Inquiry about Performance Impact of OPA

[sys0613]

Hi,

I have some concerns regarding the performance impact of OPA. I'm worried that it might introduce performance overheads or slow down the system.

Could you please provide some information or insights on the following:

1. Has any performance testing been conducted for OPA?
2. What are the expected performance characteristics?
3. Are there any known areas where OPA might cause performance degradation?
4. Are there any recommendations or best practices to mitigate potential performance issues?

Any information or feedback on the performance impact of OPA would be greatly appreciated.

Thank you!

[anderseknert]

Hi there! IMO, any large scale deployment of OPA should be tested not just for correctness but to measure (and where possible, improve) performance impact as well. I believe this is a quite common thing to do, so the answer to your first question is "yes" :)

Broadly speaking, there are two things to look at:

1. Policy performance. This will depend largely on what type of policy you've written, and how it's expressed. This is covered by the OPA docs, which should be a good starting point on the topic.
2. Networking overhead. Meaning the cost of each service having to request authorization decisions from an external service. This is commonly the reason (along with better isolation) people tend to run OPA as a sidecar on the same host as the service, rather than having a few "centralized" instances further away. I've written about some alternatives aound that in the past.

I think what's most important is that you use the available tools to measure the performance impact given your specific use case.