This message was deleted.
# opals
Slackbot
02/02/2023, 1:25 AMThis message was deleted.
o
Or Weis
02/02/2023, 1:31 AMHI @Aren - welcome- and is sounds like you’re off to a great start - super happy to hear 🤘
To your question:
Usually the OPAL-client and OPA instance run within the same container - so there’s only one sidecar per service.
By default - The OPAL-client runs the OPA process as a subprocess.
You can configure an independent OPA instance (at another container or in the same one) - but you don’t have to.
Or Weis
02/02/2023, 1:32 AMIn the end result of either option - your services query OPA directly for policy decisions.
The OPAL-client just needs to connect to the OPA instance to administer it with policy and data.
I hope this answers the question 🙂
a
Aren
02/02/2023, 1:33 AMSo OPA ships with OPAL-client out of the box?
o
Or Weis
02/02/2023, 1:34 AMOther way around (OPAL-client ships with OPA) - but yes
a
Aren
02/02/2023, 1:34 AMsorry its been a long day haha caffeine is starting to wear off haha. Perfect, so I'd have OPAL-client run as a sidecar alongside by application deployments
Aren
02/02/2023, 1:35 AMand my applications would be querying OPA(technically the opal-client)
o
Or Weis
02/02/2023, 1:35 AMNo worries - I can relate 😉 ☕
Or Weis
02/02/2023, 1:35 AMYes, to both 🙂
❤️ 1
a
Aren
02/02/2023, 1:36 AMTHANK YOU! I was having a hard time understanding how exactly the architecture flowed and how we'd implement here, but you made it make A LOT of sense.
o
Or Weis
02/02/2023, 1:37 AMMy pleasure 😇
a
Aren
02/02/2023, 1:38 AMhelm chart doesn't include a sidecar injector correct?
o
Or Weis
02/02/2023, 1:42 AMYou mean via a webhook trigger? No it doesn’t
a
Aren
02/02/2023, 1:42 AMin terms of injecting my current API deployments with the OPAL-client
Aren
02/02/2023, 1:42 AMtotally understood no worries 😄
Aren
02/02/2023, 1:42 AMthanks again 💪
😊 1
Aren
02/02/2023, 1:57 AMCould you help me understand what the idea is behind how the helm chart installs right out of the box? It installs a client and a server into its own namespace. Is the idea to take the pieces from the helm chart and work them into our own services helm charts to get the client to spin up? Do I need to run the client in the namespace if the client is supposed to run as a sidecar with my application containers? Not sure if this is documented anywhere so I do apologize if I missed it.
Aren
02/02/2023, 1:59 AMand if my application is running the client as a sidecar is a Service still necessary for it? I thought it would query through localhost?
o
Or Weis
02/02/2023, 2:14 AMI think @Raz Co would do a better job than I explaining the details here.
But to give it a quick go: You can control what gets deployed by tweaking the values;
I believe the easiest way to mix this into your services as a sidecar would be forking this helm chart and adding your services (or the other way around).
And yes, when running as a sidecar you can query through localhost- though having a namespace doesn’t hurt
❤️ 1
r
Raz Co
02/02/2023, 8:59 AMHey Aren,
As or said, Opal client will communicate with the OPA instance locally using localhost.
In terms of namespaces and services, these are all k8s resources that implements the ideas of tenants and networking (loadbalancing).
There are many options to deploy OPAL in your cluster, and deploying sidecar is one of them.
As you said, running the opal client as a sidecar can make the service unnecessary.
Raz Co
02/02/2023, 9:02 AMI can suggest you to use the Opal-helm-chart to deploy OPAL Server, and for the client, just edit your existing helm (or any other deployment) of your application and add the client as a sidecar.
In order to deploy only the server you’ll need to delete the
client💪 1
a
Aren
02/02/2023, 5:27 PMYou guys are awesome! Thank you for the support in slack, for the prompt response, and the general guidance. Y'all have been an immense help!
@Raz Co you mentioned there's multiple ways to configure opal. Do people generally go the route of sidecar-ing opal client to their existing deployments? Or do they set up opal server and opal client in its own NS and then query it from there? Just trying to understand what the community agreed upon usage is
o
Or Weis
02/02/2023, 5:59 PMHappy to be of help 💪
Most people do the sidecar model for sure - but I’m not sure most of them use HELM . 🙂
Sorry for stealing the questions from you @Raz Co - 😉 feel free of course to add your input
opal 1
👍 1
r
Raz Co
02/02/2023, 7:09 PMNo worries 😉
I’ll add to Or’s answer that some users of OPAL have big workloads, and attaching an OPAL Client for each pod might be too much and very wasteful in terms of compute and money of course.
The alternative we would suggest in this scenario is deploying a k8s Deployment or Daemonset of OPAL Clients.
Of course it depends on your use case.
Feel free to share your thoughts about this 🙂
👍 1
a
Aren
02/03/2023, 12:52 AMThanks again guys. I've gotten it up and running and I've got the client deployed as a sidecar on my deployments now. Hooked everything but running into issues on the opal-server with git clone path. I'll be digging into that, just wanted to say thanks again.
o
Or Weis
02/03/2023, 6:07 AMSure thing.
Let us know if you need a hand with that issue as well.