adding our values file -

You can always tag the @Ask Inkeep or inside the docs page to help you get started quickly 🤖

Based on the thread history, it looks like the OPAL client isn't starting properly due to missing data source configuration. Here's what's happening and how to fix it: The OPAL client needs proper data sources configured to become healthy (1) . When

server.dataConfigSources

has no entries, the Helm chart automatically sets

OPAL_DATA_UPDATER_ENABLED: False

to prevent the client from reporting an unhealthy state (2) . To resolve this, you need to configure your data sources in your Helm values file. Here's the minimum configuration needed (1) :

server:
  dataConfigSources:
    config:
      entries:
        - url: "<https://api.permit.io/v1/policy-config>"
          topics: ["policy_data"]
          config:
            headers:
              Authorization: "Bearer YOUR-SECRET-TOKEN"

The key configuration variables for the Helm chart include (2) : •

server.policyRepoUrl

- Git repository with your policy code •

server.dataConfigSources

- Data sources for the clients •

server.broadcastUri

- Backend for broadcasting updates (needed if replicas > 1) For a complete working example with proper data sources (3) :

export OPAL_DATA_CONFIG_SOURCES='{"config": {"entries": [{"url": "<https://api.permit.io/v1/policy-config>", "topics": ["policy_data"], "config": {"headers": {"Authorization": "Bearer FAKE-SECRET"}}}]}}'

Make sure your values file includes at least one data source entry, otherwise the client won't be able to complete its initialization and will remain unhealthy.

To learn more, see the sources I considered: [[1] Data Source Configuration](https://docs.opal.ac/getting-started/running-opal/run-opal-server/data-sources) [[2] OPAL Helm Chart for Kubernetes](https://docs.opal.ac/tutorials/helm-chart-for-kubernetes) [[3] Running the Server](https://docs.opal.ac/getting-started/running-opal/run-opal-server/putting-all-together)

but not sure what does data source should be? also tried to start it without any datasource so it will set automatically the OPAL_DATA_UPDATER_ENABLED to false so client should start healthy no ?

in addition does the opal-server has web ui ? or nope ?

@Ask Inkeep hey i tried to read docs, but still didnt understand what is a data source and why we uses it, in case we want only kubernetes level opa for example, what should i use there for ?

A data source in OPAL provides the actual authorization data (like users, roles, permissions) that your policies need to make decisions (1) (2) . Even for Kubernetes-level authorization, you need data about what resources exist and who can access them. For Kubernetes-level OPA specifically, OPAL offers distinct advantages over kube-mgmt (1) : 1. ​*Decoupling from deployments*​: You can update both policy and data on the fly without changing K8s configuration 2. ​*Data updates and distribution*​: OPAL allows loading data from multiple sources and maintaining sync 3. ​*More secure channel*​: OPAL provides secure data loading with JWT authentication What are Data Sources? Data sources are directives that tell OPAL clients how to fetch data and where to put it in OPA (3) . The

OPAL_DATA_CONFIG_SOURCES

contains the "complete picture" data sources - fetched after OPAL client loads and after every disconnect . For Kubernetes-level Authorization If you're using OPAL just for Kubernetes authorization without external data, you can configure a minimal data source. Here's an example from the documentation :

{
  "config": {
    "entries": [
      {
        "url": "<http://example-api-server.com/policy-config>",
        "config": {
          "headers": {
            "Authorization": "Bearer YOUR-SECRET-HERE"
          }
        },
        "topics": [
          "policy_data"
        ],
        "dst_path": "/"
      }
    ]
  }
}

The data source URL should point to an API that returns your Kubernetes authorization data (like namespace permissions, RBAC rules, etc.) . If you don't have external data yet, you could start with a simple static JSON file served via HTTP containing your initial authorization rules.

To learn more, see the sources I considered: [[1] Data updates](https://docs.opal.ac/faq/) [[2] FAQ | OPAL](https://docs.opal.ac/FAQ) [[3] How to configure external data sources](https://docs.opal.ac/tutorials/configure_external_data_sources)

You're right that policies rarely work without any context or state data. Here's an example of configuring OPAL with minimal or empty data sources: For a minimal data source configuration with empty data, you can structure your

OPAL_DATA_CONFIG_SOURCES

like this (1) :

{
  "config": {
    "entries": [
      {
        "url": "<https://api.permit.io/v1/policy-config>",
        "topics": [
          "policy_data"
        ],
        "config": {
          "headers": {
            "Authorization": "Bearer FAKE-SECRET"
          }
        }
      }
    ]
  }
}

The data source configuration tells OPAL clients ​*what to fetch*​ (url) and ​*where to put it*​ in OPA data document hierarchy (destination path) . Each entry in the configuration is a directive for the OPAL client to fetch data and place it in OPA cache using the Data API . If you want to provide static empty data, your API endpoint (specified in the

url

field) would simply need to return

{}

when called. The entry uses the default

dst_path

of

/

which places data at the root of OPA document hierarchy . For encoding this in an environment variable :

export OPAL_DATA_CONFIG_SOURCES='{"config": {"entries": [{"url": "<https://api.permit.io/v1/policy-config>", "topics": ["policy_data"], "config": {"headers": {"Authorization": "Bearer FAKE-SECRET"}}}]}}'

The key point is that even with "empty" data, OPAL still needs a valid data source configuration - it's just that your endpoint would return minimal or empty JSON data.

Thanks for tagging me @Or Weis. I'll look through relevant sources and get back to you shortly.

To learn more, see the sources I considered: [[1] Data Source Configuration](https://docs.opal.ac/getting-started/running-opal/run-opal-server/data-sources)

You're right that policies typically need context/state data to function properly. Here's how to configure OPAL with minimal or empty data sources: For a minimal data source configuration, you can set up your

OPAL_DATA_CONFIG_SOURCES

like this (1) :

{
  "config": {
    "entries": [
      {
        "url": "<https://api.permit.io/v1/policy-config>",
        "topics": [
          "policy_data"
        ],
        "config": {
          "headers": {
            "Authorization": "Bearer FAKE-SECRET"
          }
        }
      }
    ]
  }
}

Each entry in the

entries

array is a directive that tells the OPAL client to fetch data and place it in OPA cache using the Data API . The configuration specifies: • ​*From where to fetch:*​ The URL endpoint to retrieve data from • ​*How to fetch (optional) :*​ Configuration like HTTP headers for authentication • ​*Where to place the data in OPA cache:*​ Uses the default

/

path at the root of OPA document hierarchy if not specified If you want to provide static empty data, your API endpoint (specified in the

url

field) would need to return

{}

when called. The OPAL client will fetch this empty object and place it in the OPA cache, allowing the client to start successfully even without actual data. For encoding this as an environment variable, you can use Python's

json.dumps()

to get a one-line string :

{
  "config": {
    "entries": [
      {
        "url": "<https://api.permit.io/v1/policy-config>",
        "topics": [
          "policy_data"
        ],
        "config": {
          "headers": {
            "Authorization": "Bearer FAKE-SECRET"
          }
        }
      }
    ]
  }
}

To learn more, see the sources I considered: [[1] Data Source Configuration](https://docs.opal.ac/getting-started/running-opal/run-opal-server/data-sources)

ok i updated the server + client config with the configuration you sent + added the topic to the client, it looks like it connected to topic + to server but i still see its not healthy, adding configuration in next comment

the dataconfigsources + added the env var in client configuration

not sure maybe i need generate and add client token also (although looks like it connected)?

Hey any news maybe ? 🙏

client-deployment.yaml,server-deployment.yaml,values.yaml

got the deployments with those command - kubectl get deployments.apps it-infra-cluster-opal-opal-server -n opal -o yaml

if you have any other preferred way feel free to share and ill send you, thanks 🙌

The

OPAL_DATA_CONFIG_SOURCES

is not configured correctly, notice the

server-deployment.yaml

at lines 57-58 with empty entries for data sources. I'm checking it out and let you know what I find out ✨

🚀 its working thanks !! will update if we'll have another questions thanks !🙏

Hey again 🙂 do you have maybe a guide for migrating from styra or something ? Im trying to understand how I can export the datasources from there and add them to opal server?

@Itamar Shpak We’re currently going through similar migration processes with other clients as well. You’re welcome to schedule a meeting with @Thomas using the following link: here I’ll also continue looking for reading materials that might be helpful for you.