OPA Configuration
Configuration reference for the OPA plugin (`opa`): the parameters, each attribute with its type, whether it is required, its default and its accepted values.
Parameters
See plugin common configurations (opens in Apache APISIX docs) for configuration options available to all plugins.
host — string · required · since APISIX 2.12.0
Address of the OPA server.
policy — string · required · since APISIX 2.12.0
Policy to evaluate.
For example, if you would like to evaluate all rules in a package called rbac, configure the policy to be rbac.
If you would like to evaluate specific rule(s) in a package, you can specify the rule name behind the package, such as rbac/allow.
ssl_verify — boolean · optional · default: true · since APISIX 2.12.0
If true, verify the OPA server's SSL certificate.
timeout — integer · optional · default: 3000 · since APISIX 2.12.0
Valid values: between 1 and 60000 inclusive
Timeout for the HTTP call in milliseconds.
keepalive — boolean · optional · default: true · since APISIX 2.12.0
If true, keep the connection alive for multiple requests.
keepalive_timeout — integer · optional · default: 60000 · since APISIX 2.12.0
Valid values: greater than or equal to 1000
Idle time in milliseconds after which the connection is closed.
keepalive_pool — integer · optional · default: 5 · since APISIX 2.12.0
Valid values: greater than or equal to 1
The number of idle connections.
with_route — boolean · optional · default: false · since APISIX 2.12.0
If true, send information of the current route.
with_service — boolean · optional · default: false · since APISIX 2.12.0
If true, send information of the current service.
with_consumer — boolean · optional · default: false · since APISIX 2.12.0
If true, send information of the current consumer.
Note that the consumer information may include sensitive information such as the API key. Only set this option to true if you are sure it is safe to do so.
send_headers_upstream — array[string] · optional · since APISIX 3.5.0
Header names controlled by the OPA response when the request is allowed. The gateway forwards a configured header when OPA returns it and clears any client-supplied value when OPA omits it.