OPA Configuration

Parameters

See plugin common configurations for configuration options available to all plugins.

• host — string · required

  Address of the OPA server.

• policy — string · required

  Policy to evaluate.

  For example, if you would like to evaluate all rules in a package called rbac, configure the policy to be rbac.

  If you would like to evaluate specific rule(s) in a package, you can specify the rule name behind the package, such as rbac/allow.

• ssl_verify — boolean · optional · default: true

  If true, verify the OPA server's SSL certificate.

• timeout — integer · optional · default: 3000

  Valid values: between 1 and 60000 inclusive

  Timeout for the HTTP call in milliseconds.

• keepalive — boolean · optional · default: true

  If true, keep the connection alive for multiple requests.

• keepalive_timeout — integer · optional · default: 60000

  Valid values: greater than or equal to 1000

  Idle time in milliseconds after which the connection is closed.

• keepalive_pool — integer · optional · default: 5

  Valid values: greater than or equal to 1

  The number of idle connections.

• with_route — boolean · optional · default: false

  If true, send information of the current route.

• with_service — boolean · optional · default: false

  If true, send information of the current service.

• with_consumer — boolean · optional · default: false

  If true, send information of the current consumer.

  Note that the consumer information may include sensitive information such as the API key. Only set this option to true if you are sure it is safe to do so.

• send_headers_upstream — array[string] · optional

  Header names controlled by the OPA response when the request is allowed. The gateway forwards a configured header when OPA returns it and clears any client-supplied value when OPA omits it.