--- WARNING: THIS IS AN AUTO-GENERATED FILE, DO NOT EDIT. PLEASE MODIFY THE ORIGINAL SOURCE IN THE https://github.com/istio/istio REPO source_repo: https://github.com/istio/istio title: OPA description: Adapter that implements an Open Policy Agent engine. location: https://istio.io/docs/reference/config/policy-and-telemetry/adapters/opa.html layout: protoc-gen-docs generator: protoc-gen-docs supported_templates: authorization aliases: - /docs/reference/config/adapters/opa.html number_of_entries: 1 ---
The opa
adapter exposes an Open Policy Agent engine
that provides sophisticated access control mechanisms.
This adapter supports the authorization template.
Configuration format for the opa
adapter.
Example configuration:
policy:
- |+
package mixerauthz
policy = [
{
"rule": {
"verbs": [
"storage.buckets.get"
],
"users": [
"bucket-admins"
]
}
}
]
default allow = false
allow = true {
rule = policy[_].rule
input.subject.user = rule.users[_]
input.action.method = rule.verbs[_]
}
checkMethod: "data.mixerauthz.allow"
failClose: true