022, 1:43 PMah sorry, the endpoint was just a mistake on my part - i'm using
/api/check/resourcesa
Alex Olivier (Cerbos)
09/14/2022, 1:44 PMNo worries - you're all up to date. I'm just checking if we have any known issues with this as it's not something I've come across myself yet
h
Hazel Boyle
09/14/2022, 1:44 PMmy test is just having an EFFECT_ALLOW policy for role 1 on a resource - making a check request with role 1 and with role 2 results in the ALLOW/DENY as expected, but then changing the role in the policy to role 2 and making the same requests results in role 1 still being allowed and role 2 denied
(while /admin/policy will show the updated role)
it doesn't properly update its decisions until the container goes down and up again
a
Alex Olivier (Cerbos)
09/14/2022, 1:45 PMcan you share your config file please
c
Charith (Cerbos)
09/14/2022, 1:46 PMCan you run
cerbos compileh
Hazel Boyle
09/14/2022, 1:47 PMcan do shortly - stashed the branch right now as working on something else
config file i can do though
audit:
accessLogsEnabled: true
decisionLogsEnabled: true
enabled: true
backend: local
local:
storagePath: /data/audit_logs
auxData:
jwt:
cacheSize: -1
server:
httpListenAddr: ":3592"
playgroundEnabled: true
adminAPI:
enabled: true
adminCredentials:
[snip]
storage:
driver: "disk"
disk:
directory: /data/policies
watchForChanges: truec
Charith (Cerbos)
09/14/2022, 1:48 PMEven restarting the Cerbos instance should be enough. My hunch is that your policy has an issue that fails compilation so Cerbos is using the cached copy that's valid
h
Hazel Boyle
09/14/2022, 1:49 PMit's possible - i've been running it through playground occasionally and not seeing any problems but i'll definitely check once i'm back on that branch
hey, finally got back to this: compile runs fine on my policies
ran compile on a policy with role 1 allowed, all good. started cerbos, made two checkresources with role 1 and role 2 and got allow and deny as expected. updated policy to allow role 2 instead of role 1, saw it update in /admin/policy, ran compile on it, all good. made the same two checkresources again, role 1 is still allowed and role 2 is still denied
that's the full sequence i went through
c
Charith (Cerbos)
09/14/2022, 5:42 PMHmm.. that's very odd. Which operating system are you using?
h
Hazel Boyle
09/14/2022, 5:42 PMright now testing on windows host w/ docker desktop
c
Charith (Cerbos)
09/14/2022, 5:47 PMAh! Unfortunately, I think that file watching doesn't work on Windows. There are some Windows oddities that break some of the Cerbos features.
h
Hazel Boyle
09/14/2022, 5:53 PMhmmm, fair enough - it's really weird to me that it updates the policy correctly in the admin api but doesn't actually update its responses to requests, though
but i guess that is accurately described by "oddities"
c
Charith (Cerbos)
09/14/2022, 5:58 PMThe admin API reads policies directly from the store. Whereas, for the check API, once we compile a policy, we keep it in memory until it changes on disk. On Windows filesystem notifications don't quite work so the cache doesn't get flushed.
This seems to be a known issue because Docker on Windows uses CIFS volumes that don't support filesystem notifications. Some people suggest using this script but it seems to be a few years old. I also got the impression that WSL volumes are better. Unfortunately, none of us have Windows machines to test any of these solutions. One workaround I could suggest is to convert your policy directory into a Git repo. Cerbos supports local git repos that use the
file