OPA Decision ID but no/nullable result

[AdrianArnautu]

Hi folks,

We have a OPA server configured with bundle API and from time to time we're seeing a response that has a decision ID but no result

Something like (input omitted)

{"decision_id":"abc4fec1-c11a-dda1-8edd-10f31f832a91","result":null}

or

{"decision_id":"abc4fec1-c11a-dda1-8edd-10f31f832a91","input":{"data":"here"}}

I need your help to understand what would be the combination of events as I can't reproduce it.
I know that if there wouldn't be data loaded in OPA we would get at least an empty map - like

{"decision_id":"xxx", "result": {}}

OPA v0.52.0

[anderseknert]

Hi @AdrianArnautu! It's hard to tell without seeing the policy. Is there anything in that which could cause the evaluated rule to be null? 🤔

[AdrianArnautu]

No, our policies should always return a response.
If there's a missing bundle/policy, OPA responds with "result": {}

Looking further into the issue, there's a timing match with the issue we described here open-policy-agent/opa#5868
Looks like whenever there's a fatal error: concurrent map iteration and map write almost always there's an empty response

[anderseknert]

That seems like the likely culprit then. Thanks for raising this — I'll make sure to include it for prioritization.

[ashutosh-narkar]

@AdrianArnautu are you using the http.send builtin in your policy? If you could share your policy that would be helpful. Thanks.

[AdrianArnautu]

hi @ashutosh-narkar,
no, we're using the bundle plugin together with the discovery plugin (5s polling interval)
the bundle contains one rbac policy and data with resources and actions ( ~ 300k)
plus ~ 150 custom policies using the dynamic composition checking attributes from the input

as per metrics, the bundle takes about 1.2 - 1.5s to load into OPA

[ashutosh-narkar]

@AdrianArnautu here's one explanation for the fatal error: concurrent map iteration and map write error. Feel free to comment in the issue with your thoughts.