Minor improvements to opaServeResponse filter (#3191)

* OPA: Add decision outcome to span in opaServeResponse filter * Increment OPA decision counter metric in opaServeResponse filter To be symmetric with opaAuthorizeRequest filter, OPA decision counts are updated Signed-off-by: Farasath Ahamed <[email protected]>
zalando · Aug 27, 2024 · 2c39d54 · 2c39d54
1 parent ba12cf7
commit 2c39d54
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/filters/openpolicyagent/opaserveresponse/opaserveresponse.go b/filters/openpolicyagent/opaserveresponse/opaserveresponse.go
@@ -126,9 +126,21 @@ func (f *opaServeResponseFilter) Request(fc filters.FilterContext) {
 	fc.Metrics().MeasureSince(f.opa.MetricsKey("eval_time"), start)
 	if err != nil {
 		f.opa.ServeInvalidDecisionError(fc, span, result, err)
+		return
+	}
 
+	allowed, err := result.IsAllowed()
+	if err != nil {
+		f.opa.ServeInvalidDecisionError(fc, span, result, err)
 		return
 	}
+	span.SetTag("opa.decision.allowed", allowed)
+
+	if allowed {
+		fc.Metrics().IncCounter(f.opa.MetricsKey("decision.allow"))
+	} else {
+		fc.Metrics().IncCounter(f.opa.MetricsKey("decision.deny"))
+	}
 
 	f.opa.ServeResponse(fc, span, result)
 }