OPA is enabled through MinIO's Access Management Plugin feature.

## Get started

### 1. Start OPA in a container

```sh
podman run -it \
    --name opa \
    --publish 8181:8181 \

	AmzFwdHeaderObjectLockRetainUntil = "x-amz-fwd-header-x-amz-object-lock-retain-until-date"
	AmzFwdHeaderMPPartsCount          = "x-amz-fwd-header-x-amz-mp-parts-count"
	AmzFwdHeaderReplicationStatus     = "x-amz-fwd-header-x-amz-replication-status"
	AmzFwdHeaderSSE                   = "x-amz-fwd-header-x-amz-server-side-encryption"

		if s3Err != ErrNone {
			return nil, nil, false, errAuthentication
		}

		for k, v := range eclaims {
			claims.MapClaims[k] = v
		}

		// if root access is disabled, disable all its service accounts and temporary credentials.
		if ucred.ParentUser == globalActiveCred.AccessKey && !globalAPIConfig.permitRootAccess() {
			return nil, nil, false, errAccessKeyDisabled
		}

		// Now check if we have a sessionPolicy.

// ServerConfig represents a MinIO configuration file
type ServerConfig struct {
	ServerConfigVersion
	ServerConfigCommon
	Pools []struct {
		Args          []string `yaml:"args"`
		SetDriveCount uint64   `yaml:"set-drive-count"`
	} `yaml:"pools"`

	defer cancel()
	if err != nil {
		return nil, err
	}

	if r.Count == 0 {
		key = strings.TrimSuffix(key, etcdPathSeparator)
		r, err = c.etcdClient.Get(ctx, key)
		if err != nil {
			return nil, err
		}
		// only if we are looking at `domain` as true
		// we should return error here.
		if domain && r.Count == 0 {
			return nil, ErrDomainMissing
		}
	}

	var srvRecords []SrvRecord

	mu := NewDRWMutex(ds, "test-unlock-panic-2")
	defer func() {
		if recover() == nil {
			t.Fatalf("unlock of unlocked RWMutex did not panic")
		}
		mu.RUnlock(context.Background()) // Unlock, so -test.count > 1 works
	}()
	mu.RLock(id, source)
	mu.Unlock(context.Background())
}

// Borrowed from rwmutex_test.go
func TestRUnlockPanic(t *testing.T) {
	defer func() {
		if recover() == nil {

	}
	return 0
}

// asTimedAction returns the element as a madmin.TimedAction.
func (a AccElem) asTimedAction() madmin.TimedAction {
	return madmin.TimedAction{AccTime: uint64(a.Total), Count: uint64(a.N), Bytes: uint64(a.Size)}
}

// lastMinuteLatency keeps track of last minute latency.
type lastMinuteLatency struct {
	Totals  [60]AccElem
	LastSec int64
}

// along with this program.  If not, see <http://www.gnu.org/licenses/>.

package cmd

import (
	"context"
	"encoding/hex"
	"fmt"
	"math/rand"
	"reflect"
	"testing"
)

// Tests caclculating disk count.
func TestDiskCount(t *testing.T) {
	testCases := []struct {
		disks     []StorageAPI
		diskCount int
	}{
		// Test case - 1
		{
			disks:     []StorageAPI{&xlStorage{}, &xlStorage{}, &xlStorage{}, &xlStorage{}},

			st.Status = s.Status
			return nil
		}
		sm.resyncStatus[s.ResyncID] = st
		return saveSiteResyncMetadata(GlobalContext, st, newObjectLayerFn())
	}
	return nil
}

// increment SyncedBuckets count
func (sm *siteResyncMetrics) incBucket(o resyncOpts, bktStatus ResyncStatusType) {
	if !globalSiteReplicationSys.isEnabled() {
		return
	}
	sm.Lock()
	defer sm.Unlock()
	st, ok := sm.resyncStatus[o.resyncID]

	if k == nil {
		return nil, Errorf("KMS not configured")
	}

	if len(metadata) != len(buckets) || len(metadata) != len(objects) {
		return nil, Errorf("invalid metadata/object count: %d != %d != %d", len(metadata), len(buckets), len(objects))
	}

	keyIDs := make([]string, 0, len(metadata))
	kmsKeys := make([][]byte, 0, len(metadata))
	sealedKeys := make([]SealedKey, 0, len(metadata))