This message was deleted.
# opal
s
This message was deleted.
s
Hi Philip! First of all, I believe it's likely the error you're seeing has to do with load order. Since OPAL pushes policies incrementally to OPA (i.e., not using bundles), policies have to be loaded in dependency order. If you don't add a manifest file, OPAL will fall back to loading in alphabetical order, which might not work. You can find information about how to add a manifest at https://docs.opal.ac/tutorials/track_a_git_repo/#policy-bundle-manifest---serving-dependent-policy-modules.
Regarding your questions: 1. As the error you're seeing is returned by OPA, looking at its logs will probably help. OPAL's default is to not show OPA logs. To enable OPA logs, set the
OPAL_INLINE_OPA_LOG_FORMAT
environment variable to
full
. 2. OPAL is pretty lightweight, so the easiest option is to run both the server and client on the same machine, which shouldn't cause any performance issues. Another option (assuming what you're doing is developing a policy) is to use OPAL scopes, set up a test scope on your main server, and just run a single client in that scope. You can read about OPAL scopes at https://docs.opal.ac/overview/scopes.
Let me know if you have any further questions
p
Thanks Shaul! Thanks for pointing out the load order - I was not aware of that but it makes sense. Should help me figure this out. Also thanks for the pointer to OPAL scopes, that will be a great thing for us to look into in the future!
Regarding .manifest, we have structured our policy repo like this
Copy code
repo/
  data.json
  domain/
    shared.rego
    applications/ # contains a lot of rego policies that depend on shared.rego and data.json
    shared/ # contains a lot of rego policies that depend on shared.rego and data.json
would it be sufficient for me to add a manifest file like this in the root?
Copy code
data.json
domain/shared.rego
and expect data.json and shared.rego to be loaded first, with anything else loaded in alphabetical order?
s
You don't need the data.json in the manifest as nothing is dependent on it. Other than that, yes, OPAL will load the files in the manifest first, and then other files in alphabetical order.
👍 1
p
great, thanks shaul!
s
Sure thing, let me know if you have any other questions.