Does the --watch flag capture and reload changes to the config-file?

[mobra66]

When running opa agent as a server from CLI with the --config-file and --watch options, I see file watch events in the debug log that changes to the config file generates events.
But it seems that the OPA agent does not actually reload the config-file.
Is that a correct understanding?
(I am using opa agent version 0.50 on linux (Red Hat).

[anderseknert]

Hi @mobra66 👋 I don't think it does, no. If you want dynamically reolading configuration, Discovery is your best option, but it does depend on a remote server providing the configuration.

[mobra66]

Thank you Anders.
But even when using the discovery feature, I think that the opa service must be restarted to load the configuration, if this has changed?
My use case is that if - for some reason - the token used for accessing Styra in the configuration file must be revoked, and a new one used, this cannot be done without a restart of the opa service?

[anderseknert]

Yes, I believe you're right about that. The token needs to be in the bootstrap configuration in order to authenticate with the remote, and I don't think you can change that without a restart.