storage+bundle: Clean old bundle data before new activation (#4944)

If OPA has an activated bundle that owns all roots and a new bundle with empty roots is to be activated, the old bundle's data should first be erased from the store. Currently both the old and new data is kept in the store. This commit attempts to fix this by providing an indication to the truncate call about the scenario in which the root is to be overwritten. Fixes: #4940 Signed-off-by: Ashutosh Narkar <[email protected]>
open-policy-agent · Jul 29, 2022 · 8f63046 · 8f63046
1 parent 462d518
commit 8f63046
Show file tree

Hide file tree

Showing 6 changed files with 791 additions and 3 deletions.
diff --git a/bundle/store.go b/bundle/store.go
@@ -727,6 +727,16 @@ func writeDataAndModules(ctx context.Context, store storage.Store, txn storage.T
 				}
 			}
 		} else {
+			var rootOverwrite bool
+			for _, root := range *b.Manifest.Roots {
+				if root == "" {
+					rootOverwrite = true
+					break
+				}
+			}
+
+			params.RootOverwrite = rootOverwrite
+
 			err := store.Truncate(ctx, txn, params, NewIterator(b.Raw))
 			if err != nil {
 				return fmt.Errorf("store truncate failed for bundle '%s': %v", name, err)