OCI Image for Policy Bundle

[Ronnie-personal]

OPA can now consume policy bundles packaged as OCI images. Has this approach been commonly adopted by any users in the production environment?

I'm just wondering if this approach will become the standard way for OPA users.
What are the benefits of using OCI images for OPA bundles?

[orweis]

Personally I don't see the appeal.
Policies from my experience are dynamic living things - that's why we opted for the OPAL approach , which allows using Git as the source of truth for policies (even directly) ; with commit hashes being your auditable policy identity.

[anderseknert]

@Ronnie-personal including git revision in a bundle is simple:

opa build --bundle --revision $(git rev-parse HEAD) .

This revision will be stored in the .metadata file inside the bundle, and will be included in all decision logs emitted by OPA.

[Ronnie-personal]

What are the advantages to create bundle? Can we deploy each individual policy file?

Could you please provide document links regarding OPA bundle versions and metadata? Are they the same thing or not?
Can I use either CLI or API to retrieve the bundle version and the revision metadata?

Thank you so much!

[anderseknert]

The docs on bundles should hopefully answer that. Let me know if there's something you feel is missing in those, and we'll have them updated :)

[Ronnie-personal]

Thank you @anderseknert for sharing the document. I have reviewed the document.

I would like to understand if the bundle has a 'version' attribute besides 'revision'. Is ETAG the version of the bundle file? What value does ETAG carry?

[anderseknert]

You can use the metadata atribute if you want to provide a custom versioning scheme:

metadata - An optional key that contains arbitrary metadata to accompany the bundle. This metadata is available for querying using data.system, along with the rest of the manifest.

The Etag is created by the bundle server, so you'll need to check your bundle server documentation for how they calculate that, but most commonly it'll be a SHA-sum of the file, I believe.

[anderseknert]

Hi again @Ronnie-personal 👋

I don’t believe there will be a single standard approach for distributing policy and data to OPA. If you’re using OCI registries for other things already, that may be a benefit of the distribution format for you. It’s not going to replace any other distribution mechanism though.