Opa: Load external data from database in OPA

[priyanka-5]

I am new to REGO. I want to write policies to authorize the user based on its role and resources assigned to him/her. All information of user is stored in database, so I want to write policies which will work on this data. But how do I get or fetch the data from database in OPA.
I read OPA's official documentation for External data but I didn't get any idea about how can I fetch data from my database and execute policies. Is there any way to connect REGO to database or is there any other way so that I can execute policies on data from database.

[ashutosh-narkar]

One of the options mentioned on that page uses Bundles approach. In this scenario, you would create a service that fetches the relevant info from your database and then OPA would query that service to get policy/data.

You could use the same service to push data into OPA instead of the pull approach. That's option 4.

Additionally, there is a new use-case around data filtering that translates Rego polices to SQL and Elasticsearch queries. See https://github.com/open-policy-agent/contrib/tree/master/data_filter_elasticsearch and https://github.com/open-policy-agent/contrib/tree/master/data_filter_example. I would recommend trying the options in the External data page first.

[priyanka-5]

@ashutosh-narkar thank you. I'll try it.
I didn't get what does that "OPA would query that service to get policy/data" means ?

And one more question, how much data OPA's memory can hold ? Because as per Bundling approach, service can fetch relevant info from database and push it into OPA, but what if my data is very huge. So I want to know the OPA's memory size.

[ashutosh-narkar]

OPA would query that service to get policy/data

When your service gets a user api request and needs to make an authz decision it will ask OPA for it. OPA would load policies/data by making a call to a aggregator service (which you would have to create). The aggregator service gets relevant info from the database and makes it available to OPA.

Regarding memory, it depends how you deploy OPA and how much memory you assign to it. If your data is too big to fit in memory, there are approaches like fetching data during policy evaluation (Option 5) or having the aggregator service provide the piece of info that is relevant to make that decision.

[priyanka-5]

Ok. Thank you @ashutosh-narkar I'll try it

[patrick-east]

Going to close this out, it seems like the questions are answered. Feel free to re-open if more questions/issues come up!