Support multiple configurations within a namespace

[tsjnsn]

Expected Behavior

OPA istio plugin should support multiple policies & configs in a single namespace.

Actual Behavior

For the quickstart at least (policy via configmap), a single "opa-policy" configmap is configured for the whole namespace, and all pods in that namespace use that one for configuring OPA. If using bundles, the URL is stored in the config with no way to configure it per pod.

Ideally, there would be some support for one of these mechanisms:

• Annotation on the pod template to choose the configmap or bundle URL
• CRD for OPA policies/configs which gets applied to pods matching a label selector

[tsandall]

Documenting how to deploy multiple OPAs inside the same namespace with different configs and/or policies would be useful. Documenting how to automate that kind of deployment would also be good.

It's not immediately clear where these docs should live on openpolicyagent.org. We have some re-organization happening that might help with this open-policy-agent/opa#1687

[viditganpi]

Is there any update on how to do this?

[ashutosh-narkar]

Are you using the plugin with Istio ? I haven't tried this out but we could configure OPA to use a Discovery bundle and then inside that use an environment variable that particular instance of OPA was started with to select the appropriate bundle. To pass an environment variable in the OPA configmap is something I'm not yet sure how to easily achieve in the existing manifest.

[viditganpi]

My use case is having a different policy set on the OPA sidecar for different application pods, not sure if that is a possiblity

[ashutosh-narkar]

You can do that using OPA's Discovery feature. We'll have to pass an environment variable in the manifest and have OPA use that to decide the policy bundle to use for a particular OPA instance. How to do the former is something that will need to be tried out.

[stale]

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days.

[stale]

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days.

[prashantthorat001]

did anyone tried above mentioned approach? Please share reference document link if any

[stale]

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days.