Opa: How to reference external policies from gitlab ci

[nyalavarthi]

Expected Behavior

I am working on automating the opa policy validations ( gitlab cicd) on a terrraform git repository and the way i got it working is by adding .rego file in the root of terraform repo and referencing it as below( this line of code is from .gitlab-ci.yml file)

• opa eval --format pretty --data s3-validate.rego --input tfplan.json "data.terraform.analysis.authz"

Actual Behavior

what I actually wanted is to be able to create a separate git repo for all the reusable policies and refer the git link from opa command
ex:
opa eval --format pretty --data git::ssh://[email protected]/opa-policies.git/s3-validate.rego --input tfplan.json "data.terraform.analysis.authz"

is this possible and what are my options ?

thank you

[tsandall]

The opa eval and other command-line invocations of OPA do not (currently) support loading of policies and data from remote sources (when you run OPA as a server it can be configured to periodically download "bundles" via HTTPS but that's not available for opa eval and friends.)

In the short term, adding support for fetching via http would be relatively straightforward but support for other protocols (like Git over SSH) would require a bit more work. This is an interesting idea though and we have talked about it before.

If you want to store the policies in another repo, the simplest option would be to have some wrapper script clone that repo for you. cc @patrick-east in case he has other ideas on this.

[patrick-east]

+1 for just using a wrapper script to unblock this for now.

[nyalavarthi]

cloning is a good idea , it worked like a charm, cloned external repo into container and referred the local path in opa eval command.

clone repo

• git clone https://gitlab-ci-token:${CI_JOB_TOKEN}@code.xxx.com/path-xxxx/opa-policies.git

refer the cloned projcet

-opa eval --format pretty --data opa-policies/s3-validate-ext.rego --input tfplan.json "data.terraform.analysis.authz" > output/result.txt