Opa 1.1.0 server shuts down automatically

[mason-liu]

0.66. was working great, but when I tried to upgrade to 1.1.0, opa server shuts down automatically after it goes up, logs look like
{"level":"debug","msg":"Download in progress.","time":"2025-02-27T12:16:18Z"}
{"level":"debug","msg":"Bundle activation in progress (). Opening storage transaction.","name":"authz","plugin":"bundle","time":"2025-02-27T12:16:18Z"}
{"level":"debug","msg":"Opened storage transaction (4).","name":"authz","plugin":"bundle","time":"2025-02-27T12:16:18Z"}
{"level":"debug","msg":"Closing storage transaction (4).","name":"authz","plugin":"bundle","time":"2025-02-27T12:16:18Z"}
{"level":"info","msg":"Bundle loaded and activated successfully. Etag updated to "......".","name":"authz","plugin":"bundle","time":"2025-02-27T12:16:18Z"}
{"level":"debug","msg":"Waiting 1m58.290808633s before next download/retry.","time":"2025-02-27T12:16:18Z"}
{"headers":{"Content-Length":["213"],"Content-Type":["application/json"],"Date":["Thu, 27 Feb 2025 12:16:18 GMT"]},"level":"debug","method":"POST","msg":"Received response.","status":"200 OK","time":"2025-02-27T12:16:18Z","url":"https://telemetry.openpolicyagent.org/v1/version"}
{"current_version":"1.1.0","level":"debug","msg":"OPA is up to date.","time":"2025-02-27T12:16:18Z"}
{"level":"info","msg":"Shutting down...","time":"2025-02-27T12:16:45Z"}
{"level":"info","msg":"Server shutdown.","time":"2025-02-27T12:16:45Z"}
{"level":"info","msg":"Stopping bundle loader.","name":"authz","plugin":"bundle","time":"2025-02-27T12:16:45Z"}

The bundle itself is good, I can run that in my local with opa1.1.0, but when I try to run opa as pod and download bundle from s3 bucket, will shutdown immediately.

[anderseknert]

Hi there! Hmm, OPA doesn't indicate any failure, so that makes me suspect the pod allocated more memory than it's been assigned. Do you have any resource quotas or memory limits enforced by Kubernetes for these pods? Have you checked memory consumption of the pod running OPA?

It's still odd that this worked in v0.66.0 but not in v1.1.0... which may indicate a regression somewhere. Would be interesting to compare memory usage of the two versions for your deployment.

[mason-liu]

My resource quota is
requests:
cpu: 500m
memory: 1Gi
limits:
cpu: 2
memory: 3Gi
which is same with 0.66.0

I tried to reduce cpu and memory, same thing.

Also I stopped to pull bundle from s3, still same thing.

[anderseknert]

Oh, I think I know what's up! OPA is now only exposed on the localhost interface by default, and that's probably making the container unreachable outside of Docker. Can you try passing --addr 0.0.0.0:8181 to the opa run command?

https://www.openpolicyagent.org/docs/latest/security/#interface-binding

[mason-liu]

Thanks a lot @anderseknert , I think it is working, let me do end 2 end test

[mason-liu]

I did test this, and it is good now, thank you very much @anderseknert !

[anderseknert]

Anytime! We'll update the docs on 1.0 to better reflect this 👍