Camel Spring Boot

OPA

Evaluate Open Policy Agent (Rego) policies against an Exchange and record the allow/deny decision on it.

What’s inside

OPA component, URI syntax: opa:policyPath

Please refer to the above links for usage and configuration details.

Maven coordinates

<dependency>
    <groupId>org.apache.camel.springboot</groupId>
    <artifactId>camel-opa-starter</artifactId>
</dependency>

Spring Boot Auto-Configuration

The starter supports 11 options, which are listed below.

Name	Description	Default	Type
camel.component.opa.allow-key	The key to read the allow/deny verdict from when the policy returns an object rather than a plain boolean. For a policy returning \{allow: true, reasons: } the default value of allow is what you want.	allow	String
camel.component.opa.autowired-enabled	Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc.	true	Boolean
camel.component.opa.bearer-token	Bearer token sent to the OPA server in the Authorization header, for an OPA instance that has its API authentication enabled.		String
camel.component.opa.configuration	The component configuration. The option is a org.apache.camel.component.opa.OpaConfiguration type.		OpaConfiguration
camel.component.opa.enabled	Whether to enable auto configuration of the opa component. This is enabled by default.		Boolean
camel.component.opa.fail-open	Whether to allow the exchange to proceed when the policy cannot be evaluated at all, for example because the OPA server is unreachable. Disabled by default so that an unreachable policy decision point denies rather than grants access. Do not enable this in production.	false	Boolean
camel.component.opa.include-body	Whether to send the message body to OPA as part of the input document. Disabled by default: bodies can be large or streaming, and most authorization decisions only need headers. When enabled on a streaming body, enable stream caching so that the body is still readable by the rest of the route.	false	Boolean
camel.component.opa.include-headers	Comma-separated list of message header names to send to OPA in the input document. The default of \{code } sends every header. Narrow it when the policy only needs a few headers, or when the message carries headers that should not leave the JVM.	*	String
camel.component.opa.lazy-start-producer	Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.	false	Boolean
camel.component.opa.opa-client	An existing OPAClient to use. When set, serverUrl and bearerToken are ignored. The option is a com.styra.opa.OPAClient type.		OPAClient
camel.component.opa.server-url	The base URL of the OPA server, without the \{code /v1/data} suffix. The default assumes OPA running as a sidecar on the standard port.	http://localhost:8181	String

Name

Description

Default

Type

camel.component.opa.allow-key

The key to read the allow/deny verdict from when the policy returns an object rather than a plain boolean. For a policy returning \{allow: true, reasons: } the default value of allow is what you want.

allow

String

camel.component.opa.autowired-enabled

Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc.

true

Boolean

camel.component.opa.bearer-token

Bearer token sent to the OPA server in the Authorization header, for an OPA instance that has its API authentication enabled.

String

camel.component.opa.configuration

The component configuration. The option is a org.apache.camel.component.opa.OpaConfiguration type.

OpaConfiguration

camel.component.opa.enabled

Whether to enable auto configuration of the opa component. This is enabled by default.

Boolean

camel.component.opa.fail-open

Whether to allow the exchange to proceed when the policy cannot be evaluated at all, for example because the OPA server is unreachable. Disabled by default so that an unreachable policy decision point denies rather than grants access. Do not enable this in production.

false

Boolean

camel.component.opa.include-body

Whether to send the message body to OPA as part of the input document. Disabled by default: bodies can be large or streaming, and most authorization decisions only need headers. When enabled on a streaming body, enable stream caching so that the body is still readable by the rest of the route.

false

Boolean

camel.component.opa.include-headers

Comma-separated list of message header names to send to OPA in the input document. The default of \{code } sends every header. Narrow it when the policy only needs a few headers, or when the message carries headers that should not leave the JVM.

String

camel.component.opa.lazy-start-producer

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

Boolean

camel.component.opa.opa-client

An existing OPAClient to use. When set, serverUrl and bearerToken are ignored. The option is a com.styra.opa.OPAClient type.

OPAClient

camel.component.opa.server-url

The base URL of the OPA server, without the \{code /v1/data} suffix. The default assumes OPA running as a sidecar on the standard port.

http://localhost:8181

String