https://linen.dev logo
Join Slack
Powered by
<#C01RUUYV3TP|> I am looking for passing OPAL_INL...
# opal
n
#C01RUUYV3TP I am looking for passing OPAL_INLINE_OPA_cONFIG to get the OPA configured for decision logs to an http endpoint and I don’t see a reference how to use this. Could you please guide me ?
a
Hi @Nishanth Mathew Joy, I'm an AI assistant for Permit.io. I'll analyze available sources and get back to you shortly.
To configure OPA decision logs via 
OPAL_INLINE_OPA_CONFIG
, you need to pass an OpaServerOptions model encoded as a JSON string (1) . The 
OPAL_INLINE_OPA_CONFIG
environment variable accepts a JSON-encoded configuration that affects how OPA starts when running 
opa run --server
inline (2) . Here's how to set it up: 1. Create your OPA configuration as a JSON object 2. Encode it as a string for the environment variable For decision logs specifically, you can configure OPA to send logs to an HTTP endpoint. While the exact decision log configuration structure isn't detailed in the OPAL docs, the PDP configuration shows that decision logs are controlled through these settings (3) : • 
PDP_OPA_DECISION_LOG_ENABLED
- Set to 
True
to enable decision logs • 
PDP_OPA_DECISION_LOG_CONSOLE
- Set to 
True
to also print logs to console • 
PDP_OPA_DECISION_LOG_INGRESS_ROUTE
- The route for uploading logs (default: 
/v2/decision-logs/ingress
) • 
PDP_OPA_DECISION_LOG_INGRESS_BACKEND_TIER_URL
- The URL logs will be uploaded to The OPAL configuration guide indicates that 
OPAL_INLINE_OPA_CONFIG
should be formatted as (2) :
Copy code
OPAL_INLINE_OPA_CONFIG='{}'
You'll need to structure your JSON configuration to include the decision log settings that OPA expects for HTTP reporting endpoints. For troubleshooting which PDP version and configuration you're running, you can check the logs with appropriate verbosity settings (4) .
Thanks for the feedback, glad I was helpful.
n
Can you give me an example with docker compose
t
@Ask Inkeep can you give an example with docker compose?
a
Thanks for tagging me @Thomas. I'll look through relevant sources and get back to you shortly.
Here's a Docker Compose example with 
OPAL_INLINE_OPA_CONFIG
configured for the OPAL client (1) :
Copy code
services:
  opal_client:
    image: permitio/opal-client:latest
    environment:
      - OPAL_SERVER_URL=<http://opal_server:7002>
      - OPAL_LOG_FORMAT_INCLUDE_PID=true
      - OPAL_INLINE_OPA_LOG_FORMAT=http
      - OPAL_INLINE_OPA_CONFIG={}
    ports:
      - "7766:7000"
      - "8181:8181"
    depends_on:
      - opal_server
    command: sh -c "./wait-for.sh opal_server:7002 --timeout=20 -- ./start.sh"
The 
OPAL_INLINE_OPA_CONFIG
environment variable accepts a JSON object that configures OPA server options when running 
opa run --server
inline (2) . You need to watch escaping quotes when setting this configuration . For a complete working example, the docker-compose file typically includes three main services (3) : 1. ​*Broadcast Channel*​ - Using Postgres, Redis, or Kafka 2. ​*OPAL Server*​ - The policy management server 3. ​*OPAL Client*​ - Runs OPA inline with the configuration The OPAL client configuration shows 
OPAL_INLINE_OPA_LOG_FORMAT
can be set to 
none
, 
minimal
, 
http
, or 
full
for different log verbosity levels (1) , (4) . Note that when 
OPAL_INLINE_OPA_ENABLED=True
(the default) , OPAL runs OPA inside the same container (2) , (4) .
To learn more, see the sources I considered: [[1] OPAL Client](https://docs.opal.ac/getting-started/quickstart/docker-compose-config/opal-client) [[2] OPAL Configuration Guide | OPAL](https://docs.opal.ac/getting-started/configuration) [[3] Understanding the Docker Compose Example Configuration](https://docs.opal.ac/getting-started/quickstart/docker-compose-config/overview) [[4] Configurations](https://docs.permit.io/concepts/pdp/configuration)
n
What should be the configuration we are expediting inside opal inline OPA config?
t
that is OPA specific config that you need to test, but it should be something like:
Copy code
version: '3.8'

services:
  opal-server:
    image: permitio/opal-server:latest
    environment:
      - OPAL_BROADCAST_URI=<redis://redis:6379>
      - REDIS_HOST=redis
      - OPAL_POLICY_REPO_URL=<https://github.com/your-org/your-policies.git>
    ports:
      - "7002:7002"
    depends_on:
      - redis

  opal-client:
    image: permitio/opal-client:latest
    environment:
      - OPAL_SERVER_URL=<http://opal-server:7002>
      - OPAL_BROADCAST_URI=<redis://redis:6379>
      - OPAL_INLINE_OPA_CONFIG={"decision_logs":{"plugin":"http","plugin_config":{"url":"<http://log-server:8080/logs>","headers":{"Authorization":"Bearer my-secret-token"},"batch":{"max_wait_time_seconds":10,"max_size_bytes":1048576}},"reporting":{"min_delay_seconds":300,"max_delay_seconds":600}}}
    ports:
      - "7000:7000"
    volumes:
      - ./policies:/opal-client/policies
    depends_on:
      - opal-server
      - redis

  log-server:
    image: your-log-server-image:latest
    ports:
      - "8080:8080"

  redis:
    image: redis:alpine
    ports:
      - "6379:6379"
n
Thanks
p
Hey, thanks for reaching out ! It seems our team is a little busy right now, a human will be with you within the next hour or so. In the meantime, can I help you ?
Open in Slack
PreviousNext
Powered by