Yes, you can configure OPAL to run Cedar agent instead of OPA in Helm Chart values. The OPAL Configuration Guide shows that Cedar is supported through the

OPAL_INLINE_CEDAR_ENABLED

environment variable (1) . To configure Cedar in your Helm values, you'll need to set the appropriate environment variables in

client.extraEnv

(2) . The configuration includes: • `OPAL_INLINE_CEDAR_ENABLED`: Set to

True

to enable Cedar agent (1) • `OPAL_POLICY_STORE_TYPE`: Would need to be configured for Cedar (though the exact value isn't specified in the available documentation) • `OPAL_INLINE_CEDAR_CONFIG`: Provide options for running the Cedar agent as a JSON object The Cedar agent runs alongside OPAL in the same container when inline Cedar is enabled . OPAL supports both OPA and Cedar as policy engines, with Cedar being added in OPAL v0.7.0 . For more details on Cedar integration with OPAL, check out the Cedar and OPAL tutorial mentioned in the configuration guide .

To learn more, see the sources I considered: [[1] OPAL Configuration Guide | OPAL](https://docs.opal.ac/getting-started/configuration) [[2] OPAL Helm Chart for Kubernetes](https://docs.opal.ac/tutorials/helm-chart-for-kubernetes)

Yes, you're absolutely right! The

client.extraEnv

is indeed the correct place to configure Cedar in the OPAL Helm chart. (1) According to the OPAL Helm chart documentation,

client.extraEnv

is used for "Extra configuration for opal-client". This is where you would add the Cedar-specific environment variables. The configuration guide shows that OPAL supports Cedar through the

OPAL_POLICY_STORE_TYPE

environment variable, which defaults to

opa

but can also be set for Cedar. (2) The guide also mentions there's a Cedar tutorial available at

/tutorials/cedar

for more detailed configuration. The Helm chart specifically notes that if you leave

server.dataConfigSources

with no entries, it will automatically set

OPAL_DATA_UPDATER_ENABLED: False

in

client.extraEnv

, demonstrating how the extraEnv section works for client configuration. (1)

To learn more, see the sources I considered: [[1] OPAL Helm Chart for Kubernetes](https://docs.opal.ac/tutorials/helm-chart-for-kubernetes) [[2] OPAL Configuration Guide | OPAL](https://docs.opal.ac/getting-started/configuration)