Skip to content

Latest commit

 

History

History
35 lines (28 loc) · 2.62 KB

README.md

File metadata and controls

35 lines (28 loc) · 2.62 KB
Raw

OPA Kong Plugin

Created to work with Kong v0.13.x

Custom Kong plugin to allow for fine grained Authorization through Open Policy Agent.

Plugin will continue the request to the upstream target if OPA responds with true, else the plugin will return a 401 Not Authorized.

Requests will add the header X-Kong-Authz-Latency to requests which have been impacted by the plugin.

Setup

Config

Parameter Usage Type
timeout timeout in ms for request to OPA number
keepalive keepalive in ms for request to OPA number
opa_host target OPA base address (e.g. https://authz.example.com) string
policy_uri target OPA policy (e.g. /v1/data/my_policy) string
port target OPA port number
forward_request_method flag to forward request method boolean
forward_request_uri flag to forward request uri boolean
forward_request_headers flag to forward request headers boolean
forward_request_body flag to forward request body boolean
forward_upstream_split_path flag to forward split upstream path (e.g. /path/to/my/endpoint becomes ["path", "to", "my", "endpoint"]) boolean
debug flag to return response from OPA - not the upstream target (used for testing purposes) boolean

Example

$ curl -i -X POST \
  --url http://localhost:9001/services/my-service/plugins/ \
  --data 'name=opa' \
  --data 'config.opa_host=http://localhost:7001' \
  --data 'config.policy_uri=v1/data/my_package/my_policy'