This message was deleted.

We (Permit) haven't done so ourselves, but we had people ask about it before. Should work pretty well. CC: @Asaf Cohen

I ran into the issue, at least documentation wise, that Cloud Run doesn't like to expose 2 ports, and I think Opal Client needs to expose 2 ports.

Interesting. You can solve this by having a reverse proxy (e.g. envoy, Tarefik) take that port and redirect to either the opal-client / opa. Alternatively you can run OPA on a sperate instance. Actually this is probably the easier option

OPAL client and OPA can be split up?

Correct

@Peter Garner these docs should help you out. https://docs.opal.ac/getting-started/running-opal/run-opal-client/get-client-image#running-with-standalone-opa https://docs.opal.ac/getting-started/running-opal/run-opal-client/standalone-opa-uri You need to run: • the standalone image that does not include OPA (in its own cloud run function) • the OPA agent (in its own cloud run function) • make sure the OPAL client container is configured with the standalone OPA url

Thank You!