Based on the available documentation, the OPAL Helm chart and OPAL server configuration primarily support two authentication methods for private Git repositories: 1. ​*SSH keys*​ - Using the

OPAL_POLICY_REPO_SSH_KEY

environment variable (1) (2) 2. ​*Public repositories*​ - No authentication needed (3) The documentation shows that for private repositories, SSH keys are the standard approach. The SSH private key content is configured via the

OPAL_POLICY_REPO_SSH_KEY

environment variable (1) (2) . For the Helm chart specifically, the configuration would be set through the

server.extraEnv

field (4) , which allows passing extra configuration to the OPAL server including authentication credentials. Unfortunately, the documentation doesn't show support for: • Using Kubernetes serviceAccounts for Git authentication • Mounting existing repositories as volumes • Alternative authentication methods beyond SSH keys for private repos ​*Potential Workarounds:*​ 1. ​*Use Kubernetes Secrets*​: Instead of hardcoding values in YAML, you could store the SSH key in a Kubernetes Secret and reference it in your Helm values 2. ​*External Secrets Operator*​: Consider using tools like External Secrets Operator to sync secrets from external secret management systems 3. ​*Public repository with webhooks*​: If security permits, using a public repository with webhook-based updates for real-time synchronization (3) (5) The documentation indicates that OPAL is designed to track Git repositories by cloning them rather than using pre-existing mounted volumes (3) . Would you like guidance on setting up SSH keys with Kubernetes Secrets to avoid hardcoding credentials?

To learn more, see the sources I considered: [[1] OPAL Configuration Guide | OPAL](https://docs.opal.ac/getting-started/configuration) [[2] Policy Repository Location](https://docs.opal.ac/getting-started/running-opal/run-opal-server/policy-repo-location) [[3] Track a Git Repo | OPAL](https://docs.opal.ac/tutorials/track_a_git_repo) [[4] OPAL Helm Chart for Kubernetes](https://docs.opal.ac/tutorials/helm-chart-for-kubernetes) [[5] Step 3: Changing and updating the policy in realtime](https://docs.opal.ac/getting-started/quickstart/opal-playground/updating-the-policy)

@Ask Inkeep Can I add pod annotation in the config ?

I don't have specific information in the available documentation about adding pod annotations to the OPAL Helm chart configuration. The documentation covers various OPAL configuration options including environment variables (1) (2) (3) , security parameters (4) , and deployment examples like GCP Cloud Run (5) , but doesn't specifically address Helm chart pod annotation capabilities. For Helm-specific configuration options like pod annotations, you might want to: • Check the OPAL Helm chart's values.yaml file directly in the chart repository • Reach out over Email for more specific Helm chart documentation Would you like me to provide a general answer about how pod annotations typically work in Helm charts?

To learn more, see the sources I considered: [[1] OPAL Configuration Guide | OPAL](https://docs.opal.ac/getting-started/configuration) [[2] OPAL Configuration Guide | OPAL](https://docs.opal.ac/getting-started/configuration) [[3] OPAL Configuration Guide | OPAL](https://docs.opal.ac/getting-started/configuration) [[4] Configuring the Security Parameters](https://docs.opal.ac/getting-started/running-opal/run-opal-server/security-parameters) [[5] Deploying PDP on GCP Cloud Run](https://docs.permit.io/how-to/deploy/cloud-hosts/gcp-cloud-run)