diff --git a/README.md b/README.md index a176f0a2c..5f5aca7b3 100644 --- a/README.md +++ b/README.md @@ -101,6 +101,20 @@ IP/port of the Istio Ingress gateway. curl --user bob:password -i http://$GATEWAY_URL/api/v1/products ``` +## How to use the OPA-Istio plugin + +### Option 1: Using `vendored` OPA dependency + +In this option, the shared object file `opa_istio_plugin.so` generated by running `make build-plugin` can only be loaded using the `opa_istio` binary generated by running `make build`. + +Step-by-step instructions to use this option can be found [here](./docs/plugin_vendor.md). + +### Option 2: Using `GOPATH` OPA dependency + +In this option, the shared object file `opa_istio_plugin.so` generated by running `make build-plugin` can be loaded by a OPA binary built from source by cloning the OPA repo. + +Step-by-step instructions to use this option can be found [here](./docs/plugin.md). + ## Configuration To deploy OPA-Istio include the following container in your Kubernetes Deployments: diff --git a/docs/plugin.md b/docs/plugin.md index 5360b516e..f4803b7c8 100644 --- a/docs/plugin.md +++ b/docs/plugin.md @@ -1,4 +1,4 @@ -## Instructions to build the OPA-Istio plugin as a Go plugin: +## Instructions to load the OPA-Istio plugin using `GOPATH` OPA: 1. Clone OPA in your `GOPATH`. diff --git a/docs/plugin_vendor.md b/docs/plugin_vendor.md new file mode 100644 index 000000000..88d6f7b10 --- /dev/null +++ b/docs/plugin_vendor.md @@ -0,0 +1,28 @@ +## Instructions to load the OPA-Istio plugin using `vendored` OPA: + +1. Build the OPA-Istio binary. + + ```bash + make build + ``` + +2. Build the OPA-Istio plugin. + + ```bash + make build-plugin + ``` + +3. Create a configuration file. + + ```yaml + plugins: + envoy.ext_authz.grpc: + addr: :9191 + query: data.istio.authz.allow + ``` + +4. Run OPA-Istio + + ```bash + opa_istio --plugin-dir=. run --server --config-file=config.yaml + ```