✨ Add typed OPA config schema

.golangci.yml

@@ -34,3 +34,7 @@ issues:
   - linters:
       - lll
     source: "^//\\+kubebuilder"
+  - path: "_test\\.go"
+    linters:
+      - staticcheck
+    text: "SA1019"

api/config/v2alpha2/opaconfig_types.go

@@ -0,0 +1,76 @@
+/*
+Copyright (C) 2025 Bankdata (bankdata@bankdata.dk)
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v2alpha2
+
+import (
+	"encoding/json"
+
+	"k8s.io/apimachinery/pkg/runtime"
+
+	"github.com/bankdata/styra-controller/pkg/opaconfig"
+)
+
+// OPAConfigSpec mirrors the official OPA configuration schema.
+type OPAConfigSpec struct {
+	Services                     *runtime.RawExtension            `json:"services,omitempty"`
+	Labels                       map[string]string                `json:"labels,omitempty"`
+	Discovery                    *runtime.RawExtension            `json:"discovery,omitempty"`
+	Bundle                       *runtime.RawExtension            `json:"bundle,omitempty"`
+	Bundles                      *runtime.RawExtension            `json:"bundles,omitempty"`
+	DecisionLogs                 *runtime.RawExtension            `json:"decision_logs,omitempty"`
+	Status                       *runtime.RawExtension            `json:"status,omitempty"`
+	Plugins                      map[string]*runtime.RawExtension `json:"plugins,omitempty"`
+	Keys                         *runtime.RawExtension            `json:"keys,omitempty"`
+	DefaultDecision              *string                          `json:"default_decision,omitempty"`
+	DefaultAuthorizationDecision *string                          `json:"default_authorization_decision,omitempty"`
+	Caching                      *runtime.RawExtension            `json:"caching,omitempty"`
+	NDBuiltinCache               bool                             `json:"nd_builtin_cache,omitempty"`
+	PersistenceDirectory         *string                          `json:"persistence_directory,omitempty"`
+	DistributedTracing           *runtime.RawExtension            `json:"distributed_tracing,omitempty"`
+	MetricsExport                *runtime.RawExtension            `json:"metrics_export,omitempty"`
+	Server                       *OPAServerConfig                 `json:"server,omitempty"`
+	Storage                      *OPAStorageConfig                `json:"storage,omitempty"`
+}
+
+// OPAServerConfig mirrors OPA's server configuration section.
+type OPAServerConfig struct {
+	Metrics      *runtime.RawExtension `json:"metrics,omitempty"`
+	Encoding     *runtime.RawExtension `json:"encoding,omitempty"`
+	Decoding     *runtime.RawExtension `json:"decoding,omitempty"`
+	LoggerPlugin *string               `json:"logger_plugin,omitempty"`
+}
+
+// OPAStorageConfig mirrors OPA's storage configuration section.
+type OPAStorageConfig struct {
+	Disk *runtime.RawExtension `json:"disk,omitempty"`
+}
+
+// UnmarshalJSON validates the OPA config against the known schema keys before
+// decoding it.
+func (c *OPAConfigSpec) UnmarshalJSON(data []byte) error {
+	if err := opaconfig.ValidateRaw(data); err != nil {
+		return err
+	}
+
+	var decoded OPAConfigSpec
+	if err := json.Unmarshal(data, &decoded); err != nil {
+		return err
+	}
+
+	*c = OPAConfigSpec(decoded)
+	return nil
+}

api/config/v2alpha2/projectconfig_types.go

@@ -54,8 +54,13 @@ type ProjectConfig struct {
 
 	LeaderElection *LeaderElectionConfig `json:"leaderElection"`
 
+	// Deprecated: OPA contains the legacy controller-managed OPA settings.
 	OPA OPAConfig `json:"opa,omitempty"`
 
+	// OPAConfig contains the full OPA configuration schema and takes
+	// precedence over the legacy OPA settings.
+	OPAConfig *OPAConfigSpec `json:"opaConfig,omitempty"`
+
 	// SystemPrefix is a prefix for all the systems that the controller creates.
 	SystemPrefix string `json:"systemPrefix"`
 
@@ -131,6 +136,8 @@ type GitCredentials struct {
 }
 
 // OPAConfig contains default configuration for generated OPA config.
+//
+// Deprecated: use the typed OPA config schema instead.
 type OPAConfig struct {
 	DecisionLogs           DecisionLog        `json:"decisionLogs,omitempty" yaml:"decisionLogs,omitempty"`
 	Metrics                MetricsConfig      `json:"metrics,omitempty" yaml:"metrics,omitempty"`
@@ -168,15 +175,19 @@ type DecisionLog struct {
 	RequestContext RequestContext `json:"requestContext,omitempty"`
 }
 
-// DecisionAPIConfig contains configuration for decision log dispatch
+// DecisionAPIConfig contains configuration for decision log dispatch.
+//
+// Deprecated: use the typed OPA config schema instead.
 type DecisionAPIConfig struct {
 	Name       string               `json:"name,omitempty"`
 	ServiceURL string               `json:"serviceUrl,omitempty"`
 	TokenPath  string               `json:"tokenPath,omitempty"`
 	Reporting  DecisionLogReporting `json:"reporting,omitempty"`
 }
 
-// DecisionLogReporting contains configuration for decision log reporting
+// DecisionLogReporting contains configuration for decision log reporting.
+//
+// Deprecated: use the typed OPA config schema instead.
 type DecisionLogReporting struct {
 	MaxDelaySeconds      int `json:"maxDelaySeconds,omitempty" yaml:"maxDelaySeconds,omitempty"`
 	MinDelaySeconds      int `json:"minDelaySeconds,omitempty" yaml:"minDelaySeconds,omitempty"`

api/styra/v1beta1/opaconfig_types.go

@@ -0,0 +1,72 @@
+/*
+Copyright (C) 2025 Bankdata (bankdata@bankdata.dk)
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	"encoding/json"
+
+	"k8s.io/apimachinery/pkg/runtime"
+)
+
+// OPAConfigSpec mirrors the official OPA configuration schema.
+type OPAConfigSpec struct {
+	Services                     *runtime.RawExtension            `json:"services,omitempty"`
+	Labels                       map[string]string                `json:"labels,omitempty"`
+	Discovery                    *runtime.RawExtension            `json:"discovery,omitempty"`
+	Bundle                       *runtime.RawExtension            `json:"bundle,omitempty"`
+	Bundles                      *runtime.RawExtension            `json:"bundles,omitempty"`
+	DecisionLogs                 *runtime.RawExtension            `json:"decision_logs,omitempty"`
+	Status                       *runtime.RawExtension            `json:"status,omitempty"`
+	Plugins                      map[string]*runtime.RawExtension `json:"plugins,omitempty"`
+	Keys                         *runtime.RawExtension            `json:"keys,omitempty"`
+	DefaultDecision              *string                          `json:"default_decision,omitempty"`
+	DefaultAuthorizationDecision *string                          `json:"default_authorization_decision,omitempty"`
+	Caching                      *runtime.RawExtension            `json:"caching,omitempty"`
+	NDBuiltinCache               bool                             `json:"nd_builtin_cache,omitempty"`
+	PersistenceDirectory         *string                          `json:"persistence_directory,omitempty"`
+	DistributedTracing           *runtime.RawExtension            `json:"distributed_tracing,omitempty"`
+	MetricsExport                *runtime.RawExtension            `json:"metrics_export,omitempty"`
+	Server                       *OPAServerConfig                 `json:"server,omitempty"`
+	Storage                      *OPAStorageConfig                `json:"storage,omitempty"`
+}
+
+// OPAServerConfig mirrors OPA's server configuration section.
+type OPAServerConfig struct {
+	Metrics      *runtime.RawExtension `json:"metrics,omitempty"`
+	Encoding     *runtime.RawExtension `json:"encoding,omitempty"`
+	Decoding     *runtime.RawExtension `json:"decoding,omitempty"`
+	LoggerPlugin *string               `json:"logger_plugin,omitempty"`
+}
+
+// OPAStorageConfig mirrors OPA's storage configuration section.
+type OPAStorageConfig struct {
+	Disk *runtime.RawExtension `json:"disk,omitempty"`
+}
+
+// UnmarshalJSON decodes the OPA config. Validation of keys against the OPA
+// schema is intentionally not done here so that existing resources with
+// non-standard keys can still be read by the controller. Validation is
+// performed on write via the admission webhook.
+func (c *OPAConfigSpec) UnmarshalJSON(data []byte) error {
+	var decoded OPAConfigSpec
+	if err := json.Unmarshal(data, &decoded); err != nil {
+		return err
+	}
+
+	*c = OPAConfigSpec(decoded)
+	return nil
+}