First steps

After you went through the Installation, on this page you will deploy OPA, deploy your first rule and query it from the command line.

Deploy OPA

To deploy OPA, you just need to create an OpaCluster resource in Kubernetes and the Operator will create the OPA instances. Create a file called opa.yaml with the following contents:

---
apiVersion: opa.stackable.tech/v1alpha1
kind: OpaCluster
metadata:
  name: simple-opa
spec:
  image:
    productVersion: "0.57.0"
  servers:
    roleGroups:
      default: {}
yaml

and apply it:

kubectl apply -f opa.yaml
bash

This will create an OPA cluster. The Operator deploys a DaemonSet, so every node in your cluster will have an OPA instance.

Deploy a policy rule

Now deploy the first policy rule to OPA. Rules are deployed in ConfigMaps. Create a file simple-rule.yaml with the following contents:

---
apiVersion: v1
kind: ConfigMap
metadata:
  name: test
  labels:
    opa.stackable.tech/bundle: "true"
data:
  test.rego: |
    package test

    hello {
      true
    }

    world {
      false
    }
yaml

and apply it:

kubectl apply -f simple-rule.yaml
bash

The Operator will read the rule file, bundle it and publish the bundle to all OPA instances.

Make policy requests

Now that you have deployed the rule, you can query OPA for it. First, port-forward the service so you can query it from outside the Kubernetes cluster:

kubectl port-forward svc/simple-opa 8081 > /dev/null 2>&1 &
bash

Then, request the hello rule:

curl -s http://localhost:8081/v1/data/test/hello
bash

As it was defined in the rule file, the response should be true:

{"result":true}
json

You can also request the other rule, world:

curl -s http://localhost:8081/v1/data/test/world
bash

And see a different response:

{}
json

Great! You’ve set up OPA, deployed a rule and queried it!

What’s next

Have a look at the Usage guide page for more configuration options of the Operator.