• Home
  • Features
  • Pricing
  • Docs
  • Announcements
  • Sign In

zalando / skipper / 18462314072
78%

Build:
DEFAULT BRANCH: master
Ran 13 Oct 2025 10:21AM UTC
Jobs 1
Files 285
Run time 1min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

13 Oct 2025 10:08AM UTC coverage: 77.169% (-0.04%) from 77.208%
18462314072

push

github

web-flow
Open Policy Agent: Instance Preloading (#3562)

## Overview

This feature implements issue #3526 by moving OPA instance startup and
bundle downloading out of filter creation to make route processing
faster and more reliable.

## Problem

Previously, OPA filters created instances synchronously during filter
creation, which:
- Blocked route processing during bundle downloads
- Could cause timeouts with large bundles or slow networks
- Violated the assumption that filter creation should be fast

## Solution

When enabled via the `--enable-open-policy-agent-preloading` flag, OPA
instances are pre-loaded during route processing instead of filter
creation:

1. **Route PreProcessor**: Scans routes for OPA filter usage and
pre-creates instances
2. **Loading Strategy**: Parallel and blocking loading on startup,
sequential on route updates
3. **Non-blocking Filter Creation**: Filters only lookup created
instances, failing fast on a hard error
4. **Filters Reflect Health**: Filters return a 503 as long as an
instance is not yet healthy

Not that when Skipper starts, the PreProcessor blocks on the first
invocation, guaranteeing that OPA instances have been tried to start.
Only in steady state, when new routes introduce new OPA policies, can a
503 occur temporarily. However since these are new routes, it would
rather be odd for them to immediately receive traffic.

Without the flag, the behaviour stays unchanged.

## Usage

### Enable the Feature

```bash
skipper --enable-open-policy-agent --enable-open-policy-agent-preloading
```

### Configuration

- `--enable-open-policy-agent-preloading`: Enable the pre-loading
behavior (default: false)
- All existing OPA configuration flags remain the same

---------

Signed-off-by: Magnus Jungsbluth <magnus.jungsbluth@zalando.de>
Signed-off-by: Pushpalanka Jayawardhana <pushpalankajaya@gmail.com>
Co-authored-by: Pushpalanka Jayawardhana <pushpalankajaya@gmail.com>
Co-authored-by: Pushpalanka Jayawardhana <pushpalanka.jayawar... (continued)

320 of 422 new or added lines in 10 files covered. (75.83%)

1 existing line in 1 file now uncovered.

23555 of 30524 relevant lines covered (77.17%)

86278.25 hits per line

New Missed Lines in Diff

Lines Coverage ∆ File
1
89.8
2.47% filters/openpolicyagent/opaauthorizerequest/opaauthorizerequest.go
4
86.0
-2.54% filters/openpolicyagent/opaserveresponse/opaserveresponse.go
5
67.57
-0.25% skipper.go
11
49.04
-4.81% proxy/proxytest/proxytest.go
13
87.5
filters/openpolicyagent/internal/opatestutils/openpolicyagent_helpers.go
16
78.95
-21.05% filters/openpolicyagent/response.go
23
82.17
-0.08% filters/openpolicyagent/openpolicyagent.go
29
67.78
filters/openpolicyagent/preprocessor.go

Uncovered Existing Lines

Lines Coverage ∆ File
1
82.17
-0.08% filters/openpolicyagent/openpolicyagent.go
Jobs
ID Job ID Ran Files Coverage
1 18462314072.1 13 Oct 2025 10:21AM UTC 285
77.17
GitHub Action Run
Source Files on build 18462314072
  • Tree
  • List 285
  • Changed 9
  • Source Changed 8
  • Coverage Changed 8
Coverage ∆ File Lines Relevant Covered Missed Hits/Line
  • Back to Repo
  • Github Actions Build #18462314072
  • 423e2392 on github
  • Prev Build on master (#18461128947)
  • Next Build on master (#18532140170)
STATUS · Troubleshooting · Open an Issue · Sales · Support · CAREERS · ENTERPRISE · START FREE · SCHEDULE DEMO
ANNOUNCEMENTS · TWITTER · TOS & SLA · Supported CI Services · What's a CI service? · Automated Testing

© 2026 Coveralls, Inc