# OPA Quickstart Guide [![Slack](https://slack.minio.io/slack?type=svg)](https://slack.minio.io)

OPA is a lightweight general-purpose policy engine that can be co-located with MinIO server, in this document we talk about how to use OPA HTTP API to authorize requests. It can be used with any type of credentials (STS based like OpenID or LDAP, regular IAM users or service accounts).

OPA is enabled through MinIO's Access Management Plugin feature.

## Get started

// CHECK-LABEL: func @testDataOperandsAndResults
// CHECK-SAME: ([[ARG_0:%.+]]: tensor<i1>)
func.func @testDataOperandsAndResults(%arg0 : tensor<i1>) {
  %0:2 = tf_executor.graph {
    %1:2 = tf_executor.island {
      %2 = "tf.opA"(%arg0) : (tensor<i1>) -> tensor<i1>
      tf_executor.yield %2 : tensor<i1>
    }
    %3:3 = tf_executor.island() {
      %4:2 = "tf_device.parallel_execute"() ({
        %5 = "tf.opB"(%1#0) : (tensor<i1>) -> tensor<i1>

// by parent `tf_device.launch`.
// CHECK-LABEL: func @single_op_launch
func.func @single_op_launch() {
  tf_executor.graph {
    %0:5 = tf_executor.island {
      %a = "tf.opA"() : () -> tensor<i1>
      %launch:2 = "tf_device.launch"() ({
        %b:2 = "tf.opB"(%a) : (tensor<i1>) -> (tensor<i32>, tensor<f32>)
        tf_device.return %b#1, %b#0 : tensor<f32>, tensor<i32>

// CHECK-LABEL: func @testDataOperandsAndResults
// CHECK-SAME: ([[ARG_0:%.+]]: tensor<i1>)
func.func @testDataOperandsAndResults(%arg0 : tensor<i1>) {
  %0:2 = tf_executor.graph {
    %1:2 = tf_executor.island {
      %2 = "tf.opA"(%arg0) : (tensor<i1>) -> tensor<i1>
      tf_executor.yield %2 : tensor<i1>
    }
    %3:3 = tf_executor.island() {
      %4:2 = "tf_device.parallel_execute"() ({
        %5 = "tf.opB"(%1#0) : (tensor<i1>) -> tensor<i1>

        %a:2 = "tf.opA"() {device = ""} : () -> (tensor<i32>, tensor<f32>)
        tf_device.return %a#1, %a#0 : tensor<f32>, tensor<i32>
      }) {device = "CPU:0"} : () -> (tensor<f32>, tensor<i32>)
      tf_executor.yield %launch#0, %launch#1: tensor<f32>, tensor<i32>
    }
    tf_executor.fetch
  }
  func.return
}

// CHECK:      [[A:%.+]]:2 = "tf.opA"
// CHECK-SAME: device = "CPU:0"

  // CHECK:      %[[READ:.*]] = "tf.ReadVariableOp"
  // CHECK-NEXT: tf_device.replicate
  // CHECK-NEXT:   "tf.OpA"(%[[READ]])
  tf_device.replicate {n = 2 : i32} {
    %0 = "tf.ReadVariableOp"(%arg0) : (tensor<*x!tf_type.resource<tensor<f32>>>) -> tensor<f32>
    "tf.OpA"(%0) : (tensor<f32>) -> ()
  }
  func.return
}

// -----

// CHECK:       tf.OpA
// CHECK:       ^bb0
// CHECK:         (%[[BARG:[a-zA-Z0-9_]+]]: tensor<*xf32>)
// CHECK-NOT:   tf.OpB
// CHECK:       tf.OpC
// CHECK-SAME:    %[[BARG]]
func.func @remove_first_result(%arg0: tensor<*xf32>, %arg1: tensor<*xf32>) -> tensor<*xf32> {
  %0:2 = "tf.WhileRegion"(%arg0, %arg1) ({
  ^bb0(%arg2: tensor<*xf32>, %arg3: tensor<*xf32>):
    %1 = "tf.OpA"() {is_stateless = true} : () -> tensor<i1>

		*a = oa
		return nil
	}

	*a = oa
	return nil
}

// Opa - implements opa policy agent calls.
type Opa struct {
	args   Args
	client *http.Client
}

// Enabled returns if opa is enabled.
func Enabled(kvs config.KVS) bool {
	return kvs.Get(URL) != ""
}

// LookupConfig lookup Opa from config, override with any ENVs.

	Compression compress.Config `json:"compress"`

	// OpenID configuration
	OpenID openid.Config `json:"openid"`

	// External policy enforcements.
	Policy struct {
		// OPA configuration.
		OPA opa.Args `json:"opa"`

		// Add new external policy enforcements here.
	} `json:"policy"`

	LDAPServerConfig xldap.LegacyConfig `json:"ldapserverconfig"`

  // CHECK-NOT: "tf_device.launch"
  // CHECK: "tf.opA"
  "tf.opA"() : () -> tensor<i1>
  func.return
}

// Tests that single TensorFlow op with empty device attribute is not wrapped in `tf_device.launch`.
// CHECK-LABEL: func @empty_device_attribute
func.func @empty_device_attribute() {
  // CHECK-NOT: "tf_device.launch"
  // CHECK: "tf.opA"
  "tf.opA"() {device = ""} : () -> tensor<i1>
  func.return
}