OPA gRPC Question

[Ronnie-personal]

Hi There,
My requirement is to do policy evaluation through gRPC call. We would like to execute policy evaluation directly, and return the decision to the caller.

As far as I understand OPA envoy plugin expose OPA as a gRPC server, but the plugin is deployed as a sidecar to an app or microservice, and the consumer actually calls the app or microserivce.

So I don't think OPA envoy plugin is the option for my requirement.

Is my understanding correct? Do you have any other options for my requirement?

Thanks!

[srenatus]

Hello!

Is my understanding correct? Do you have any other options for my requirement?

You are correct, there is no generic gRPC API in OPA. opa-envoy-plugin exposes the gRPC API that Envoy can speak to, referred to as "external authorization", or ext_authz, in the Envoy docs.

You could create your own OPA plugin that exposes the gRPC API that your service expects. Or you could write a shim proxy that exposes gRPC and talks HTTP to OPA.

[Ronnie-personal]

Thank you for the prompt reply!

When you say 'shim proxy', do you have any specific tooling on your mind, or you just use a generic term?

[srenatus]

When you say 'shim proxy', do you have any specific tooling on your mind, or you just use a generic term?

Nothing generic in mind. You'd define your service.proto, generate the golang server code, use OPA as golang library in the server implementation. (Or call out to an OPA instance's HTTP API.)