OPAL SERVER HANDLING GIT SUBMODULES

[SoufianLabed]

Hello,

Is it possible to pull a git repo with multiple submodules for opal server ?

I have tested but with something like this :
- /policies/policy1 # SUBMODULE #
- /policies/policy2 # static folder #

the opal server pull correctly the policy1 but the policy2 is just an empty folder.

Thanks for you help,

Soufian

[SoufianLabed]

My context : I have multiple git repo with policies + data,

I want those polices running on the same OPA,

what's the best solution for this need ?

Best regards,

Soufian

[danyi1212]

Hey @SoufianLabed, thank you for sharing that 🌟

Although I haven't tried that, my guess is that OPAL would not support Git Submodules, as it is necessary to explicitly ask it when git cloneing the repo.
As referenced here

• https://git-scm.com/docs/git-clone#Documentation/git-clone.txt-code--recurse-submodulesltpathspecgtcode
• https://git-scm.com/book/en/v2/Git-Tools-Submodules#:~:text=default%20you%20get%20the%20directories%20that%20contain%20submodules

To support that, there would need to be specific configuration for the Policy Store to also clone the submodules. We would much appreciate it if you contributed that feature and will gladly guide you in planning and developing it. 🙏

Keep in mind, when one of the submodules changes, it does not automatically update the relating repo. A commit must be made on the repo to change the submodule commit it references.

As an alternative, you can consider using OPAL Scopes, each with the appropriate Policy Repo. This is a classic setup for larger deployments, allowing each service to have its dedicated OPAL Client, with its OPA and Policy Repo, managed independently by the relevant team. This setup is embracing the distributed nature of OPAL 💎

Let me know what you think and feel free to follow-up with more questions 🙂

[danyi1212]

Hey @SoufianLabed, thank you for sharing that 🌟

Although I haven't tried that, my guess is that OPAL would not support Git Submodules, as it is necessary to explicitly ask it when git cloneing the repo.
As referenced here

• https://git-scm.com/docs/git-clone#Documentation/git-clone.txt-code--recurse-submodulesltpathspecgtcode
• https://git-scm.com/book/en/v2/Git-Tools-Submodules#:~:text=default%20you%20get%20the%20directories%20that%20contain%20submodules

To support that, there would need to be specific configuration for the Policy Store to also clone the submodules. We would much appreciate it if you contributed that feature and will gladly guide you in planning and developing it. 🙏

Keep in mind, when one of the submodules changes, it does not automatically update the relating repo. A commit must be made on the repo to change the submodule commit it references.

As an alternative, you can consider using OPAL Scopes, each with the appropriate Policy Repo. This is a classic setup for larger deployments, allowing each service to have its dedicated OPAL Client, with its OPA and Policy Repo, managed independently by the relevant team. This setup is embracing the distributed nature of OPAL 💎

Let me know what you think and feel free to follow-up with more questions 🙂