Using 'OPA run config-file' to define policy file and policy json data file

[Ronnie-personal]

Hi There,

I'm currently reading https://www.openpolicyagent.org/docs/latest/configuration/. The configuration file seems to only support bundle files. Can we define individual policy files and policy data josn files in the YAML configuration file, similar to the 'opa run -d option'?

Thanks!

[anderseknert]

Hi! No, those are passed only from the command line. The reason for that is that bundles provided via config are commonly remote, and require things like credentials to fetch. These bundles also commonly update during the course of OPAs deployment, while file system bundles don't. Shorter version: use bundles on disk for local development, and remote bundles for testing/stage/production.

[Ronnie-personal]

Thanks for the reply, it makes sense.

If I plan to use OPA API (put /v1/data) to push external data, I will have to configure
this policy data as file system bundle to OPA server, is my understanding correct?

If I need both static policy data in remote bundle and policy data through Asynchronous push in my production workload, I will have to configure both remote bundle and file system bundle for the production OPA server.

Please let me know if there are any other options.

Thanks.

[Ronnie-personal]

What if I don't use remote bundle at all, just load policy files to OPA. Is this a common approach?

[anderseknert]

If you know for sure that your policy never will change during the course of the OPA deployment, that's doable. I wouldn't say it's a common approach, as most will want to have the option of having their policy updated, but I've seen a few deployments where they do this.

[Ronnie-personal]

I see what you mean.
Not using remote bundle at all might not be practical.
It's acceptable to push some dynamic data through data API '/v1/data put', but policy itself and static data should be in the remote bundle.