New opa exec subcommand

[anderseknert]

When deploying OPA in a CI/CD context to verify configuration or deployment resources, run Terraform policies, etc.. it isn't always ideal to run OPA in server mode. While OPA and the ecosystem provides some great options to run one-off policy checks, like opa eval or Conftest, they don't currently provide some of the management and configuration capabilities that running OPA as a standalone server does. Having CI/CD policy tasks fetch policy bundles from a centralized location, or have OPA report back the decisions it took, are both important features for OPA deployments at scale.

I suggest we introduce an --exec flag to opa run that does the following:

• Runs OPA with any flags (like --config-file) normally available to opa run.
• Operates with any plug-ins configured, like discovery, bundles and decision logging.
• Terminates after policy evaluation (like opa eval) with exit code set depending on outcome.

While this mode of operation is going to be somewhat slower having to startup OPA and potentially pull/push data at each invocation, performance is normally not a big concern in this context.

Could be that some of the improvements for the serverless use case could be used here too, but the two use cases are fundamentally different IMO.

[stale]

This issue has been automatically marked as inactive because it has not had any activity in the last 30 days.