How to setup polling of an external OPA instance on opa-client-standalone

[maclermo]

Hi,

I am currently deploying opal-server, opal-client-standalone and opa-envoy-authz (https://github.com/open-policy-agent/opa-envoy-plugin).

The opal-client-standalone instance is using OPAL_POLICY_STORE_URL to send the policies to the opa-envoy-authz instance.

The problem is that if the instance opa-envoy-authz reboots, the rules are gone. Is there a way for opal-client-standalone to periodically poll opa-envoy-authz so that it always has the latest rules?

[orweis]

I'm afarid OPAL doesn't have such a feature at the moment.

What I can suggest is managing this externally and restarting both containers on the restart of OPA.

[maclermo]

I guess replacing the opa binary for the ova-envoy-plugin binary in the opal-client docker image could do the trick.

[orweis]

Yep that should work too.