<p>I am trying to setup my OPA as below.</p>

<ol>
<li>OPA installed as a sidecar in Kubernetes</li>
<li>Policy will be managed as bundle</li>
<li>OPA policy will be stored and served from a separate service [ Bundle ]</li>
<li>OPA need to be configured using config-file to get the policy from external service</li>
<li>config-file will be stored as a config map in kubernetes.</li>
<li>That config map need to be used in --config-file</li>
</ol>

<p>My config map in kubernetes</p>

<pre><code>kubectl create configmap policyconfig --from-file=./config/config.yaml
</code></pre>

<p>My Sidecar OPA</p>

<pre><code> - name: opa
          image: openpolicyagent/opa:latest
          args:
            - "run"
            - "--server"
            - "--addr=0.0.0.0:443"
            - "--addr=0.0.0.0:8181"
            - "--config-file=policyconfig"
      volumes:
        - name: policyconfig
          configMap:
            name: policyconfig

</code></pre>

<p>Let me know if it is possible to implement in this way</p>

ajoy sinha
<p>You can use <a href="https://github.com/open-policy-agent/kube-mgmt" rel="nofollow noreferrer">kube-mgmt</a> as sidecar for managing OPA on top of Kubernetes.</p>

<p>kube-mgmt automatically discovers policies stored in ConfigMaps in Kubernetes and loads them into OPA. kube-mgmt assumes a ConfigMap contains policies if the ConfigMap is:</p>

<ol>
<li>Created in a namespace listed in the --policies option. If you specify --policies=* then kube-mgmt will look for policies in ALL namespaces.</li>
<li>Labelled with openpolicyagent.org/policy=rego</li>
</ol>

<p><a href="https://i.stack.imgur.com/2fAak.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/2fAak.png" alt="opa"></a></p>

<p><a href="https://medium.com/capital-one-tech/policy-enabled-kubernetes-with-open-policy-agent-3b612b3f0203" rel="nofollow noreferrer">https://medium.com/capital-one-tech/policy-enabled-kubernetes-with-open-policy-agent-3b612b3f0203</a></p>

<p>Update: </p>

<p>With your current setup and requirement you need to add a <code>volumeMounts</code> to make it work</p>

<pre><code> - name: opa
          image: openpolicyagent/opa:latest
          args:
            - "run"
            - "--server"
            - "--addr=0.0.0.0:443"
            - "--addr=0.0.0.0:8181"
            - "--config-file=policyconfig"
          volumeMounts:
          - name: policyconfig
            mountPath: /config
      volumes:
        - name: policyconfig
          configMap:
            name: policyconfig
</code></pre>
