Using Artifactory as OCI registry host for OPA bundles

[harshiy24]

OPA can download bundles from OCI compatible registries. Artifactory is one such host that can have bundles stored as containers. We have the following config file:

services:
  docker-registry:
    url: https://docker-snapshot.net
    type: oci
    credentials:
      bearer:
        scheme: "Basic"
        token: "username:password"
bundles:
  authz:
    service: docker-registry
    resource: docker-snapshot.net/testorg/policy-deployment-policy/1.0.0
    persist: true
    polling:
      min_delay_seconds: 60
      max_delay_seconds: 120
persistence_directory: /var/opa

When opa is run, this bundle is downloaded and works as expected. But these are the questions for our usecase:

• The point of having OPA fetch its bundles from Artifactory is to allow us to push changes without updating the OPA config each time. Is it possible to have OPA fetch the latest bundle by omitting the tag?
• If not, is it possible to say push a single tag called “latest” like Docker does and if so is OPA smart enough to automatically re-download it when it changes?

Can any of the above two points be satisfied using a specific config?

[kevinswiber]

@harshiy24 I believe if the trigger mode in the configuration is set to periodic, it'll check for a new bundle every now and then. I think the default is between every 1 and 2 minutes.

[kevinswiber]

Oh, to answer your other questions... Yes, you should use a tag of some sort. Periodically, OPA server will check the OCI registry to see if the sha256 digest has changed for that tag. If it has changed, it'll download the new image.

[harshiy24]

Thank you, do we have documentation anywhere that specifies the actual intervals for the 'periodic' value?

[anderseknert]

Yes: https://www.openpolicyagent.org/docs/latest/configuration/#bundles

[harshiy24]

The documentation does mention the values as manual and periodic. But, is there a way that we can set the intervals for the periodic? Like every 2 hours, etc.?

[kevinswiber]

bundles[_].polling.min_delay_seconds and bundles[_].polling.max_delay_seconds