In order to give you better service we use cookies. By continuing to use our website, you agree to the use of cookies as described in our Cookie Policy

Kong Logo
search
Docs
Kong Konnect Platform Konnect Platform Konnect SaaS Kong Gateway (Enterprise) Kong Mesh Plugin Hub
Open Source Kong Gateway (OSS) decK Kubernetes Ingress Controller Insomnia Kuma
Support Community Kong U Demos & Labs
Get Started
Plugin Hub
header icon

OPA

Kong Konnect only: This plugin is only available with a Kong Konnect subscription. Please inquire about Kong Konnect by contacting us.
BETA

WARNING: This plugin is released as BETA and should not be deployed in a production environment.

Forward request to Open Policy Agent and process the request only if the authorization policy allows for it.

Note: The OPA plugin is compatible with the Kong Gateway (Enterprise) beta version 2.4.x.

Configuration Reference

This plugin is compatible with requests with the following protocols:

  • http
  • https

This plugin is compatible with DB-less mode.

In DB-less mode, Kong Gateway does not have an Admin API. If using this mode, configure the plugin using declarative configuration.

Enabling the plugin on a service

Admin API
Kubernetes
Declarative (YAML)
Konnect SaaS
Manager

For example, configure this plugin on a service by making the following request:

1
2
3
4
5

$ curl -X POST http://<admin-hostname>:8001/services/<service>/plugins \
    --data "name=opa"  \
    --data "config.opa_host=localhost" \
    --data "config.opa_port=8181" \
    --data "config.opa_path=</v1/data/example/kong/allow>"

<service> is the id or name of the service that this plugin configuration will target.

First, create a KongPlugin resource:

1
2
3
4
5
6
7
8
9

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: <opa-example>
config: 
  opa_host: localhost
  opa_port: 8181
  opa_path: </v1/data/example/kong/allow>
plugin: opa

Next, apply the KongPlugin resource to a Service by annotating the Service as follows:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

apiVersion: v1
kind: Service
metadata:
  name: <service>
  labels:
    app: <service>
  annotations:
    konghq.com/plugins: <opa-example>
spec:
  ports:
  - port: 80
    targetPort: 80
    protocol: TCP
    name: <service>
  selector:
    app: <service>

<service> is the id or name of the service that this plugin configuration will target.

Note: The KongPlugin resource only needs to be defined once and can be applied to any service, consumer, or route in the namespace. If you want the plugin to be available cluster-wide, create the resource as a KongClusterPlugin instead of KongPlugin.

For example, configure this plugin on a service by adding this section to your declarative configuration file:

1
2
3
4
5
6
7

plugins:
- name: opa
  service: <service>
  config: 
    opa_host: localhost
    opa_port: 8181
    opa_path: </v1/data/example/kong/allow>

<service> is the id or name of the service that this plugin configuration will target.

Configure this plugin on a service:

  1. In Konnect SaaS, select the service on the ServiceHub page.
  2. Scroll down to Versions and select the version.
  3. Scroll down to Plugins and click New Plugin.
  4. Find and select the OPA plugin.

  5. Enter the following parameters, updating the default or sample values as needed:

    • Config.Opa Path: </v1/data/example/kong/allow>
  6. Click Create.

Configure this plugin on a service:

  1. In Kong Manager, select the workspace.
  2. From the Dashboard, scroll down to Services and click View for the service row.
  3. Scroll down to plugins and click Add Plugin.

  4. Find and select the OPA plugin.

    Note: If the plugin is greyed out, then it is not available for your product tier. See Kong Gateway tiers.
  5. If the option is available, select Scoped.
  6. Add the service name and ID to the Service field if it is not already prefilled.

  7. Enter the following parameters, updating the default or sample values as needed:

    • Config.Opa Path: </v1/data/example/kong/allow>
  8. Click Create.

Enabling the plugin on a route

Admin API
Kubernetes
Declarative (YAML)
Konnect SaaS
Manager

For example, configure this plugin on a route with:

1
2
3
4
5

$ curl -X POST http://<admin-hostname>:8001/routes/<route>/plugins \
    --data "name=opa"  \
    --data "config.opa_host=localhost" \
    --data "config.opa_port=8181" \
    --data "config.opa_path=</v1/data/example/kong/allow>"

<route> is the id or name of the route that this plugin configuration will target.

First, create a KongPlugin resource:

1
2
3
4
5
6
7
8
9

apiVersion: configuration.konghq.com/v1
kind: KongPlugin
metadata:
  name: <opa-example>
config: 
  opa_host: localhost
  opa_port: 8181
  opa_path: </v1/data/example/kong/allow>
plugin: opa

Then, apply it to an ingress (Route or Routes) by annotating the ingress as follows:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

apiVersion: networking/v1beta1
kind: Ingress
metadata:
  name: <route>
  annotations:
    kubernetes.io/ingress.class: kong
    konghq.com/plugins: <opa-example>
spec:
  rules:
  - host: examplehostname.com
    http:
      paths:
      - path: /bar
        backend:
          serviceName: echo
          servicePort: 80

<route> is the id or name of the route that this plugin configuration will target.

Note: The KongPlugin resource only needs to be defined once and can be applied to any service, consumer, or route in the namespace. If you want the plugin to be available cluster-wide, create the resource as a KongClusterPlugin instead of KongPlugin.

For example, configure this plugin on a route by adding this section to your declarative configuration file:

1
2
3
4
5
6
7

plugins:
- name: opa
  route: <route>
  config: 
    opa_host: localhost
    opa_port: 8181
    opa_path: </v1/data/example/kong/allow>

<route> is the id or name of the route that this plugin configuration will target.

Configure this plugin on a route:

  1. In Konnect SaaS, select the service from the ServiceHub page.
  2. Scroll down to Versions and select the version.
  3. Select the route.
  4. Scroll down to Plugins and click Add Plugin.
  5. Find and select the OPA plugin.

  6. Enter the following parameters, updating the default or sample values as needed:

    • Config.Opa Path: </v1/data/example/kong/allow>
  7. Click Create.

Configure this plugin on a route:

  1. In Kong Manager, select the workspace.
  2. From the Dashboard, select Routes in the left navigation.
  3. Click View for the route row.
  4. Scroll down to plugins and click Add Plugin.

  5. Find and select the OPA plugin.

    Note: If the plugin is greyed out, then it is not available for your product tier. See Kong Gateway tiers.
  6. If the option is available, select Scoped.
  7. Add the Route ID if it is not already prefilled.

  8. Enter the following parameters, updating the default or sample values as needed:

    • Config.Opa Path: </v1/data/example/kong/allow>
  9. Click Create.

Enabling the plugin globally

A plugin which is not associated to any service, route, or consumer is considered global, and will be run on every request. Read the Plugin Reference and the Plugin Precedence sections for more information.

Admin API
Kubernetes
Declarative (YAML)
Kong Manager

For example, configure this plugin globally with:

1
2
3
4
5

$ curl -X POST http://<admin-hostname>:8001/plugins/ \
    --data "name=opa"  \
    --data "config.opa_host=localhost" \
    --data "config.opa_port=8181" \
    --data "config.opa_path=</v1/data/example/kong/allow>"

Create a KongClusterPlugin resource and label it as global:

1
2
3
4
5
6
7
8
9
10
11
12
13

apiVersion: configuration.konghq.com/v1
kind: KongClusterPlugin
metadata:
  name: <global-opa>
  annotations:
    kubernetes.io/ingress.class: kong
  labels:
    global: \"true\"
config: 
  opa_host: localhost
  opa_port: 8181
  opa_path: </v1/data/example/kong/allow>
plugin: opa

For example, configure this plugin using the plugins: entry in the declarative configuration file:

1
2
3
4
5
6

plugins:
- name: opa
  config: 
    opa_host: localhost
    opa_port: 8181
    opa_path: </v1/data/example/kong/allow>

Configure this plugin globally:

  1. In Kong Manager, select the workspace.
  2. From the Dashboard, select Plugins in the left navigation.
  3. Click New Plugin.

  4. Find and select the OPA plugin.

    Note: If the plugin is greyed out, then it is not available for your product tier. See Kong Gateway tiers.
  5. If the option is available, set the plugin scope to Global.

  6. Enter the following parameters, updating the default/sample values as needed:

    • Config.Opa Path: </v1/data/example/kong/allow>
  7. Click Create.

Parameters

Here's a list of all the parameters which can be used in this plugin's configuration:

Form ParameterDescription
name

Type: string		 The name of the plugin to use, in this case opa.
service.id

Type: string		 The ID of the Service the plugin targets.
route.id

Type: string		 The ID of the Route the plugin targets.
enabled

Type: boolean

Default value: true		 Whether this plugin will be applied.
config.opa_protocol
optional

Type: string

Default value: http

The protocol to use when talking to Open Policy Agent (OPA) server. Allowed protocols are http and https.
config.opa_host
optional

Type: string

Default value: localhost

The DNS name or IP address of the OPA server.
config.opa_port
optional

Type: integer

Default value: 8181

The port of the OPA server.
config.opa_path
required

Type: string

The HTTP path to use when making a request to the OPA server. This is usually the path to the policy and rule to evaluate, prefixed with /v1/data/. For example, if you want to evaluate the allow rule inside example.kong package, then the path would be /v1/data/example/kong/allow.
config.include_service_in_opa_input
optional

Type: boolean

Default value: false

If set to true, the Kong Gateway Service object in use for the current request is included as input to OPA.
config.include_route_in_opa_input
optional

Type: boolean

Default value: false

If set to true, the Kong Gateway Route object in use for the current request is included as input to OPA.
config.include_consumer_in_opa_input
optional

Type: boolean

Default value: false

If set to true, the Kong Gateway Consumer object in use for the current request (if any) is included as input to OPA.

Usage

Set up an OPA server

If you are not already running an OPA server, start one by following instructions on openpolicyagent.org.

Set up a dummy policy

Create an example.rego file with the following content:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32

package example

default allow = false

allowBoolean {
  header_present
}

header_present {
  input.request.http.headers["my-secret-header"] == "open-sesame"
}

allowDetailed = response {
  header_present
  response := {
    "allow": true,
    "headers": {
      "header-from-opa": "accepted",
    },
  }
}

allowDetailed = response {
  not header_present
  response := {
    "allow": false,
    "status": 418,
    "headers": {
      "header-from-opa": "rejected",
    },
  }
}

This policy allows the request to pass through if it contains the HTTP header my-secret-header with value open-sesame.

Next, configure the policy with OPA:

1

curl -XPUT localhost:8181/v1/policies/example --data-binary @example.rego

The above command uses OPA’s default port 8181. It could be different for your setup.

Set up Kong Gateway

Set up a Route and Service in Kong Gateway and then enable the plugin:

1
2
3
4

curl -X POST http://<admin-hostname>:8001/routes/<route>/plugins \
    --data "name=opa"  \
    --data "config.opa_path=/v1/data/example/allow" \
    --data "config.opa_host=<host-where-opa is running>"

Make a request

Now, make a request to Kong Gateway:

1

curl http://kong:8000/{proxy_path}

You will get a 403 response from the gateway because OPA has rejected the request.

Next, make the same request providing the necessary header:

1
2

curl http://kong:8000/{proxy_path} \
  -H 'my-secret-header: open-sesame'

This time you will get the response from your upstream service, as this request is allowed by OPA.

Next, update the plugin configuration to use /v1/data/example/allowDetailed as opa_path and observe how the policy affects the response and proxied request.

OPA input structure

The input to OPA has the following JSON structure:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65

{
  "input": {
    "request": { # details about the request from client to Kong
      "http": {
        "host": "example.org", # host header used by the client to make the request
        "port": "8000",        # port to which the request was made
        "tls": {},             # TLS details if the request was made on HTTPS and Kong terminated the TLS connection
        "method": "GET",       # HTTP method used in the request
        "scheme": "http",      # protocol used to make the request by the client, this can be either `http` or `https`
        "querystring": {       # Query string in the HTTP request as key-value pairs
          "foo" : "bar",
          "foo2" : "bar2",
        },
        "headers": {           # HTTP headers of the request
          "accept-encoding": "gzip, deflate",
          "connection": "keep-alive",
          "accept": "*\\/*"
        }
      }
    },
    "client_ip": "127.0.0.1",# client IP address as interpreted by Kong
    "service": {             # The Kong service resource to which this request will be forwarded to if OPA allows. Injected only if `include_service_in_opa_input` is set to `true`.
      "host": "httpbin.org",
      "created_at": 1612819937,
      "connect_timeout": 60000,
      "id": "e6fd8b19-89e5-44e6-8a2a-79e8bf3c31a5",
      "protocol": "http",
      "name": "foo",
      "read_timeout": 60000,
      "port": 80,
      "updated_at": 1612819937,
      "ws_id": "d6020dc4-67f5-4c62-8b45-e2f497c20f5c",
      "retries": 5,
      "write_timeout": 60000
    },
    "route": {               # The Kong route that was matched for this request. Injected only if `include_route_in_opa_input` is set to `true`.
      "id": "bc6d8617-76a7-441f-aa40-32eb1f5be9e6",
      "paths": [
        "\\/"
      ],
      "protocols": [
        "http",
        "https"
      ],
      "strip_path": true,
      "created_at": 1612819949,
      "ws_id": "d6020dc4-67f5-4c62-8b45-e2f497c20f5c",
      "request_buffering": true,
      "updated_at": 1612819949,
      "preserve_host": false,
      "regex_priority": 0,
      "response_buffering": true,
      "https_redirect_status_code": 426,
      "path_handling": "v0",
      "service": {
        "id": "e6fd8b19-89e5-44e6-8a2a-79e8bf3c31a5"
      }
    },
    "consumer": {            # Kong consumer that was used for authentication for this request. Injected only if `include_consumer_in_opa_input` is set to `true`.
      "id": "bc6d8617-76a7-431f-aa40-32eb1f5be7e6",
      "username": "kong-consumer-username"
    }
  }
}

Note that it is possible that Consumer and Service resources are not present for any given request in Kong Gateway.

Expected response from OPA

After OPA is done executing policies, the plugin expects the policy evaluation result in one of the defined formats: boolean or object. Any other format or a status code other than 200 OK results in the plugin returning a 500 Internal Server Error to the client.

Boolean result

OPA can return a true or false result after a policy evaluation. This should suffice for most use cases.

Examples:

To allow the request to be processed further, OPA should send the following response:

1
2
3

{
  "result": true
}

To deny the request and terminate its processing, OPA should send the following response:

1
2
3

{
  "result": false
}

Any other fields in the response in this case are ignored.

Object result

In this case, OPA returns an object instead of a boolean result. This allows for injecting custom HTTP headers as well as changing the HTTP status code for rejected requests.

The plugin expects the following structure in the OPA response in this case:

1
2
3
4
5
6
7
8
9
10

{
  "result": {
    "allow": <boolean>,
    "status": <HTTP status code>,
    "headers": {
      "<key>": "<value>",
      "<key2>": "<value2>"
    }
  }
}

The only required field in this response is result.allow, which accepts a boolean value.

If result.allow is set to true, then the key-value pairs in result.headers (if any) are injected into the request before it is forwarded to the upstream Service.

If result.allow is set to false, then the key-value pairs in result.headers (if any) are injected into the response and the status code of the response is set to result.status. If result.status is absent then the default 403 status code is sent.