Opa: Load external data in OPA using push data approach

[PriyaKatkade]

I want to load external data to OPA using push data approach. I have read documentation on your official site but I don't see any practical example there. Everywhere therotical documentation is there. From this documentation I came to know that I need to build replicator which will pull data from external data source and push it to OPA. But I didn't get any detail information on replicator. Like in Bundle approach we need to give config file with services and bundle, is there any configuration needed for replicator? It will be good if you provide any demo example for this.

Will you please send me link if you have any demo/example for this? It will really helpful for me as I stuck here and I am not getting how to implement that.

Thank you.

[ashutosh-narkar]

The replicator is a custom service that you will have to build that fetches data from an external source and pushes it into OPA via it's REST API. Imagine you have data sitting in some DB like Mongo, your replicator service will pull data from Mongo, perform any modifications on it (if needed) and push data into OPA. If you wrote your service in Go, you would use Mongo's Go-driver to fetch data from Mongo and then make a http call to OPA.

Take a look at kube-mgmt for reference. It replicates Kube resources into OPA.

[PriyaKatkade]

Okay. Thank you @ashutosh-narkar. I'll try it

[PriyaKatkade]

While building replicator service, one question came up. I am running OPA as a sidecar service. I have multiple micro-services for each OPA is available as sidecar service. All OPA servers need same or different data to execute policy. So my question is whether there will be single replicator service available which will push data on all OPA servers or do we need to build multiple replicator services?

[ashutosh-narkar]

Is there any specific reason that you prefer the push approach ?

The existing support for Bundles in conjunction with Discovery would be perfect for your use-case.

Regarding your question, one approach would be to run the replicator service as a sidecar in your app pod. In that way the service can push data/policy to OPA over localhost.