Open Policy Agent (opa)
Policy decision point of every Navin Enterprise gateway (models, tools, MCP, data). Loads the Navin policy bundle and answers the decisions of the Control Plane.
Generated from catalog/services/opa.yaml: do not edit by hand.
Summary
| Version | 1.21.4 |
| Use | install and configure, configure and connect |
| Layer | functional (AI catalog) |
| Category | Security and policies |
| Installation methods | binary, podman |
| External connection | no |
| Sandbox only | no |
Licence
| SPDX identifier | Apache-2.0 |
| Licence policy | core licence (MIT or Apache-2.0) |
| Licence exception | - |
| Platform component | opa |
Packages and artifacts
A package the project of the service publishes (its image, its binary archive, its Python or OS package) carries the licence of the service; a third-party package carries the licence written on its row, read from the official upstream metadata.
| Kind | Package | Version | Licence | Details |
|---|---|---|---|---|
| container image | docker.io/openpolicyagent/opa | 1.21.4-static | Apache-2.0 | image key opa, used by opa-server, digest sha256:47f93480b09e24c220ae75f1e9133585ba6d698059951668d35e6a4fc32ebc82 |
| binary archive | opa | 1.21.4 | Apache-2.0 | https://github.com/open-policy-agent/opa/releases/download/v1.21.4/opa_linux_amd64_static, x86_64, checksum sha256 |
Images are pinned by tag in the descriptor, and by digest when the descriptor declares one (the offline bundle then refuses a pulled image that does not carry it); the digest is recorded in the mirror of the Manager when the offline bundle is imported, and every pull or load is checked against it.
Supported systems and architectures
| Method | Operating systems | Architectures |
|---|---|---|
binary | RHEL family (dnf), Debian family (apt), Arch Linux (pacman) | x86_64 (architecture of the artifacts of the descriptor) |
podman | RHEL family (dnf), Debian family (apt), Arch Linux (pacman) | x86_64, aarch64 (not restricted by the descriptor) |
Certified host systems: RHEL 8/9/10, Rocky Linux 8/9/10, AlmaLinux 8/9/10, Oracle Linux 8/9, CentOS Stream 9/10, Ubuntu 22.04/24.04, Debian 12, Arch Linux (rolling). The host preflight accepts these systems (other releases of a known family give a warning, end of life releases are refused) and the x86_64 and aarch64 architectures.
Prerequisites
Host
- at least 512 MB of memory (blocking,
memory).
Network and ports
| Component | Port name | Port | Opened in the host firewall |
|---|---|---|---|
opa-server | api | 8181/tcp | yes |
opa-server | diagnostic | 8282/tcp | yes |
Services and connections needed
This service has no dependency.
Installation methods and modes
| Method | Default | What the method uses |
|---|---|---|
binary | yes | the binary archives of the descriptor, unpacked under the service directory |
podman | - | the container images of the descriptor, run by Podman under systemd |
Components
| Component | Kind | Installation methods | Ports |
|---|---|---|---|
OPA server (opa-server) | master | binary, podman | 8181/tcp, 8282/tcp |
Single server (standalone) (default)
One OPA server, for a sandbox or a small installation.
What the mode deploys:
| Component | Placement |
|---|---|
opa-server | min 1, max 1 |
Replicated (replicated)
Several stateless OPA servers behind the load balancer; each loads the same bundle.
What the mode deploys:
| Component | Placement |
|---|---|
opa-server | min 2, recommended 3 |
Install this service
The install wizard of the Navin Manager plans, validates and runs the installation; you need the services:install permission on the cluster.
-
Open the wizard. In Clusters, choose the row action Install services of the target cluster. The wizard opens on its first step, Service.
-
Choose the service. On the Service step, select Open Policy Agent. The card shows the licence
Apache-2.0. Pick the Method amongbinary,podman(defaultbinary). -
Choose the hosts and the mode. On the Hosts step, tick the hosts, then choose the Mode:
standalone(default),replicated. Each mode deploys the components listed in Installation methods and modes. -
Bindings. This service has no dependency: the Bindings step has nothing to bind.
-
Configure. On the Configure step, review the parameters (see Configuration parameters). Passwords left empty with a generated default are generated and sealed by the Manager.
-
Review and install. On the Install step the Manager validates the plan and shows the installation order; when it says "The plan is valid. Ready to install.", choose Install. A highly available mode is installed only when its HA checks pass.
-
Verify. The operation ends when the health checks of every instance pass (see Health checks); the service then shows as running in Services. Open the service and choose Run the smoke test in the Checks card: Loads a policy, asks a decision that must allow and one that must deny, then removes the policy.
Connect an existing service
| Schemes | https, http |
| Default port | 8181 |
| Authentication | optional |
| Health check | /health |
| Authentication method | Fields | Description |
|---|---|---|
bearer | token | OPA started with --authentication=token and --authorization=basic: system.authz must let the token read /v1/policies. |
client_certificate | client_cert, client_key | OPA started with --authentication=tls: client certificate signed by the authority of --tls-ca-cert-file. |
none | - | Default of OPA: no authentication, bind it to a filtered network. |
Official documentation: https://www.openpolicyagent.org/docs/security
High availability
| Cluster | replicas (replication) |
| High availability | external (external) |
| Failover | load balancer (load-balancer) |
| Replication | shared store (shared-store) |
| Quorum | none (none) |
| Discovery | none (none) |
| Entry point | load balancer (load-balancer) |
| Official documentation | https://www.openpolicyagent.org/docs/deploy |
| Peer TLS parameter | tls_enabled |
Topology per mode
| Modes | Highest catalog level | Distribution | Quorum component | Fault domains | Description |
|---|---|---|---|---|---|
standalone | standalone (standalone) | single (single) | - | 1 | One instance, no fault tolerance. |
replicated | ha (ha) | active-active (active-active) | - | 2 | Several stateless servers behind the load balancer, each loading the same policy bundle. |
Notes
- Every instance evaluates on its own copy of the policies: with bundles enabled the bundle server must stay reachable for updates, the last loaded bundle keeps serving meanwhile.
Configuration parameters
Network
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|---|---|---|---|---|---|---|
API port (port) | port | 8181 | - | no | no | no | Port of the decision API (/v1/data). |
Diagnostic port (diagnostic_port) | port | 8282 | - | no | no | no | Port of /health and /metrics, kept apart from the decision API. |
TLS (tls_enabled) | bool | false | - | no | no | no | Serve the API over TLS with a certificate issued by the manager CA. |
Policy bundle
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|---|---|---|---|---|---|---|
Bundle server (bundle_url) | url | {{ mirror.url }}/bundles | - | no | no | no | Base URL serving the policy bundle. |
Bundle file (bundle_resource) | string | navin-policies.tar.gz | - | no | no | no | Path of the bundle below the bundle server. |
Load the bundle (bundle_enabled) | bool | true | - | no | no | no | Download and activate the Navin policy bundle (disable only to test the empty server). |
Minimum polling delay (bundle_min_delay_s) | int | 30 | min 5, max 3600 | no | no | yes | Seconds between two bundle downloads (minimum). (advanced) |
Maximum polling delay (bundle_max_delay_s) | int | 120 | min 10, max 7200 | no | no | no | Seconds between two bundle downloads (maximum). (advanced) |
Logging
| Parameter | Type | Default | Allowed values | Required | Secret | Restart | Description |
|---|---|---|---|---|---|---|---|
Log level (log_level) | enum | info | debug, info, warn, error | no | no | no | Verbosity of the server log. |
Decision logs (decision_logs_console) | bool | true | - | no | no | no | Write every decision to the journal (collected by the log pipeline for the SIEM). |
Endpoints
| Endpoint | Scheme | Component | Port | Path | TLS parameter | Binding parameters | Binding secrets | Provisioning command |
|---|---|---|---|---|---|---|---|---|
api | http | opa-server | 8181 (port) | - | tls_enabled | - | - | - |
Client configuration files
Files rendered for the client configuration download:
opa.env(client.env.j2)
Commands
| Command | Component | Target | Description |
|---|---|---|---|
Check the policy bundle (bundle_status) | opa-server | every host | Asks every OPA server whether the Navin bundle is activated. |
Health checks
Liveness (per instance)
| Component | Check | Details |
|---|---|---|
opa-server | HTTP {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn if config.tls_enabled else (host.ip or '127.0.0.1') }}:{{ config.diagnostic_port }}/health | Expected 200; 30 retries; interval 1 s; timeout 3 s |
Readiness (service check)
| Check | Details |
|---|---|
HTTP {{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn if config.tls_enabled else (host.ip or '127.0.0.1') }}:{{ config.port }}/v1/data/system/main | Expected 200, 404; 5 retries; interval 2 s; timeout 5 s |
Smoke test
Loads a policy, asks a decision that must allow and one that must deny, then removes the policy. (opa-server: load_policy, decision_allow, decision_deny, remove_policy)
Preflight checks
| Check | Type | Meaning | Severity | Components |
|---|---|---|---|---|
memory | memory_mb {"min": 512} | at least 512 MB of memory | blocking | every component |
api_port_free | port_free {"param": "port"} | port 8181 free on the host | blocking | every component |
Upgrade
| Supported from | 1.21.3 |
| Stateful | no |
| Backup before the upgrade | no |
| Rollback | yes |
Uninstall
Paths removed when the data is purged: {{ paths.data }}, {{ paths.log }}.
Quick links
- Diagnostic metrics:
{{ 'https' if config.tls_enabled else 'http' }}://{{ host.fqdn }}:{{ config.diagnostic_port }}/metrics
Upstream documentation
- Homepage: https://www.openpolicyagent.org
- Source: https://github.com/open-policy-agent/opa
- High availability: https://www.openpolicyagent.org/docs/deploy
- Authentication: https://www.openpolicyagent.org/docs/security