This message was deleted.

Hey @Jack Geek, thank you for attaching the logs, it’s very helpful !

Hi, for me the OPAL client and server are not in the same POD, the OPAL server has a public IP address like 100.101.102.103. Is there something else that I need to configure ?

And have you configured a Service for the OPAL Server ?

yes a LoadBalaner service, and I can get a status ok response with the public IP

Great, so if your service called

opal-server

and it exists on the namespace -

default

for example, you can configure the Client’s

OPAL_SERVER_URL

variable to the service FQDN, which in this example will be -

opal-server.default.svc

1. and if I have OPAL clients in multiple namepspaces, I must install multiple OPAL servers ? (one per namespace ?) 2. What do you think the cause of host.docker.internal ? Can we deactivate it ?

1. Same, you can use service FQDN to also communicate with services across different namespaces 🙂 2. You can see in the Dockerfile (https://github.com/permitio/opal/blob/master/docker/Dockerfile#L151) that the

OPAL_ALL_DATA_URL

env var is used to control this endpoint call. When running both Client and Server on docker-compose this

host.docker.internal

should work properly. So the question is do you run OPAL Server in your docker-compose as well ?

No it's the same public IP (from the loadbalancer) - I tested it on a docker-compose Client. on K8S, on the OPAL client, should I override OPAL_ALL_DATA_URL ?

No it’s the same public IP (from the loadbalancer) - I tested it on a docker-compose Client.

Sorry, I couldn’t understand for which part of my answer this sentence is referring to. In k8s I recommend you to change this variable to a k8s FQDN url.

Thanks @Raz Co, I will change it to

<serviceName>.<namespaceName>.svc.cluster.local

instead of Public IP and I check if the DOCKER error is gone or not

Hey Jack, Can you try to set ‘OPAL_ALL_DATA_URL’ ? @Asaf Cohen you might have a quick answer for this

Hey @Jack Geek :) The reason you are seeing this issue is because OPAL_DATA_CONFIG_SOURCES is not configured correctly. You need to config a data source entry that is available to the opal client to fetch.

Hi @Asaf Cohen, at this stage, I don't need to fetch data (only policies are needed for the moment). How can we desactivate the mechanism ?

Hi @Jack Geek to run in "policy only mode": 1) set the following env var on OPAL server:

OPAL_DATA_CONFIG_SOURCES={"entries":[]}

2) set the following env var on OPAL client:

OPAL_DATA_UPDATER_ENABLED=false

Hi @Asaf Cohen, in kubernetes env vars, do you have an idea how to pass the object as string :

you want to escape the

"

characters with

\"

@Raz Co correct me if i'm wrong

Yes Asaf, JSON escaping will solve this for you, basically the right value will be -

{\"enteries\":[]}

Thank you @Asaf Cohen and @Raz Co, I just configured it.