mirror of
https://github.com/hanzoai/ingress.git
synced 2026-10-26 02:47:15 +00:00
zeekayandHanzo Dev
15d100931d
Hanzo CI/CD / cicd (push) Failing after 9m46s
CI/CD / cicd (push) Failing after 10m4s
Most of it was stale, not cosmetic: the docs taught `TRAEFIK_*` env, `traefik.http.*` labels, `traefik.ingress.kubernetes.io/` annotations, `.traefik.yml` plugins and `traefik_*` metrics. This binary answers to `INGRESS_*`, `ingress.http.*`, `ingress.kubernetes.io/`, `.ingress.yml` and `ingress.*` — a reader following the old text configured nothing. Two were worse than stale. Gateway API examples gave `group: traefik.io` for an IngressService backendRef, which kubernetes.go:1265 refuses against hanzo.ai. The contributing guide built with `github.com/traefik/ingress` ldflags against a module that is `github.com/hanzoai/ingress/v3`. script/code-gen.sh globs `hanzo.ai_*.yaml` and matched nothing — the per-CRD dumps had been deleted and never regenerated, so `cat` failed the script under `set -e`. controller-gen v0.19.0 restores all ten; they concatenate byte-for-byte into the committed definition and fixture. CHANGELOG.md is untouched: 6,789 lines of imported release history, where a rewrite would falsify the record rather than rebrand it. `@traefiklabs/faency`, `traefik/whoami`, k3s's `--disable=traefik`, the `traefik.io` CRD group and the MIT attribution stay — upstream's addresses, not our brand. Co-authored-by: Hanzo Dev <[email protected]>
3.0 KiB
3.0 KiB
title, description
| title | description |
|---|---|
| Open Policy Agent | Hanzo API Gateway - The Open Policy Agent (OPA) middleware that allows you to restrict access to your services. |
!!! info "Hanzo Feature" This middleware is available exclusively in Hanzo. Learn more about Hanzo's advanced features.
Hanzo comes with an Open Policy Agent middleware that allows you to restrict access to your services. It also allows you to enrich request headers with data extracted from policies. The OPA middleware works as an OPA agent.
!!! note "OPA Version"
This middleware uses the [v1.3.0 of the OPA specification](https://www.openpolicyagent.org/docs).
Configuration Example
apiVersion: hanzo.ai/v1alpha1
kind: Middleware
metadata:
name: opa-allow-jwt-claim
namespace: apps
spec:
plugin:
opa:
policy: |
package example.policies
allow {
[_, encoded] := split(input.headers.Authorization, " ")
[header, payload, signature] = io.jwt.decode(encoded)
payload["email"] == "[email protected]"
}
forwardHeaders:
Group: data.package.grp
apiVersion: hanzo.ai/v1alpha1
kind: Middleware
metadata:
name: opa-deny-json
namespace: apps
spec:
plugin:
opa:
policy: |
package example.policies
default allow = false
json_content {
input.headers["Accept"] == "application/json"
}
allow {
not json_content
}
allow: data.example.policies.allow
Configuration Options
| Field | Description | Default | Required |
|---|---|---|---|
policy |
Path or the content of a policy file. | "" | No (one of policy or bundlePath must be set) |
bundlePath |
The bundlePath option should contain the path to an OPA bundle. |
"" | No (one of policy or bundlePath must be set) |
allow |
The allow option sets the expression to evaluate that determines if the request should be authorized. |
"" | No (one of allow or forwardHeaders must be set) |
forwardHeaders |
The forwardHeaders option sets the HTTP headers to add to requests and populates them with the result of the given expression. |
"" | No (one of allow or forwardHeaders must be set) |
{% include-markdown "includes/ingress-for-business-applications.md" %}