OPA (Open Policy Agent) Evaluate
CertifiedEnterprise EditionEvaluate a policy decision with OPA
OPA (Open Policy Agent) Evaluate
Evaluate a policy decision with OPA
Calls OPA Data API at /v1/data/{path} with optional input to compute a decision. Metrics and explain traces are optional; metrics default to false.
type: io.kestra.plugin.ee.opa.policy.EvaluateExamples
Evaluate an OPA policy
id: check_policy
namespace: company.team
tasks:
- id: check_policy
type: io.kestra.plugin.ee.opa.policy.Evaluate
url: "{{ secret('OPA_URL') }}"
token: "{{ secret('OPA_TOKEN') }}"
policyPath: "kubernetes/admission"
input:
request:
operation: "CREATE"
kind: "Deployment"
object:
metadata:
name: "nginx-deployment"
namespace: "production"
spec:
replicas: 3
template:
spec:
containers:
- name: "nginx"
image: "nginx:1.21"
securityContext:
runAsNonRoot: true
readOnlyRootFilesystem: true
metrics: true
explain: "notes"
Properties
policyPath *string
Policy path
Path relative to /v1/data (do not prefix with data/).
url *string
OPA base URL
assets
Assets this task consumes as inputs or produces as outputs, for lineage tracking and the asset graph (Enterprise Edition). A flow declaring this property on a task is rejected in the open-source edition.
io.kestra.core.models.assets.AssetsDeclaration
IGNOREFAILWARNAsset failure behavior
Behavior applied to the task state when a declared asset fails to render, emit, or be persisted (e.g. a lock conflict): FAIL escalates it to FAILED, WARN (default) warns it if it would otherwise succeed, IGNORE leaves the state untouched.
Whether to auto-register assets referenced dynamically at runtime that are not statically declared in inputs or outputs.
The assets consumed as inputs.
io.kestra.core.models.assets.AssetIdentifier
1The assets produced as outputs.
io.kestra.plugin.ee.assets.Dataset
1150{}1150io.kestra.plugin.ee.assets.File
1150{}1150io.kestra.plugin.ee.assets.Table
1150{}1150io.kestra.plugin.ee.assets.VM
1150{}1150io.kestra.core.models.assets.External
1150{}1150io.kestra.core.models.assets.Custom
11501Custom asset type
{}1150explain string
Explain
Return query explanation in addition to result. Allowed values: notes, fails, full, debug.
input object
Input document
JSON input document rendered with flow variables and sent as input.
metrics booleanstring
Enable metrics
Return query performance metrics; defaults to false.
token string
Bearer token
Outputs
decisionId string
Decision ID
OPA decision_id, if decision logging is enabled
defined boolean
Whether the result is defined
True if OPA returned a result field
response object
Raw OPA response
Full response returned by OPA Data API
result object
Policy result
Value of the 'result' field if present, otherwise null
