Open Policy Agent (OPA)

Traefik Enterprise comes with an Open Policy Agent middleware that allows you to restrict access to your services. It also allows you to enrich request headers with data extracted from policies. The OPA middleware works as an OPA agent.

OPA Version

This middleware uses the v0.24.0 of the OPA specification.

Middleware Options

policy

Optional (one of policy or bundlePath must be set), Default=""

The policy option should contain the path or the content of a policy.

Docker

labels:
  - "traefik.http.middlewares.test-opa.plugin.opa.policy=/usr/traefikee/policy.rego"

Kubernetes

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: test-opa
spec:
  plugin:
    opa:
      policy: /usr/traefikee/policy.rego

Consul Catalog

- "traefik.http.middlewares.test-opa.plugin.opa.policy=/usr/traefikee/policy.rego"

Marathon

"labels": {
    "traefik.http.middlewares.test-opa.plugin.opa.policy": "/usr/traefikee/policy.rego"
}

Rancher

labels:
  - "traefik.http.middlewares.test-opa.plugin.opa.policy=/usr/traefikee/policy.rego"

File (YAML)

http:
  middlewares:
    test-opa:
      plugin:
        opa:
          policy: /usr/traefikee/policy.rego

File (TOML)

[http.middlewares]
  [http.middlewares.test-opa.plugin.opa]
    policy = "/usr/traefikee/policy.rego"

bundlePath

Optional (one of policy or bundlePath must be set), Default=false

The bundlePath option should contain the path to an OPA bundle.

Docker

labels:
  - "traefik.http.middlewares.test-opa.plugin.opa.bundlePath=/usr/traefikee/bundle.tar.gz"

Kubernetes

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: test-opa
spec:
  plugin:
    opa:
      bundlePath: /usr/traefikee/bundle.tar.gz

Consul Catalog

- "traefik.http.middlewares.test-opa.plugin.opa.bundlePath=/usr/traefikee/bundle.tar.gz"

Marathon

"labels": {
    "traefik.http.middlewares.test-opa.plugin.opa.bundlePath": "/usr/traefikee/bundle.tar.gz"
}

Rancher

labels:
  - "traefik.http.middlewares.test-opa.plugin.opa.bundlePath=/usr/traefikee/bundle.tar.gz"

File (YAML)

http:
  middlewares:
    test-jwt:
      plugin:
        opa:
          bundlePath: /usr/traefikee/bundle.tar.gz

File (TOML)

[http.middlewares]
  [http.middlewares.test-opa.plugin.opa]
    bundlePath = /usr/traefikee/bundle.tar.gz

allow

Optional (one of allow or forwardHeaders must be set), Default=""

The allow option sets the expression to evaluate that determines if the request should be authorized.

Docker

labels:
  - "traefik.http.middlewares.test-opa.plugin.opa.allow=data.package.allow"

Kubernetes

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: test-opa
spec:
  plugin:
    opa:
      allow: data.package.allow

Consul Catalog

- "traefik.http.middlewares.test-opa.plugin.opa.allow=data.package.allow"

Marathon

"labels": {
  "traefik.http.middlewares.test-opa.plugin.opa.allow": "data.package.allow"
}

Rancher

labels:
  - "traefik.http.middlewares.test-opa.plugin.opa.allow=data.package.allow"

File (YAML)

http:
  middlewares:
    test-opa:
      plugin:
        opa:
          allow: data.package.allow

File (TOML)

[http.middlewares]
  [http.middlewares.test-opa.plugin.opa]
    allow = "data.package.allow"

forwardHeaders

Optional (one of allow or forwardHeaders must be set), Default=None

The forwardHeaders option sets the HTTP headers to add to requests and populates them with the result of the given expression.

Docker

labels:
  - "traefik.http.middlewares.test-opa.plugin.opa.forwardHeaders.Group=data.package.grp"

Kubernetes

apiVersion: traefik.containo.us/v1alpha1
kind: Middleware
metadata:
  name: test-opa
spec:
  plugin:
    opa:
      forwardHeaders:
        Group: data.package.grp

Consul Catalog

- "traefik.http.middlewares.test-opa.plugin.opa.forwardHeaders.Group=data.package.grp"

Marathon

"labels": {
    "traefik.http.middlewares.test-opa.plugin.opa.forwardHeaders.Group": "data.package.grp"
}

Rancher

labels:
  - "traefik.http.middlewares.test-opa.plugin.opa.forwardHeaders.Group=data.package.grp"

File (YAML)

http:
  middlewares:
    test-jwt:
      plugin:
        opa:
          forwardHeaders:
            Group: data.package.grp

File (TOML)

[http.middlewares]
  [http.middlewares.test-opa.plugin.opa]
    [http.middlewares.test-opa.plugin.opa.forwardHeaders]
      Group = "data.package.grp"