This message was deleted Permit #opal

Join Slack

This message was deleted.

# opal

Slackbot

03/23/2023, 8:53 AM

This message was deleted.

Shaul Kremer

03/23/2023, 9:27 AM

Hi Philip! First of all, I believe it's likely the error you're seeing has to do with load order. Since OPAL pushes policies incrementally to OPA (i.e., not using bundles), policies have to be loaded in dependency order. If you don't add a manifest file, OPAL will fall back to loading in alphabetical order, which might not work. You can find information about how to add a manifest at https://docs.opal.ac/tutorials/track_a_git_repo/#policy-bundle-manifest---serving-dependent-policy-modules.

Shaul Kremer

03/23/2023, 9:35 AM

Regarding your questions: 1. As the error you're seeing is returned by OPA, looking at its logs will probably help. OPAL's default is to not show OPA logs. To enable OPA logs, set the

OPAL_INLINE_OPA_LOG_FORMAT

environment variable to

full

. 2. OPAL is pretty lightweight, so the easiest option is to run both the server and client on the same machine, which shouldn't cause any performance issues. Another option (assuming what you're doing is developing a policy) is to use OPAL scopes, set up a test scope on your main server, and just run a single client in that scope. You can read about OPAL scopes at https://docs.opal.ac/overview/scopes.

Shaul Kremer

03/23/2023, 9:35 AM

Let me know if you have any further questions

Philip Claesson

03/23/2023, 9:55 AM

Thanks Shaul! Thanks for pointing out the load order - I was not aware of that but it makes sense. Should help me figure this out. Also thanks for the pointer to OPAL scopes, that will be a great thing for us to look into in the future!

Philip Claesson

03/23/2023, 9:58 AM

Regarding .manifest, we have structured our policy repo like this

Copy code

repo/
  data.json
  domain/
    shared.rego
    applications/ # contains a lot of rego policies that depend on shared.rego and data.json
    shared/ # contains a lot of rego policies that depend on shared.rego and data.json

would it be sufficient for me to add a manifest file like this in the root?

Copy code

data.json
domain/shared.rego

and expect data.json and shared.rego to be loaded first, with anything else loaded in alphabetical order?

Shaul Kremer

03/23/2023, 10:23 AM

You don't need the data.json in the manifest as nothing is dependent on it. Other than that, yes, OPAL will load the files in the manifest first, and then other files in alphabetical order.

👍 1

Philip Claesson

03/23/2023, 10:27 AM

great, thanks shaul!

Shaul Kremer

03/23/2023, 10:34 AM

Sure thing, let me know if you have any other questions.

Open in Slack

Previous Next