--- title: OPA description: Adapter that implements an Open Policy Agent engine location: https://istio.io/docs/reference/config/policy-and-telemetry/adapters/opa.html layout: protoc-gen-docs generator: protoc-gen-docs aliases: - /docs/reference/config/adapters/opa.htm l number_of_entries: 1 ---
The opa adapter exposes an Open Policy Agent engine
that provides sophisticated access control mechanisms.
This adapter supports the authorization template.
Configuration format for the opa adapter.
Example configuration:
policy:
  - |+
    package mixerauthz
    policy = [
      {
        "rule": {
          "verbs": [
            "storage.buckets.get"
          ],
          "users": [
            "bucket-admins"
          ]
        }
      }
    ]
    default allow = false
    allow = true {
      rule = policy[_].rule
      input.subject.user = rule.users[_]
      input.action.method = rule.verbs[_]
    }
checkMethod: "data.mixerauthz.allow"
failClose: true