Procedure for bundling OPA policy bundles as OCI images

[jabbrwcky]

Hi,

what is the currently recommended approach for bundling policies as OPA images?

When I tried to follow the steps outlined in the documentation using opa 1.6.0, I noteced several things:

1. the CLI invocation given for oras does not work with the current oras version as some CLI flags have changed
2. Providing an empty config produces an OCI container that is refused by OPA - apparently there are two annotations necessary on both? the manifest as well as on thje bundle.tar.gz layer: "org.openpolicyregistry.type": "policy", "rego.version": "rego.V1"

So the current docs seem somewhat outdated.

The policy tool by https://openpolicycontainers.com/ produces working images out of the box but has not seen updates for some months now (opa code used there is still at 1.0.0). So I do not know how actively it is worked on.

Are the assumptions about the annotations correct and what is the currently recommended way to build OCI images?

I think I figured out most of the process for oras, so I would be willing to update the documentation, if this is the way to go.

Can anybody provide more insight?

Cheers,
Jens

[srenatus]

I think I figured out most of the process for oras, so I would be willing to update the documentation, if this is the way to go.

Yeah having docs for how to do it with oras alone would be preferable. I'm afraid I don't know the answer to your annotation question without diving into the code.

So I do not know how actively it is worked on.

The OCI functionality was contributed by Aserto, which is not operating anymore. So, it's up to the community around that to revive it, and keep it alive. I'm afraid OCI bundles haven't really caught on outside of Aserto's tooling.

[jabbrwcky]

What a pity, but this explains the lack of updates.

The OCI approach is useful in my situation because we have multiple teams working on policies deployed to one OPA.
OCI will/would make it a lot easier to have all of them deploy independently and OCI repositories solve the storing and versioning quite nicely.

I'll dig in a little deeper. While my current setup works , i.e. produces images that are loaded by OPA, it still has some rough edges.

Once I am happy with my process I will write up some docs and add an PR for to update the docs to build OCI images.