Executing .wasm policies using OPA server

[dushyant7917]

OPA server provides out of the box facility to execute Rego policies. OPA cli provides support to compile Rego policies into .wasm files. Can we use OPA server to execute the .wasm policies? If yes, is there any tutorial documentation for this?

[srenatus]

If you use the default images (non-static), then opa run is able to work with the bundles built using opa build -t wasm -e some/entrypoint .... Those bundles contain a policy.wasm; and there's an SDK in OPA that'll use wasmtime to evaluate them. It should be fairly transparent, but the wasm modules always stay inside bundles. OPA does not accept plain .wasm files.

[dushyant7917]

Why the server is evaluating the .rego policy as well from bundle.tar.gz along with executing .wasm policy? From the metrics I can see that rego evaluation is also taking place! Can we disable rego execution completely and just use wasm execution?

@srenatus ^^ bump

[srenatus]

Sorry I've forgotten about this one, it seems. 😳

You might have to define more entrypoints.

[dushyant7917]

You might have to define more entrypoints.

Didn't understood this point?

[dushyant7917]

@srenatus Bump ^^

[srenatus]

Nevermind. I've tried passing -e foo in addition to -e foo/bar but it doesn't change the outcome.

Can we disable rego execution completely and just use wasm execution?

No you cannot. But don't worry about rego execution -- topdown is the entrypoint that the server is using, and there's no way around that. But as you can see from the trace, it'll immediately jump into the Wasm module:

$ echo '"bar"' | opa eval -I -fpretty -b bundle.tar.gz --explain=full data.foo.bar
query:1     Enter data.foo.bar = _
query:1     | Eval data.foo.bar = _
query:1     | Wasm data.foo
query:1     | Exit data.foo.bar = _
query:1     Redo data.foo.bar = _
query:1     | Redo data.foo.bar = _
"baz"