Policy and data administration, distribution, and real-time updates on top of Policy Agents (OPA, Cedar, ...) - opal/packages/opal-client/opal_client/config.py at master · permitio/opal

OPAL's configuration is based on our very own Confi module, which in turn is based on Decouple, and adds complex value parsing with Pydantic, and command line arguments via Typer/Click.

Oct 22, 2025 · The opal-client is deployed alongside a policy-store (e.g: OPA), keeping it up-to-date, by connecting to an opal-server and subscribing to pub/sub updates for policy and policy …

Opal can authenticate users by using an existing LDAP or Active Directory server. This is done by adding the proper configuration section in the shiro.ini file:

Learn how to configure and use the Opal CLI. See the Opal CLI npm page for a list of all available CLI commands. Use opal login to authenticate to the Opal CLI. This creates an authentication …

OPAL-Servers publish policy and data updates over a lightweight (websocket) PubSub Channel, which OPAL-clients subscribe to via topics. Upon updates, each client fetches data directly …

OPAL consists of a server responsible for tracking policy/data from the policy repository and an OPAL client that reflects changes to the OPA instances. Policies are managed through a …

This guide will teach you how to setup the OPAL Server & Client as a series of python packages using the CLI.

Now that OPAL is live, we can use OPAL server to push updates to OPAL clients in real time. We have a separate tutorial on how to trigger updates.

⚠️ Notice: OPAL v0.9.0 ships by default with OPA v1 and include OPAL_V0_COMPAT=true set by default. In OPAL v0.10.0, this flag will be disabled. We recommend following the OPA …