Camel Spring Boot

OPA

Evaluate Open Policy Agent (Rego) policies against an Exchange and record the allow/deny decision on it.

What’s inside

OPA component, URI syntax: opa:policyPath

Please refer to the above links for usage and configuration details.

Maven coordinates

<dependency>
    <groupId>org.apache.camel.springboot</groupId>
    <artifactId>camel-opa-starter</artifactId>
</dependency>

Spring Boot Auto-Configuration

The starter supports 23 options, which are listed below.

Name	Description	Default	Type
camel.component.opa.allow-key	The key to read the allow/deny verdict from when the policy returns an object rather than a plain boolean. For a policy returning \{allow: true, reasons: } the default value of allow is what you want. A dotted path reaches a verdict nested inside the document: \{code allowKey=result.allow} reads \{result: \{allow: true}}. A key with no dot is looked up directly at the top level.	allow	String
camel.component.opa.autowired-enabled	Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc.	true	Boolean
camel.component.opa.bearer-token	Bearer token sent to the OPA server in the Authorization header, for an OPA instance that has its API authentication enabled.		String
camel.component.opa.borrow-timeout	How long an exchange waits for a free WebAssembly policy instance in wasm mode before the evaluation fails. An exchange that cannot get an instance is not denied by a policy, so it is reported as an evaluation failure and handled like any other: failing closed, or proceeding if failOpen is set. Raise it, or poolSize, for a route whose concurrency exceeds the pool. The option is a long type.	30000	Long
camel.component.opa.configuration	The component configuration. The option is a org.apache.camel.component.opa.OpaConfiguration type.		OpaConfiguration
camel.component.opa.connection-timeout	How long to wait for the connection to the OPA server to be established, in rest mode. The SDK’s own transport applies no timeout at all, so a server that never answers would otherwise park the calling thread indefinitely rather than letting the component fail closed. The option is a long type.	10000	Long
camel.component.opa.enabled	Whether to enable auto configuration of the opa component. This is enabled by default.		Boolean
camel.component.opa.entrypoint	The compiled entrypoint to evaluate in wasm mode. This is not the same thing as the policy path: an entrypoint is fixed when the bundle is built, with \{code opa build -e}. Defaults to the endpoint’s policy path, which is the name \{code opa build} gives it.		String
camel.component.opa.evaluation-mode	How the policy is evaluated. rest (the default) calls a running OPA server over its Data API. wasm evaluates a WebAssembly bundle in-process, with no server involved - so there is no network hop and no unreachable decision point, at the cost of the policy being a build-time artefact rather than something a server distributes and updates. serverUrl, bearerToken and failOpen do not apply in wasm mode.	rest	String
camel.component.opa.fail-open	Whether to allow the exchange to proceed when the policy cannot be evaluated at all, for example because the OPA server is unreachable. Disabled by default so that an unreachable policy decision point denies rather than grants access. Do not enable this in production.	false	Boolean
camel.component.opa.health-check-consumer-enabled	Used for enabling or disabling all consumer based health checks from this component	true	Boolean
camel.component.opa.health-check-producer-enabled	Used for enabling or disabling all producer based health checks from this component. Notice: Camel has by default disabled all producer based health-checks. You can turn on producer checks globally by setting camel.health.producersEnabled=true.	true	Boolean
camel.component.opa.include-body	Whether to send the message body to OPA as part of the input document. Disabled by default: bodies can be large or streaming, and most authorization decisions only need headers. When enabled on a streaming body, enable stream caching so that the body is still readable by the rest of the route.	false	Boolean
camel.component.opa.include-headers	Comma-separated list of message header names to send to OPA in the input document. The default of \{code } sends every header except those that carry a caller credential verbatim - Authorization, \{code Proxy-Authorization}, Cookie and \{code Set-Cookie} - which are withheld because OPA’s decision logging ships the whole input document, often off the box. A policy that genuinely needs one can still have it by naming the header here. Narrow the list when the policy only needs a few headers.	*	String
camel.component.opa.include-properties	Comma-separated list of exchange property names to send to OPA in the input document, or \{code } for all of them. Empty by default, so no properties are sent unless asked for. This is where the authentication components put the identity they verified: \{code camel-keycloak} stores the access token and its subject as exchange properties and prefers them over the equivalent headers, precisely because headers can be set by the caller. List those property names here to let a policy authorize the identity an earlier step established, instead of copying it into a header first. Only custom properties are sent; Camel’s own internal exchange properties are never included.		String
camel.component.opa.lazy-start-producer	Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.	false	Boolean
camel.component.opa.opa-client	An existing OPAClient to use. When set, serverUrl and bearerToken are ignored. The option is a com.styra.opa.OPAClient type.		OPAClient
camel.component.opa.policy-bundle	The WebAssembly policy to evaluate in wasm mode, as produced by \{code opa build -t wasm}. Accepts a \{code file:}, \{code classpath:} or \{code http:} location holding either the bundle.tar.gz that \{code opa build} emits or a bare .wasm module. Required when \{code evaluationMode=wasm}. Prefer the bundle: it also carries the data document the policy reads as \{code data.}, which a bare module does not.		String
camel.component.opa.pool-size	How many WebAssembly policy instances to pool in wasm mode. An instance carries mutable state and is not thread-safe, so each exchange borrows one; this bounds how many exchanges evaluate at once.	8	Integer
camel.component.opa.request-timeout	How long to wait for the decision once connected, in rest mode. A request that times out is an evaluation failure rather than a deny, so it fails closed - or proceeds when failOpen is set - like any other failure to reach a verdict. The option is a long type.	30000	Long
camel.component.opa.server-url	The base URL of the OPA server, without the \{code /v1/data} suffix. The default assumes OPA running as a sidecar on the standard port.	http://localhost:8181	String
camel.component.opa.ssl-context-parameters	TLS configuration for the connection to the OPA server in rest mode. Needed to trust a server whose certificate comes from a private CA, and to present a client certificate to a server that requires mutual TLS - a SPIFFE X.509-SVID, for instance, so the workload authenticates to the policy decision point as itself. The option is a org.apache.camel.support.jsse.SSLContextParameters type.		SSLContextParameters
camel.component.opa.use-global-ssl-context-parameters	Enable usage of global SSL context parameters.	false	Boolean

Name

Description

Default

Type

camel.component.opa.allow-key

The key to read the allow/deny verdict from when the policy returns an object rather than a plain boolean. For a policy returning \{allow: true, reasons: } the default value of allow is what you want. A dotted path reaches a verdict nested inside the document: \{code allowKey=result.allow} reads \{result: \{allow: true}}. A key with no dot is looked up directly at the top level.

allow

String

camel.component.opa.autowired-enabled

Whether autowiring is enabled. This is used for automatic autowiring options (the option must be marked as autowired) by looking up in the registry to find if there is a single instance of matching type, which then gets configured on the component. This can be used for automatic configuring JDBC data sources, JMS connection factories, AWS Clients, etc.

true

Boolean

camel.component.opa.bearer-token

Bearer token sent to the OPA server in the Authorization header, for an OPA instance that has its API authentication enabled.

String

camel.component.opa.borrow-timeout

How long an exchange waits for a free WebAssembly policy instance in wasm mode before the evaluation fails. An exchange that cannot get an instance is not denied by a policy, so it is reported as an evaluation failure and handled like any other: failing closed, or proceeding if failOpen is set. Raise it, or poolSize, for a route whose concurrency exceeds the pool. The option is a long type.

30000

Long

camel.component.opa.configuration

The component configuration. The option is a org.apache.camel.component.opa.OpaConfiguration type.

OpaConfiguration

camel.component.opa.connection-timeout

How long to wait for the connection to the OPA server to be established, in rest mode. The SDK’s own transport applies no timeout at all, so a server that never answers would otherwise park the calling thread indefinitely rather than letting the component fail closed. The option is a long type.

10000

Long

camel.component.opa.enabled

Whether to enable auto configuration of the opa component. This is enabled by default.

Boolean

camel.component.opa.entrypoint

The compiled entrypoint to evaluate in wasm mode. This is not the same thing as the policy path: an entrypoint is fixed when the bundle is built, with \{code opa build -e}. Defaults to the endpoint’s policy path, which is the name \{code opa build} gives it.

String

camel.component.opa.evaluation-mode

How the policy is evaluated. rest (the default) calls a running OPA server over its Data API. wasm evaluates a WebAssembly bundle in-process, with no server involved - so there is no network hop and no unreachable decision point, at the cost of the policy being a build-time artefact rather than something a server distributes and updates. serverUrl, bearerToken and failOpen do not apply in wasm mode.

rest

String

camel.component.opa.fail-open

Whether to allow the exchange to proceed when the policy cannot be evaluated at all, for example because the OPA server is unreachable. Disabled by default so that an unreachable policy decision point denies rather than grants access. Do not enable this in production.

false

Boolean

camel.component.opa.health-check-consumer-enabled

Used for enabling or disabling all consumer based health checks from this component

true

Boolean

camel.component.opa.health-check-producer-enabled

Used for enabling or disabling all producer based health checks from this component. Notice: Camel has by default disabled all producer based health-checks. You can turn on producer checks globally by setting camel.health.producersEnabled=true.

true

Boolean

camel.component.opa.include-body

Whether to send the message body to OPA as part of the input document. Disabled by default: bodies can be large or streaming, and most authorization decisions only need headers. When enabled on a streaming body, enable stream caching so that the body is still readable by the rest of the route.

false

Boolean

camel.component.opa.include-headers

Comma-separated list of message header names to send to OPA in the input document. The default of \{code } sends every header except those that carry a caller credential verbatim - Authorization, \{code Proxy-Authorization}, Cookie and \{code Set-Cookie} - which are withheld because OPA’s decision logging ships the whole input document, often off the box. A policy that genuinely needs one can still have it by naming the header here. Narrow the list when the policy only needs a few headers.

String

camel.component.opa.include-properties

Comma-separated list of exchange property names to send to OPA in the input document, or \{code } for all of them. Empty by default, so no properties are sent unless asked for. This is where the authentication components put the identity they verified: \{code camel-keycloak} stores the access token and its subject as exchange properties and prefers them over the equivalent headers, precisely because headers can be set by the caller. List those property names here to let a policy authorize the identity an earlier step established, instead of copying it into a header first. Only custom properties are sent; Camel’s own internal exchange properties are never included.

String

camel.component.opa.lazy-start-producer

Whether the producer should be started lazy (on the first message). By starting lazy you can use this to allow CamelContext and routes to startup in situations where a producer may otherwise fail during starting and cause the route to fail being started. By deferring this startup to be lazy then the startup failure can be handled during routing messages via Camel’s routing error handlers. Beware that when the first message is processed then creating and starting the producer may take a little time and prolong the total processing time of the processing.

false

Boolean

camel.component.opa.opa-client

An existing OPAClient to use. When set, serverUrl and bearerToken are ignored. The option is a com.styra.opa.OPAClient type.

OPAClient

camel.component.opa.policy-bundle

The WebAssembly policy to evaluate in wasm mode, as produced by \{code opa build -t wasm}. Accepts a \{code file:}, \{code classpath:} or \{code http:} location holding either the bundle.tar.gz that \{code opa build} emits or a bare .wasm module. Required when \{code evaluationMode=wasm}. Prefer the bundle: it also carries the data document the policy reads as \{code data.}, which a bare module does not.

String

camel.component.opa.pool-size

How many WebAssembly policy instances to pool in wasm mode. An instance carries mutable state and is not thread-safe, so each exchange borrows one; this bounds how many exchanges evaluate at once.

Integer

camel.component.opa.request-timeout

How long to wait for the decision once connected, in rest mode. A request that times out is an evaluation failure rather than a deny, so it fails closed - or proceeds when failOpen is set - like any other failure to reach a verdict. The option is a long type.

30000

Long

camel.component.opa.server-url

The base URL of the OPA server, without the \{code /v1/data} suffix. The default assumes OPA running as a sidecar on the standard port.

http://localhost:8181

String

camel.component.opa.ssl-context-parameters

TLS configuration for the connection to the OPA server in rest mode. Needed to trust a server whose certificate comes from a private CA, and to present a client certificate to a server that requires mutual TLS - a SPIFFE X.509-SVID, for instance, so the workload authenticates to the policy decision point as itself. The option is a org.apache.camel.support.jsse.SSLContextParameters type.

SSLContextParameters

camel.component.opa.use-global-ssl-context-parameters

Enable usage of global SSL context parameters.

false

Boolean