OPA Wasm Compilation - Automatic Entrypoint Detection

[khaledbaghdadii]

I'm working on a project that involves compiling a bunch of Rego policies into Wasm bundles. The thing is, I've got loads of policy files in nested directories and specifying the entrypoint for each one is a real headache.

Any chance there's a feature or trick that lets OPA auto-detect the entrypoints?

[anderseknert]

Hi there! I'm not sure how it would be able to do that 😅 Any rule or package is potentially an entrypoint, and while OPA maybe could guess the "main" entrypoint by... I don't know, count the number of dependencies to other rules or something like that, you're specifically saying that you have a bunch of them.

Could you expand on why you need so many entrypoints? Can't you just have a single one that routes to the rules needed for evaluation? Dynamic policy composition is a nice pattern to work with for that purpose.

[khaledbaghdadii]

Hello, thanks for the reply.
I'll check the article provided in the answer. As of why we need so many endpoints, in our project we have multiple resources and multiple actions that can be executed on each one, and we have a rego file defined for each resource.

[anderseknert]

Having a main policy / entrypoint that "routes" to other policies and rules based on the content in input seems like a good idea then 🙂

[srenatus]

Would using entrypoint: true in metadata not help here? You'd only have to annotate all the rules where they are written, you don't have to maintain a second list for the opa built -t wasm call.

[khaledbaghdadii]

That might be useful actually, I'll check it out. Thanks!