Local OPA Bundle File

[Ronnie-personal]

Hi,

According to https://www.openpolicyagent.org/docs/latest/cli/#opa-run, OPA supports to load bundle from a compressed file or directory.
'opa run --bundle'

When the policy or data files are updated in these local directory or compressed file, are they loaded on the fly without requiring a restart of OPA?

The bundle document 'https://www.openpolicyagent.org/docs/latest/management-bundles/' says 'OPA can periodically download bundles of policy and data from remote HTTP servers. The policies and data are loaded on the fly without requiring a restart of OPA'.
In order to poll the changes and load them to OPA agent memory on the fly, we have to use remote HTTP servers, such as S3 or Azure storage?

[anderseknert]

Hi @Ronnie-personal 👋 That's correct. For any real deployment scenario, you'll almost always want the bundles to be provided by a remote server rather than from a local disk. If you want to run the OPA server and have it listen for file updates, you can do so with the --watch flag. I'm not sure if it works with bundles (but please do try!), but it works with policy and data in directories. Note that this mode is not meant for production use, but can occasionally be useful for development.

[Ronnie-personal]

Hi @anderseknert,

What about the Nginx option https://www.openpolicyagent.org/docs/latest/management-bundles/#nginx? The document indicates the option is for local test.
Is possible to use nginx as a bundle server and store bundle files in k8s configMap?

[anderseknert]

Yep, using nginx for local testing is probably better than --watch, as it'll be an experience closer to what you'll have in production.

Kubernetes configmaps are for configuration data. Bundles are (potentially large) tarballs, so they would not be suitable for that purpose. I'd look into mounting storage into the nginx (or whatever bundle server you go with) service instead, or use something like S3 buckets as bundle servers.

[Ronnie-personal]

Thanks for the prompt reply. Make perfect sense.
Do we know why nginx bundle server is for 'test' only and is not for production?

[anderseknert]

Nginx can certainly be used for production :)