Where does OPA stores its new deployed policies ? export of policies

[oranichu]

Hey,
I couldn't find in the guides how to export to a file all the newly deployed policies I've deployed in OPA.
is such a thing even possible?
Does OPA only stores its policies in memory and doesn't write it in some volume? or persistent volume in the case of Kubernetes.

Thanks!

[anderseknert]

OPA can be thought of as an in-memory cache for policy and data kept there only to be able to make policy decisions as close to the calling service as possible. It is not the "source of truth" for policy or data, which is rather commonly distributed centrally via bundles.

There's some work in progress to allow OPA to write it's data to disk, but that is rather to allow for datasets that wouldn't fit in memory, and not for the purpose of exporting policy or data to other systems.

[oranichu]

Ok got it,
I guess I can create a rego file for every policy I create and save it in the volumeMount path to be loaded to OPA for backup

Thanks for the quick reply :)

[anderseknert]

I'd suggest just using git for keeping track of your policy files, then build bundles from that repository for distribution to your OPAs. You can provide a --revision option to opa build which will include that reference as part of the bundle metadata. A common practice is to use the SHA of the git commit which was used to build the bundle.

If your concern is around OPA not being able to reach the remote bundle endpoint when restarting, you can use the persist option in the bundle configuration to have OPA save a copy of the bundle to disk, and use that should the bundle server be unreachable at startup. See https://www.openpolicyagent.org/docs/latest/configuration/#bundles

[jorisscheppers]

@anderseknert I am in a similar situation where I want to be able to manage policies but I'm using Gatekeeper. I have not yet found documentation on how to define the 'source of truth' for my ConstraintTemplates and Constraints and have them apply to the Kubernetes cluster when a change occurs. I thought bundles were the answer but I can't find out how to configure Gatekeeper to pull the bundles.

[anderseknert]

Hi Joris!

I don't have a lot of experience using OPA Gatekeeper, but I know they don't use bundles, but rather embed policies in constraint templates. There's been some early work done to allow sourcing at least data from different sources, but I've not tried it myself. If you'd like to keep policies separate from the templates, I've heard a lot of good things about the konstraint tool.

[maxsmythe]

@jorisscheppers It sounds like you're looking to push policies to a cluster from a given source-of-truth?

For K8s, there is a concept of GitOps, where a source-of-truth repository containing K8s resources (like constraints and templates) are pushed to a cluster. There are a few tools out there that do this. This blog post discusses three of them (there are more out there):

https://blog.container-solutions.com/fluxcd-argocd-jenkins-x-gitops-tools