Unable to configure embedded OPA about opal-helm-chart HOT 6 CLOSED

Hi @oskar-christensson - I believe that the values for authorization and authentication here are mixed-up; meaning you should swap them, so it will be:

      OPAL_INLINE_OPA_CONFIG:                '{"authentication": "token", "authorization": "basic"}'

As per: https://github.com/permitio/opal/blob/5b4729d4a62cf47454e79f48c498ff992aee078f/packages/opal-client/opal_client/opa/options.py#L13

Let me know if that helps :)

We should probably improve the error message here, regardless (CC: @asafc , @roekatz )

from opal-helm-chart.

Thanks, that works.

2023-02-28T11:12:34.475776+0000 | opal_client.opa.runner                  | INFO  | Running OPA inline: opa run --server --addr=:8181 --authentication=token --authorization=basic --log-level=info

from opal-helm-chart.

On that note, @orweis in order to get authorization working in OPA you need to provide something resolving to data.system.authz.allow. Seems like in OPAL you'd want these files in the files cli argument.

However, when running this helm chart - it does not seem possible to mount those files.
I would think that the ConfigMap would be a good place for this and mount the map as a volume in the pod.

How is one supposed to add data.system.authz.allow policy to the client in this helm chart now?

from opal-helm-chart.

Fair point @oskar-christensson ; I don't think we've used this option with the helm-chart specifically so far.
I'll defer to our helm-chart master: @RazcoDev

from opal-helm-chart.

Right! That's fine.
I'll create a PR with this support.

from opal-helm-chart.

There's now a PR here:
#25

from opal-helm-chart.